CVE-2023-0178 Annual Archive < 1.6.0 - Contributor+ Stored XSS

The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress plugin Annual Archive 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on PHP and MySQL servers. A cross-site scripting...

WordPress Annual Archive Plugin < 1.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Annual Archive Type Plugin Vulnerable versions 1.6.0 Fixed in 1.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0178 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e447b05c3b01 Credits Lana Codes Required...

Annual Archive < 1.6.0 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. archives tag='ul onmouseover="alert1"'...

Why does technology no longer excite us? Lock and Code S04E01

When did technology last excite you? If Douglas Adams, author of The Hitchhiker's Guide to the Galaxy, is to be believed, your own excitement ended, simply had to end, after turning 35 years old. Decades ago, at first writing privately and later having those private writings published after his...

Conti vs. LockBit: A Comparative Analysis of Ransomware Groups

We compare the targeting and business models of the Conti and LockBit ransomware groups using data analysis approaches. This will be presented in full at the 34th Annual FIRST Conference on June 27, 2022...

US senators introduce the Kids Online Safety Act (KOSA)

US Senators Richard Blumenthal of Connecticut and Marsha Blackburn of Tennessee have introduced the Kids Online Safety Act KOSA, legislation that aims to enhance childrens safety online. This follows the The Wall Street Journal WSJs reporting on the harm Instagram can inflict on teens, which was...

The 2021 Naughty and Nice Lists: Cybersecurity Edition

Editor’s note: We had planned to publish our Hacky Holidays blog series throughout December 2021 – but then Log4Shell happened, and we dropped everything to focus on this major vulnerability that impacted the entire cybersecurity community worldwide. Now that it’s 2022, we’re feeling in need of...

NCSC Releases 2021 Annual Review

The United Kingdom UK National Cyber Security Centre NCSC has released its Annual Review 2021, which focuses on its response to evolving and challenging cyber threats. The publication contains highlights of NCSC’s collaboration with trusted cybersecurity partners, including CISA. Examples include...

ca-certificates bug fix and enhancement update

The ca-certificates package contains a set of Certificate Authority CA certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure PKI. Bug Fixes and Enhancements: Annual 2021 ca-certificates update 2.48 from nss 3.66 for Firefox 91 BZ1971200...

ACSC Releases Annual Cyber Threat Report

The Australian Cyber Security Centre ACSC has released its annual report on key cyber security threats and trends for the 2020–21 financial year. The report lists the exploitation of the pandemic environment, the disruption of essential services and critical infrastructure, ransomware, the rapid...

Security and Human Behavior (SHB) 2021

Today is the second day of the fourteenth Workshop on Security and Human Behavior. The University of Cambridge is the host, but were all on Zoom. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of security, organized each year by Alessandro...

CVE-2021-31166

HTTP Protocol Stack Remote Code Execution Vulnerability Recent assessments: architect00 at May 12, 2021 8:18am UTC reported: The vulnerability only affects newer versions of Windows 10 / Server. Version 20H2 and 2004 of Windows 10 and Windows Server Core installations are affected according to th...

11-13 year old girls most likely to be targeted by online predators

The Internet Watch Foundation IWF, a not-for-profit organization in England whose mission is "to eliminate child sexual abuse imagery online", has recently released its analysis of online predator victimology and the nature of sexual abuse media that is currently prevalent online. The scope of th...

Akamai Foundation: Our Chance to Give Back

The Akamai Foundation was set up in 2018 to improve the impact and focus of our long-term philanthropic activities. Importantly, we wanted to support the next generation of technology innovators; promoting the pursuit of excellence in STEM education amongst school children. Our work had an...

Trend Micro 2020 Annual Cybersecurity Report

Reviewing the most important cybersecurity stories, issues, and trends that occurred over 2020, this annual report aims to equip security leaders with valuable insight and tools so they can focus on both protecting and enabling the organization...

Krakow Internship

The beginning of a new year is a time to look back and reflect on the previous one. December 31st is also the end date of our annual Krakow Internship Program...

Why Data Privacy Day matters

Our Lock and Code special episode on Data Privacy Day, featuring guests from Mozilla, DuckDuckGo, and Electronic Frontier Foundation can be listened to here. Today, January 28, is Data Privacy Day, the annual, multinational event in which governments, companies, and schools can inform the public...

Working Together with Our Customers to Build a Sustainable Future

By now, we hope you've read Monday's and Tuesday's blog posts announcing the release of our annual sustainability report, our sustainability program, and the technical innovation behind it...

Happy HaXmas from the Rapid7 Team!

Happy HaXmas, everyone! This has been quite the year, but we’re thrilled that we’re able to keep up our favorite holiday tradition of our annual HaXmas blog series, which features holiday stories, hacking wins from the year, tips and tricks, and general festivity to keep you entertained during th...