Deep Dive Into 6 Key Steps to Accelerate Your Incident Response

Organizations rely on Incident response to ensure they are immediately aware of security incidents, allowing for quick action to minimize damage. They also aim to avoid follow on attacks or future related incidents. The SANS Institute provides research and education on information security. In th...

Partnering and prioritization: Lessons learned when building security operations at hyperspeed

CISOs share their experiences ensuring security in fast-growth environments...

Node.js March 17th Infrastructure Incident Post-mortem

Node.js March 17th Infrastructure Incident Post-mortem By Matt Cowley, Claudio Wunder, Mar 23, 2023 The Incident Starting on March 15th and going through to March 17th with much of the issue being mitigated on the 16th, users were receiving intermittent 404 responses when trying to download Node....

Deploying Akamai MFA at Scale: 6 Lessons Learned

Planning a multi-factor authentication MFA rollout? Take a look at the six lessons we learned when we deployed Akamai MFA...

[Template] Incident Response for Management Presentation

Security incidents occur. It's not a matter of "if," but of "when." That's why you implemented security products and procedures to optimize the incident response IR process. However, many security pros who are doing an excellent job in handling incidents find effectively communicating the ongoing...

CVE-2021-24713

The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks...

CVE-2021-24713

The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks...

CVE-2021-24713

The CVE-2021-24713 entry affects the WordPress plugins Video Lessons Manager (before 1.7.2) and Video Lessons Manager Pro (before 3.5.9). The root cause is improper sanitization/escaping when updating settings, enabling stored Cross-Site Scripting by privileged users. Reported impacts include XSS...

CVE-2021-24713 Video Lessons Manager - Admin+ Stored Cross-Site Scripting

The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Video Lessons Manager, which stems from a...

PT-2021-16216

Name of the Vulnerable Software and Affected Versions Video Lessons Manager WordPress plugin versions prior to 1.7.2 Video Lessons Manager Pro WordPress plugin versions prior to 3.5.9 Description The issue concerns the improper sanitization and escaping of values when updating settings, potential...

Evolving Zero Trust—Lessons learned and emerging trends

Looking back at the last two years, to say that our security strategies have evolved would be an understatement. Organizations around the world made overnight transitions to remote work models in response to a global pandemic, forcing them to reassess attack surface areas as they underwent an...

Video Lessons Manager - Admin+ Stored Cross-Site Scripting

The plugins do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks PoC Open the CM Video Lesson Plugin's Settings page. Click on Label Tab Enter payload like " into the "channel" or "channels" fields...

WordPress Video Lessons Manager Pro premium plugin <= 3.5.8 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Shivam Rai in WordPress Video Lessons Manager Pro premium plugin versions = 3.5.8. Solution Update the WordPress Video Lessons Manager Pro premium plugin to the latest available version at least 3.5.9...

Tutor LMS < 1.9.9 - Multiple Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Put the following payload in the Plugin's Settings General "Error message for...

3 security lessons from an MSP that survived the Kaseya VSA attack

Jay Tipton, chief executive for the Managed Service Provider MSP Technology Specialists, remembers his Fourth of July weekend this year like many MSP employees likely remember theirs: As a bit of a nightmare. “That’s like the worst feeling you’ll ever have,” Tipton said about his initial...

Cutting the Red Tape: Lessons Learned from CyberThreats 2021

If I had a dollar for every time I heard the phrase “digital transformation,” I would have a lot of dollars. I’m sure you would too. We’d have even more if we counted the term “Zero Trust.” Maybe we should start counting them, now that I think about it!...

Scholastic Online School App Has Logic Flaw Vulnerability

Scholastic Online School App is a mobile application that provides private customized courses for students and friends. A logic flaw vulnerability exists in Scholastic Online School APP, which can be exploited by attackers to obtain sensitive information...

Shifting Threats in a Changed World: Edge, IoT and Vaccine Fraud

Though it’s often hard to find group consensus, one thing everyone can agree on is a feeling of relief that we may be moving past the worst of the pandemic. While few want to look back on the darkest times, those months have continuing lessons to teach about cybersecurity. Like it or not, the...

Authentication: Lessons Learned From Microsoft Exchange And F5 Big-IP Hacks

The past month has been a very dynamic time in the world of security for hackers and threat researchers, but it has been an extended nightmare for CSOs responsible for securing their enterprise networks...