Vanilla: A user can comment in private discussions without having permission to access the discussion

Hello team, I have found a vulnerability which allows a user who does not have access to a discussion to comment on it and thus avoid the control applied. http://littleguy.vanillastaging.com/ Proof Of Concept ============= For this proof of concept I have used 3 users. User A creates a PRIVATE...

Friday Squid Blogging: Squid Pin

There's a squid pin on Kickstarter. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Drupal Open Atrium module Discussions sub module security vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a collaborative team development module based on the Drupal platform.Discussions sub module is one of the sub-modules. A security vulnerability exists in the...

Level up your cybersecurity journey with CLOUDSEC 2017

Beginning this month, Trend Micro will be hosting CLOUDSEC, one of the largest cybersecurity conferences across Asia-Pacific and Europe. The event features presentations and panel discussions from industry experts and thought leaders who will discuss high-level strategies, forward looking securit...

Security and Human Behavior (SHB 2017)

I'm in Cambridge University, at the tenth Workshop on Security and Human Behavior. SHB is a small invitational gathering of people studying various aspects of the human side of security, organized each year by Ross Anderson, Alessandro Acquisti, and myself. The 50 or so people in the room include...

CISO Forum 2017

Last week I have attended CISO Forum 2017 in Moscow. I was talking there about "Vulnerability Quadrants: automated hot topic detection in public vulnerability CVE flow". Today I want to share my impressions about the forum itself. To be short, I liked it very much. Both exhibition and...

UBUNTU-CVE-2016-3731

Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions...

CVE-2016-3731

CVE-2016-3731 affects Moodle 3.0 (3.0.0–3.0.3), 2.9 (2.9.0–2.9.5), and 2.8 (2.8.0–2.8.11). The vulnerability allows remote attackers to obtain the names of hidden forums and forum discussions. The provided documents do not include exploit details, affected module specifics beyond the version rang...

Former Cardinals Scout Christopher Correa Sentenced Four Years for Houston Astros Hack

The Federal Court came down hard on a former scouting director for the St. Louis Cardinals on Monday, sentencing Christopher Correa to almost four years in prison for hacking into a computer system that belongs to the Houston Astros. Correa, who until last summer served as Director of Baseball...

Social Discussions - Multiple Path Disclosure

The Social Discussions WordPress plugin was affected by a Multiple Path Disclosure security vulnerability...

wordpress social discussions plugin 6.1.1 - Multiple Vulnerabilities

No description provided by source. waraxe-2012-SA093 - Multiple Vulnerabilities in Wordpress Social Discussions Plugin ====================================================================================== Author: Janek Vind waraxe Date: 17. October 2012 Location: Estonia, Tartu Web:...

Service Disruption or Destruction: Which is Worse?

Outcomes in security tend to be about data loss; stolen pharmaceutical formulas, jet fighter blueprints, patient records, credit card numbers etc. All of these come with a great cost to the victim and make for sexy headlines. But far too little is dissected and analyzed about service disruptions...

WordPress Social Discussions Plugin 6.1.1 - Multiple Vulnerabilities

WordPress Social Discussions plugin is prone to remote file inclusion and full path disclosure in multiple scripts vulnerabilities. Solution Update the plugin...

WordPress Plugin social discussions 6.1.1 - Multiple Vulnerabilities

WordPress Plugin social discussions 6.1.1 - Multiple Vulnerabilities waraxe-2012-SA093 - Multiple Vulnerabilities in Wordpress Social Discussions Plugin ====================================================================================== Author: Janek Vind "waraxe" Date: 17. October 2012...

WordPress Social Discussions Plugin 6.1.1 - Multiple Vulnerabilities

WordPress Social Discussions plugin is prone to remote file inclusion and full path disclosure in multiple scripts vulnerabilities. Solution Update the plugin...

[waraxe-2012-SA#093] - Multiple Vulnerabilities in Wordpress Social Discussions Plugin

waraxe-2012-SA093 - Multiple Vulnerabilities in Wordpress Social Discussions Plugin ====================================================================================== Author: Janek Vind "waraxe" Date: 17. October 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-93.html...

Wordpress Social Discussions 6.1.1 File Inclusion / Path Disclosure

waraxe-2012-SA093 - Multiple Vulnerabilities in Wordpress Social Discussions Plugin ====================================================================================== Author: Janek Vind "waraxe" Date: 17. October 2012 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-93.html...

WordPress Social Discussions Plugin Multiple Vulnerabilities

WordPress Social Discussions Plugin is prone to remote file inclusion and full path disclosure vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Hacker Claims Compromise of IT Recruiter

A hacker affiliated with a group called TeamGhostShell claims he hacked into a website servicing IT professionals seeking jobs on Wall Street, and in doing so compromised the personal information of thousands of job applicants, according to a ComputerWorld report. A hacker identifying himself as...

Joomla Discussions SQL Injection

Title : Joomla Discussions Component comdiscussions SQL Injection Vulnerability Author : Red Security TEAM Date : 17/01/2012 Risk : High Software : http://extensions.joomla.org/extensions/communication/forum/13560 Tested On : CentOS Contact : Info 4t RedSecurity d0t COM Home :...