Scilico I, Librarian Access Control Error Vulnerability

Scilico I, Librarian is the United States Scilico company a set of online PDF document management system. An access control error vulnerability exists in the ajaxdiscussion.php file in Scilico I, Librarian 4.9 and earlier versions. An attacker can exploit this vulnerability to gain unauthorized...

Improper access control

I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access read, write and delete to project discussions...

CVE-2018-1000141

I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access read, write and delete to project discussions...

Vanilla: A user can comment in private discussions without having permission to access the discussion

Hello team, I have found a vulnerability which allows a user who does not have access to a discussion to comment on it and thus avoid the control applied. http://littleguy.vanillastaging.com/ Proof Of Concept ============= For this proof of concept I have used 3 users. User A creates a PRIVATE...

Friday Squid Blogging: Squid Pin

There's a squid pin on Kickstarter. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Drupal Open Atrium module Discussions sub module security vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a collaborative team development module based on the Drupal platform.Discussions sub module is one of the sub-modules. A security vulnerability exists in the...

CVE-2014-9503: Undefined Security Weakness

The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging improper access checks on unspecified ajax callbacks...

Level up your cybersecurity journey with CLOUDSEC 2017

Beginning this month, Trend Micro will be hosting CLOUDSEC, one of the largest cybersecurity conferences across Asia-Pacific and Europe. The event features presentations and panel discussions from industry experts and thought leaders who will discuss high-level strategies, forward looking securit...

Security and Human Behavior (SHB 2017)

I'm in Cambridge University, at the tenth Workshop on Security and Human Behavior. SHB is a small invitational gathering of people studying various aspects of the human side of security, organized each year by Ross Anderson, Alessandro Acquisti, and myself. The 50 or so people in the room include...

CISO Forum 2017

Last week I have attended CISO Forum 2017 in Moscow. I was talking there about "Vulnerability Quadrants: automated hot topic detection in public vulnerability CVE flow". Today I want to share my impressions about the forum itself. To be short, I liked it very much. Both exhibition and...

UBUNTU-CVE-2016-3731

Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions...

CVE-2016-3731

CVE-2016-3731 affects Moodle 3.0 (3.0.0–3.0.3), 2.9 (2.9.0–2.9.5), and 2.8 (2.8.0–2.8.11). The vulnerability allows remote attackers to obtain the names of hidden forums and forum discussions. The provided documents do not include exploit details, affected module specifics beyond the version rang...

Former Cardinals Scout Christopher Correa Sentenced Four Years for Houston Astros Hack

The Federal Court came down hard on a former scouting director for the St. Louis Cardinals on Monday, sentencing Christopher Correa to almost four years in prison for hacking into a computer system that belongs to the Houston Astros. Correa, who until last summer served as Director of Baseball...

PT-2014-8301

Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.x through 2.6.5 Moodle versions 2.7.x through 2.7.2 Description The issue allows remote authenticated users to access a forum without proper group permission verification. This is due to a problem in the...

PT-2014-5422

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.4.11 Moodle versions 2.5.x prior to 2.5.8 Moodle versions 2.6.x prior to 2.6.5 Moodle versions 2.7.x prior to 2.7.2 Description The issue allows remote authenticated users to bypass the individual answer-posting...

Social Discussions - Multiple Path Disclosure

The Social Discussions WordPress plugin was affected by a Multiple Path Disclosure security vulnerability...

wordpress social discussions plugin 6.1.1 - Multiple Vulnerabilities

No description provided by source. waraxe-2012-SA093 - Multiple Vulnerabilities in Wordpress Social Discussions Plugin ====================================================================================== Author: Janek Vind waraxe Date: 17. October 2012 Location: Estonia, Tartu Web:...

Service Disruption or Destruction: Which is Worse?

Outcomes in security tend to be about data loss; stolen pharmaceutical formulas, jet fighter blueprints, patient records, credit card numbers etc. All of these come with a great cost to the victim and make for sexy headlines. But far too little is dissected and analyzed about service disruptions...

WordPress Social Discussions Plugin 6.1.1 - Multiple Vulnerabilities

WordPress Social Discussions plugin is prone to remote file inclusion and full path disclosure in multiple scripts vulnerabilities. Solution Update the plugin...

WordPress Social Discussions Plugin 6.1.1 - Multiple Vulnerabilities

WordPress Social Discussions plugin is prone to remote file inclusion and full path disclosure in multiple scripts vulnerabilities. Solution Update the plugin...