WordPress WP Courses LMS plugin <= 2.0.28 - Broken Access Controls leading to Courses Content Disclosure vulnerability

Broken Access Controls leading to Courses Content Disclosure vulnerability found by Marco Ortisi redtimmysec in WordPress WP Courses LMS plugin versions = 2.0.28. Solution Update the WordPress WP Courses LMS plugin to the latest available version at least 2.0.29...

WP Courses < 2.0.29 - Broken Access Controls leading to Courses Content Disclosure

The plugin does not protect the courses which could be accessed by unauthenticated users using the REST API /wp-jon/ endpoints. This could result in attackers accessing paying content without authorisation...

OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.

...

Akamai Identified as a Leader Among Zero Trust Providers by Independent Research Firm

We are pleased to share that Akamai has been identified as a Leader in The Forrester Wave™: Zero Trust eXtended Ecosystem Platform Providers, Q3 2020. In the report, Forrester evaluated how each vendor's portfolio maps and delivers on specific components of the Zero Trust eXtended ZTX framework...

Secure Cloud Infrastructures with Application Security

Watch this video to see how applications can be simplified with serverless technologies and how security and monitoring controls can be seamlessly maintained in these constrained environments...

Design/Logic Flaw

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could...

CVE-2019-15993 Cisco Small Business Switches Information Disclosure Vulnerability

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could...

CVE-2019-15993 Cisco Small Business Switches Information Disclosure Vulnerability

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to access sensitive device information. The vulnerability exists because the software lacks proper authentication controls to information accessible from the web UI. An attacker could...

Speed 2 – The Poseidon Adventure – Part Two

This post is a companion to the DEF CON 28 video available here Part One is available here Issue 3: Time and Tide Wait for No VLAN As mentioned the cabin switch appeared to be the key to all our access requirements. From that we could get to the trunk network, and all those TV, VOIP, and Wi-Fi...

Rethinking Defensive Strategy at the Edge, Part 2: Risk Signals as Security Controls

In the first post in our blog series Rethinking Defensive Strategy at the Edge, we began to outline why a new defensive edge strategy is needed for today's enterprise. As previously mentioned, the strategy enhances those in place and introduces another layer of defense that includes the following...

Huawei Data Communication: Read current-configuration configuration section include multicast routing-enable

Get the sections with multicast routing-enable of the VRP device. Note: This script only stores information for other Policy Controls. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Huawei Data Communication: Read current-configuration configuration section include multicast routing-enable

Get the sections with multicast routing-enable of the VRP device. Note: This script only stores information for other Policy Controls. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2020-7294

Privilege Escalation vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows authenticated user interface user to delete or download protected files via improper access controls in the REST interface...

CVE-2020-7294

Privilege Escalation vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows authenticated user interface user to delete or download protected files via improper access controls in the REST interface...

CVE-2020-7293

Privilege Escalation vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows authenticated user interface user with low permissions to change the system's root password via improper access controls in the user interface...

Privilege escalation

Privilege Escalation vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface...

Privilege escalation

Privilege Escalation vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows authenticated user interface user to delete or download protected files via improper access controls in the REST interface...

CVE-2020-7295

CVE-2020-7295 is a privilege-escalation vulnerability in McAfee Web Gateway (MWG) prior to version 9.2.1. An authenticated UI user can delete or download protected log data due to improper access controls in the user interface. This description is consistently reported across multiple sources (NV...

CVE-2020-7295 Web Gateway (MWG) - Privilege Escalation vulnerability

Privilege Escalation vulnerability in McAfee Web Gateway MWG prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface...

CVE-2020-7294

CVE-2020-7294 affects McAfee Web Gateway (MWG) prior to 9.2.1. The issue is an elevation of privilege due to improper access controls in the REST interface, allowing an authenticated UI user to delete or download protected files. Root cause: REST interface access control weaknesses. Impact: privi...