CVE-2022-0983

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default...

Moderate: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

libarchive security update

An update is available for libarchive. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libarchive programming library can create and read several different...

Multiple Security Flaws Discovered in Popular Software Package Managers

Multiple security vulnerabilities have been disclosed in popular package managers that, if potentially exploited, could be abused to run arbitrary code and access sensitive information, including source code and access tokens, from compromised machines. It's, however, worth noting that the flaws...

Trellix Global Defenders: Invasion of the Information Snatchers - Protecting against RedLine Infostealer

Trellix Global Defenders: Invasion of the Information Snatchers - Protecting against RedLine Infostealer By Taylor Mullins · February 7, 2022 What information are you storing in your Browsers? Storing credentials and other important information in web browsers is a helpful method to not have to...

Trellix Global Defenders: Invasion of the Information Snatchers - Protecting against RedLine Infostealer

Trellix Global Defenders: Invasion of the Information Snatchers - Protecting against RedLine Infostealer By Taylor Mullins · February 7, 2022 What information are you storing in your Browsers? Storing credentials and other important information in web browsers is a helpful method to not have to...

CVE-2022-0333

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events...

GHSA-C6RP-XVQV-MWMF Cross-site Scripting in epubjs

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

CVE-2021-33040

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

CVE-2021-33040

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

Cross site scripting

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

CVE-2021-33040

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

CVE-2021-33040

CVE-2021-33040 affects FuturePress EPub.js (prior to v0.3.89). The vulnerability is a XSS in managers/views/iframe.js due to insufficient escaping of user-submitted data. Used in the EPUB rendering library; impact is cross-site scripting. Public references indicate the fix is in v0.3.89 (upstream...

CVE-2021-33040

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

PT-2022-10194

Name of the Vulnerable Software and Affected Versions FuturePress EPub.js versions prior to 0.3.89 Description The issue allows for XSS due to a problem in the managers/views/iframe.js file. Recommendations For versions prior to 0.3.89, update to version 0.3.89 or later to resolve the issue...

CVE-2021-33040: Improper Neutralization of Input During Web Page Generation

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS...

Threat Advisory: E-commerce Bots Use Domain Registration Services for Mass Account Fraud

While researching a recent large-scale bot campaign with CQ Prime Threat Research team lead, Dean Lendrum, we found attackers using domain parking and monetization services to register multiple domains, creating a large number of fake eCommerce accounts per domain. TL; DR ------ Analysis of...

CVE-2021-35244

The "Log alert to a file" action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution...

CVE-2021-42775

Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, have a vulnerability in the remote firmware download feature that could allow a user to place or replace an arbitrary file on the remote host. In...

We’re Excited to Announce the Launch of Comms Hub!

We are excited to announce the launch of Comms Hub to the Researcher Portal submission experience! With this launch, security researchers will be able to streamline communication with MSRC case SPMs case managers, attach additional files, track case and bug bounty status all in the Researcher...