GitLab: Last build status and coverage leaked to unauthorized users

GitLab CI supports creating badges for the latest build/coverage on a certain branches. However, with restricted access, where users do not have access to pipelines, users still have access to the build/coverage status of any branch. This access works for different configurations: 1. For public...

Badgelife: A Defcon 26 retrospective

One more year gone, one more Defcon completed. Defcon is the longest-running security conference in existence and one that I have been attending since Defcon 18. It is an opportunity to see and interact in real life with industry peers that would forever remain a digital persona otherwise. It is...

Moodle 2.x / 3.x Multiple Vulnerabilities (May 2016) - Linux

Moodle CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

HackerOne: Leakage badges on disabled user

Indonesia Here ; Hi HackerOne Team, Description: This attack occurs when an attacker uses this graphql code: and this builds the path of the attacker getting disclosure information about how many programs already in the close Resolved from the Public or Disable user. okay now I do not say if the...

Vulnerability Found in Two Keyless Entry Locks

Researchers at Dell Secureworks are warning a vulnerability in two keyless entry products could allow local attackers to lock and unlock doors and create illegitimate RFID badges by sending unauthenticated requests to affected devices. Impacted are two AMAG Technology Symmetry IP-based access doo...

Information Disclosure

Moodle is vulnerable to information disclosure. The library does not properly enforce the moodle/badges:viewbadges capability, allowing an authenticated malicious user to view sensitive information through badges/overview.php or badges/view.php...

Girl Scouts to Offer Merit Badges in Cybersecurity

The Girl Scouts are going to be offering 18 merit badges in cybersecurity, to scouts as young as five years old...

Mixmax: Stored XSS in Templates>Enahance>Social Badges

Hi, just like the report 237927, I found stored XSS in TemplatesEnhance Social Badges section. 1. Go to templates section and click on one of your templates. 2. Enhance Social Badges. 3. Enter the payload: javascript:alert1 in any of the social networking button url. 4. You'll see that the xss is...

CVE-2016-3732

The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users...

CVE-2016-3732

The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users...

UBUNTU-CVE-2016-3732

The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users...

WordPress rockhoist-badges plugin cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language.REST API can transfer data via JSON format to access or control the content of the WordPress site. A cross-site scripting vulnerability exists in the WordPress rockhoist-badges plugin due to a failure to adequately validate user...

CVE-2017-6102

Persistent XSS in wordpress plugin rockhoist-badges v1.2.2...

CVE-2017-6102

Persistent XSS in wordpress plugin rockhoist-badges v1.2.2...

CVE-2017-6102

Persistent XSS in wordpress plugin rockhoist-badges v1.2.2...

CVE-2017-6102

CVE-2017-6102 affects the WordPress plugin rockhoist-badges v1.2.2, with a persistent (stored) XSS flaw caused by insufficient input validation. Several connected sources describe this as an authenticated stored XSS vulnerability that could allow an attacker to execute scripts in a victim’s brows...

Moodle 2.6.x < 2.6.2 Multiple Vulnerabilities

Binary data 9424.prm...

Moodle 2.5.x < 2.5.5 Multiple Vulnerabilities

Binary data 9423.prm...

Moodle 2.7.x < 2.7.14 Multiple Vulnerabilities

Binary data 9428.prm...

Moodle Design Vulnerability (CNVD-2016-03328)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. There is a design flaw in Moodle. An attacker can view other users' badges with the he...