Information Leakage

Moodle is vulnerable to information leakage. When RSS tokens are used to impersonate another user, rss/file.php shows a rss feed error shows block information of the impersonated user...

CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

DEBIAN-CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

Design/Logic Flaw

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

UBUNTU-CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

CVE-2017-1000035

CVE-2017-1000035 affects Tiny Tiny RSS prior to 829d478f, where an XSS window.opener vulnerability exists. The root cause is a cross-site scripting flaw in the application’s handling of window.opener context, potentially allowing script injection in affected sessions. Referenced patch/commit 829d...

CVE-2017-1000035

Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack...

Concrete CMS: Stored XSS vulnerability in RSS Feeds Description field

Intro "Pirates of the Crayons" Type of issue: Core CMS issue Level of severity: Internal Attack Vector Concrete5 version: 8.2.0 RC2 rev. b54f2b451f0a0804699c4cf9f0b3a8fef0e407db July 10th Summary There is Stored XSS vulnerability in RSS Feeds Description property. Value of the textarea is not...

Metasploit Wrapup

Metasploit Hackathon We were happy to host the very first Metasploit framework open source hackathon this past week in the Rapid7 Austin. Eight Metasploit hackers from outside of Rapid7 joined forces with the in-house team and worked on a lot of great projects, small and large. @bcook started the...

Sensitive Information Disclosure

moodle/moodle is vulnerable to information disclosure attacks. A flaw in blog/rsslib.php continues to provide a blog RSS feed when blogging is disabled. Attackers can leverage this feed to obtain sensitive information...

Authentication flaw

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors...

CVE-2016-4908

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors...

CVE-2016-4908

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors...

CVE-2016-4908

CVE-2016-4908 affects Cybozu Garoon 3.0.0–4.2.2, where an access restriction flaw in the RSS settings allows remote authenticated attackers to bypass protections and alter or delete another user’s private RSS settings via unspecified vectors. The OpenVAS/JVN entries and CVE records corroborate an...

Sensitive Information Leak

Moodle is vulnerable to a sensitive information leak. blog/rsslib.php does not prevent guest users from accessing sensitive information from hidden blog posts through related RSS feeds for site-level blogs...

Bypass Access Restrictions

Moodle is vulnerable to access restrictions being bypassed. Authenticated users can leverage the student role to bypass access restrictions and read the RSS feed for a forum. This is possible because mod/forum/rsslib.php does not correctly implement the requirement for posting before reading a Q...

Beers with Talos Podcast Now Available

The first episodes of Beers with Talos are now available on iTunes and directly on talosintelligence.com/podcasts.When Talos decided to make a threat intelligence podcast, we wanted to make it different than your typical buttoned down, subdued security podcast. The BWT crew: Craig, Joel, a...