CVE-2020-8894

An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php...

CVE-2020-8894

An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php...

Design/Logic Flaw

An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php...

CVE-2020-8894

An issue was discovered in MISP before 2.4.121. ACLs for discussion threads were mishandled in app/Controller/ThreadsController.php and app/Model/Thread.php...

PT-2020-20355 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.121 Description: An issue was discovered where ACLs for discussion threads were mishandled in the ThreadsController.php and Thread.php files. Recommendations: For versions prior to 2.4.121, update to version 2.4.121...

CVE-2020-8894

CVE-2020-8894 concerns MISP before 2.4.121, where ACLs for discussion threads were mishandled in the code paths of ThreadsController.php and Thread.php. The vulnerability arises from improper access control logic, enabling potential permission misconfigurations or exposure of thread discussions d...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I'm speaking at Indiana University Bloomington on January 30, 2020. I'll be at RSA Conference 2020 in San Francisco. On Wednesday, February 26, at 2:50 PM, I'll be part of a panel on "How to Reduce Supply Chain Risk: Lessons from...

Mail.ru: Stored XSS on https://community.my.games/ (Add Post)

Two stored XSS at https://community.my.games/. First XSS via upload photo title at link https://community.my.games/community/game/GameName/ . Second XSS via Discussion at the same link...

TYPO3 wec_discussion extension SQL Injection Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. wecdiscussion extension is a third-party forum extension plugin used in it. A SQL injection vulnerability exists in TYPO3 wecdiscussion extension versions prior to 2.1.1. The...

PT-2019-6673

Name of the Vulnerable Software and Affected Versions TYPO3 Core wec discussion extension versions prior to 2.1.1 Description The issue is related to SQL Injection due to improper sanitation of user-supplied input. This allows for potential exploitation by injecting malicious SQL code...

Friday Squid Blogging: Piglet Squid

Another piglet squid video. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

CVE-2016-10969

The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title...

CVE-2016-10969

The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title...

Design/Logic Flaw

The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title...

CVE-2016-10969

The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title...

CVE-2016-10969

CVE-2016-10969: The WordPress SupportFlow plugin is vulnerable to stored XSS via a discussion ticket title in versions before 0.7. The issue originates from the plugin’s handling of ticket titles, enabling script injection that could execute in a user’s browser. Affects the SupportFlow WordPress ...

CVE-2016-10969

The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title...

CVE-2016-10969: Improper Neutralization of Input During Web Page Generation

The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title...

PT-2019-7762

Name of the Vulnerable Software and Affected Versions Supportflow plugin versions prior to 0.7 Description The issue allows for XSS via a discussion ticket title, potentially affecting WordPress sites using the Supportflow plugin. Recommendations For versions prior to 0.7, update to version 0.7 o...

GitLab Restriction Bypass Vulnerability (CNVD-2019-31324)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...