New Version of ViperSoftX Malware Targets Password Managers and Cryptocurrency Wallets

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ViperSoftX is an information-stealing malware primarily targeting cryptocurrencies, using sophisticated encryption techniques and monthly changes in command-and-control servers to evade detection. To...

Rapid7 Podcast Explores Hybrid-First Workplace Learnings

As the world continues to navigate the post-pandemic shift in work environments, Rapid7 is operating on a hybrid-first approach that balances flexibility and productivity with collaboration and optimizing for customer success. In the spirit of cross-collaboration, the People Development and...

Moodle arbitrary file read vulnerability

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

GHSA-56R9-72VX-Q989 Moodle arbitrary file read vulnerability

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

CVE-2023-28330

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

CVE-2023-28329

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28329

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28330

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

UBUNTU-CVE-2023-28329

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

Design/Logic Flaw

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

CVE-2023-28329

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28330 Moodle: authenticated arbitrary file read through malformed backup file

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

CVE-2023-28330

CVE-2023-28330: In Moodle, insufficient sanitizing in the backup feature enables an authenticated arbitrary file read. Access to this backup-related capability is restricted by default to teachers, managers, and admins. Connected documents corroborate a backup-file read risk and reference unpatch...

CVE-2023-28330 Moodle: authenticated arbitrary file read through malformed backup file

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

CVE-2023-28329 Moodle: authenticated sql injection via availability check

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28329

CVE-2023-28329 concerns Moodle with an authenticated SQL injection via the profile field availability check. Documented affected ranges include Moodle 3.11–3.11.14, 4.0–4.0.8, 4.1–4.1.3, and 4.2. Affected vendor notes describe insufficient validation enabling SQL injection when retrieving profile...

CVE-2023-28329 Moodle: authenticated sql injection via availability check

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

CVE-2023-28330

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

CVE-2023-28329 Moodle: authenticated sql injection via availability check

Insufficient validation of profile field availability condition resulted in an SQL injection risk by default only available to teachers and managers...

Apache Spark < 2.4.6 RCE (CVE-2020-9480)

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...