WordPress plugin FeedWordPress 跨站脚本漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. A security vulnerability exists in previous versions of the WordPress plugin FeedWordPress 2022.0123, which stems from a lack of effective filtering and escaping of the "visibility" parameter. No detail...

Hadoop token in temp file visible to all users in Apache Gobblin

In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions = 0.15.0. Users should update to version 0.16.0 which addresses this issue...

[Security Nation] John Rouffas on Building a Security Function

!\Security Nation\ John Rouffas on Building a Security Functionhttps://blog.rapid7.com/content/images/2022/02/securitynationlogo--1-.jpg In this episode of Security Nation, Jen chats with John Rouffas, CISO at intelliflo, about his experience building out a security function and team at a young a...

Webinar: How to See More, But Respond Less with Enhanced Threat Visibility

The subject of threat visibility is a recurring one in cybersecurity. With an expanding attack surface due to the remote work transformation, cloud and SaaS computing and the proliferation of personal devices, seeing all the threats that are continuously bombarding the company is beyond...

CVE-2021-40695

It was possible for a student to view their quiz grade before it had been released, using a quiz web service...

Cyber Threat Protection — It All Starts with Visibility

Just as animals use their senses to detect danger, cybersecurity depends on sensors to identify signals in the computing environment that may signal danger. The more highly tuned, diverse and coordinated the senses, the more likely one is to detect important signals that indicate danger. This,...

Will 2022 Be the Year of the Software Bill of Materials?

Here, have a can of soup. Nah, we don’t know what’s in it. Could be 30 percent insect parts, could be seasoned with rat hair, who can say? The ingredients keep changing anyway. Just pour it into your network and pray. That, unfortunately, is the current state of cybersecurity: a teeth-grinding...

DEBIAN-CVE-2022-21695

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users or unauthenticated in public mode can send messages without being visible in the list of chat participants. Th...

PYSEC-2022-46

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users or unauthenticated in public mode can send messages without being visible in the list of chat participants. Th...

CVE-2022-21695

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users or unauthenticated in public mode can send messages without being visible in the list of chat participants. Th...

3 Data Source Coverage Capabilities You Need from Your Database Security Solution

When Henry Ford, the de-facto inventor of mass production, was asked during a production meeting in 1909 in which colors his Model T automobile would be available to consumers, Ford - a notorious stickler for keeping costs to the bare minimum - offered almost no optional extras and that included...

FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS)

The plugin is affected by a Reflected Cross-Site Scripting XSS within the "visibility" parameter. PoC https://example.com/wp-admin/admin.php?page=feedwordpress%2Fsyndication.php=%22%3E%3Cimg+src%3D2+onerror%3Dalert%28origin%29%3E...

GHSA-64G7-MVW6-V9QJ Improper Privilege Management in shelljs

Impact Output from the synchronous version of shell.exec may be visible to other users on the same system. You may be affected if you execute shell.exec in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec as the root user. Other shelljs functions including the asynchronous...

CVE-2022-21677

Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members. By default, a newly created group has its visibility set to public and the group's members visibility set to public as well. However, a...

Spoofing

Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members. By default, a newly created group has its visibility set to public and the group's members visibility set to public as well. However, a...

CVE-2022-21677 Group advanced search option may leak group and group's members visibility

Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members. By default, a newly created group has its visibility set to public and the group's members visibility set to public as well. However, a...

CVE-2022-21677

CVE-2022-21677 affects Discourse prior to versions 2.7.13 and 2.8.0.beta11, where the group advanced search option could reveal restricted group visibility or members visibility. The root cause is that search did not respect the configured visibility levels. The issue results in information discl...

CVE-2022-21677 Group advanced search option may leak group and group's members visibility

Discourse is an open source discussion platform. Discourse groups can be configured with varying visibility levels for the group as well as the group members. By default, a newly created group has its visibility set to public and the group's members visibility set to public as well. However, a...

Automating Agent-less Vulnerability Assessment for Intune Enrolled Mobile Devices

Most Mobile Device Management solutions lack critical functionality such as vulnerability assessment and patch management. Integration with a popular MDM like Microsoft Intune allows Qualys to provide automated onboarding and continuous scanning of your mobile devices, among other functions to...

PT-2022-15029 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.7.13 Discourse versions prior to 2.8.0.beta11 Description: A vulnerability has been discovered in Discourse where the group advanced search option does not respect the group's visibility and members visibility...