CVE-2023-46746

CVE-2023-46746 concerns PostHog (self-hosted) where a server-side request forgery (SSRF) vulnerability could be exploited by authenticated users. The root cause is that PostHog did not verify whether a URL is local when enabling webhooks, allowing an authenticated user to forge a POST request. Th...

CVE-2023-37891

Cross-Site Request Forgery CSRF vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin = 2.0.4 versions...

CVE-2023-37891: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin = 2.0.4 versions...

WordPress Nugget by Ingot: Easy, automated and native A/B testing for everyone Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Nugget by Ingot: Easy, automated and native A/B testing for everyone Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

Better A/B Testing with EdgeWorkers + EdgeKV

Learn how to use Akamai EdgeWorkers and EdgeKV to create easy-to-control A/B tests...

CVE-2022-36065 GrowthBook account creation and file upload vulnerability in self-hosted configurations

GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can register new accounts and upload files to arbitrary directories within the container. If the attacker uploads a Python script to the righ...

CVE-2022-36065

GrowthBook (self-hosted) prior to 2022-08-29 is affected by an account creation and arbitrary file-upload vulnerability that can lead to remote code execution if a Python script is uploaded to an arbitrary directory inside the container. Exploitation requires all of: self-hosted deployment (Growt...

WordPress "Nugget by Ingot: Easy, automated and native A/B testing for everyone" plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Nugget by Ingot: Easy, automated and native A/B testing for everyone" plugin versions = 1.0.0. Solution No patched version available...

WordPress "Nugget by Ingot: Easy, automated and native A/B testing for everyone" plugin <= 1.0.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "Nugget by Ingot: Easy, automated and native A/B testing for everyone" plugin versions = 1.0.0. Solution No patched version available...

A/B Testing, Now with EdgeKV

This blog was co-authored by Tim Vereecke, Josh Johnson, and Medhat Yakan This is a blog series about building an A/B test with EdgeWorkers and EdgeKV. Read part one here. In our previous blog, we wrote the base code for our A/B test and stored the data locally. Although this may be convenient fo...

A/B Testing, Now with EdgeKV

Now that we've written the framework of our code, let's layer in EdgeKV EKV, our distributed key-value store database...

GitLab File Read Remote Code Execution Exploit

This Metasploit module provides remote code execution against GitLab Community Edition CE and Enterprise Edition EE. It combines an arbitrary file read to extract the Rails secretkeybase, and gains remote code execution with a deserialization vulnerability of a signed experimentationsubjectid...

GitLab File Read Remote Code Execution

This module provides remote code execution against GitLab Community Edition CE and Enterprise Edition EE. It combines an arbitrary file read to extract the Rails "secretkeybase", and gains remote code execution with a deserialization vulnerability of a signed 'experimentationsubjectid' cookie tha...

Introducing Serverless Computing at the Edge with Akamai EdgeWorkers

For the first time, Akamai is introducing an all-new serverless compute capability to help you customize web traffic, expanding the possibilities of personalized engagement with your customers while putting the flexibility and control in the hands of your developers. Developers can now manipulate...