CVE-2024-1208: Exposure of Sensitive Information to an Unauthorized Actor

The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions...

LearnDash LMS < 4.10.3 - Sensitive Information Exposure via API

Description The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions...

Apache Answer Competition Condition Problem Vulnerability

Apache Answer is a community platform of the Apache USA Foundation. Apache Answer version 1.2.0 and prior versions suffer from a Competing Conditional Questions vulnerability that stems from the fact that repeated submissions via scripting can increase the number of questions collected many times...

Choosing an AI-SPM tool: The four questions every security organization needs to ask

Ensure you are staying secure as your organization adopts AI by following these four guiding questions...

The 23andMe Data Breach Keeps Spiraling

23andMe has provided more information about the scope and scale of its recent breach, but with these details come more unanswered questions...

CVE-2023-46404

PCRS = 3.11 d0de1e “Questions” page and “Code editor” page are vulnerable to remote code execution RCE by escaping Python sandboxing...

CVE-2023-46404

PCRS = 3.11 d0de1e “Questions” page and “Code editor” page are vulnerable to remote code execution RCE by escaping Python sandboxing...

CVE-2023-46404

PCRS = 3.11 d0de1e “Questions” page and “Code editor” page are vulnerable to remote code execution RCE by escaping Python sandboxing...

CVE-2023-46404

PCRS (PHP-based web app for online programming exercises) versions prior to 3.11 (d0de1e) are vulnerable to remote code execution via the "Questions" page and the "Code editor" page. The root cause is escaping Python sandboxing, enabling attacker-controlled code execution. Public advisories consi...

CVE-2023-46404: Improper Control of Generation of Code

PCRS = 3.11 d0de1e “Questions” page and “Code editor” page are vulnerable to remote code execution RCE by escaping Python sandboxing...

PT-2023-30004 · Pcrs · Pcrs

Name of the Vulnerable Software and Affected Versions: PCRS versions prior to 3.11 d0de1e Description: The issue allows for remote code execution RCE by escaping Python sandboxing on the "Questions" page and the "Code editor" page. Recommendations: For versions prior to 3.11 d0de1e, update to...

Android Security Bulletin—October 2023Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2023-10-06 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Intrusion Detection & Prevention Systems Guide

IDPS, IDS, IPS… what’s the difference? Discover key differences between intrusion detection and prevention systems as well as 9 technical and non-technical questions to ask when evaluating vendors...

Intrusion Detection & Prevention Systems Guide

IDPS, IDS, IPS… what’s the difference? Discover key differences between intrusion detection and prevention systems as well as 9 technical and non-technical questions to ask when evaluating vendors...

CVE-2023-20133

A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists because of insufficient validation of user-supplied input in Webex Events class...

CVE-2023-20133: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists because of insufficient validation of user-supplied input in Webex Events class...

Android Security Bulletin—July 2023Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2023-07-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Ethical Problems in Computer Security

Tadayoshi Kohno, Yasemin Acar, and Wulf Loh wrote excellent paper on ethical thinking within the computer security community: "Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversation": Abstract: The computer security research community regularly tackles ethical...

PT-2023-22501 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.14 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when admins create a FAQ News and can pass malicious scripts to the text of the record section. This allows for th...

PT-2023-17311 · Unknown · Thorsten/Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue concerns improper access control in the thorsten/phpmyfaq GitHub repository. Specifically, when FAQ News is marked as inactive in settings and comments are enabled, it allows...