GHSA-8MM2-M2GP-C6X2 Moodle Improper Access Control vulnerability

Students in "Only see own membership" groups could see other students in the group, which should be hidden...

Moodle Improper Access Control vulnerability

Students in "Only see own membership" groups could see other students in the group, which should be hidden...

CVE-2023-5542

Students in "Only see own membership" groups could see other students in the group, which should be hidden...

CVE-2023-5542

Students in "Only see own membership" groups could see other students in the group, which should be hidden...

Design/Logic Flaw

Students in "Only see own membership" groups could see other students in the group, which should be hidden...

CVE-2023-5542

Students in "Only see own membership" groups could see other students in the group, which should be hidden...

UBUNTU-CVE-2023-5542

Students in "Only see own membership" groups could see other students in the group, which should be hidden...

CVE-2023-5542

CVE-2023-5542 corresponds to an improper access control issue in Moodle: students in an "Only see own membership" group could view other students in the same group. This is corroborated by OSV and GHSA entries (BIT-MOODLE-2023-5542, GHSA-8MM2-M2GP-C6X2) describing the same behavior. Public refere...

CVE-2023-5542 Moodle: students can view other users in "only see own membership" groups

Students in "Only see own membership" groups could see other students in the group, which should be hidden...

PT-2023-8912

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description The issue is related to the Separate Groups mode in the forum summary report, where restrictions were not properly enforced, allowing the display of users from other groups. This could...

PT-2023-32165 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue allows students in "Only see own membership" groups to see other students in the group, which should be hidden. Recommendations: At the moment, there is no information about a newe...

GhostLocker - A “Work In Progress” RaaS

This post was also authored by Anna Širokova Executive Summary In recent years, there has been a noticeable uptick in threat actors venturing into the realm of Ransom-as-a-Service RaaS. Some have emerged as significant threats, while others have faded into obscurity. What makes the current...

CVE-2023-45140

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnorm...

CVE-2023-45140

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnorm...

CVE-2023-45140 Group-based JIT MFA bypass on scp and sftp in The Bastion

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnorm...

CVE-2023-45140 Group-based JIT MFA bypass on scp and sftp in The Bastion

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnorm...

Experts Expose Farnetwork's Ransomware-as-a-Service Business Model

Cybersecurity researchers have unmasked a prolific threat actor known as farnetwork, who has been linked to five different ransomware-as-a-service RaaS programs over the past four years in various capacities. Singapore-headquartered Group-IB, which attempted to infiltrate a private RaaS program...

PT-2023-6781

Name of the Vulnerable Software and Affected Versions SysAid On-Premise versions prior to 23.3.36 Description A path traversal vulnerability in SysAid On-Premise software leads to code execution after an attacker writes a file to the Tomcat webroot. This issue has been exploited in the wild, with...

PT-2023-29435 · Unknown · The Bastion

Name of the Vulnerable Software and Affected Versions: The Bastion versions prior to 3.14.15 Description: The Bastion provides authentication, authorization, traceability, and auditability for SSH accesses. However, SCP and SFTP plugins do not honor group-based Just-In-Time JIT Multi-Factor...

Enough Polynomials and Linear Algebra to Implement Kyber

I was once talking with a mathematician and trying to explain elliptic curve cryptography. Eventually, something clicked and they went "oh, that! I think there was a chapter about it in the book. You made a whole field out of it?" Yes, in cryptography we end up focusing on a very narrow slice of...