Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1172PUBLISHED: 2023-03-17
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...
CVE-2023-1469PUBLISHED: 2023-03-17
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenti...
CVE-2023-1466PUBLISHED: 2023-03-17
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(...
CVE-2023-1467PUBLISHED: 2023-03-17
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt le...
CVE-2023-1468PUBLISHED: 2023-03-17
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipula...
User Rank: Strategist
6/23/2017 | 11:38:43 AM
Until a dedicated exchange or forum exists (besides the existing tools that mesh subscriber detections today) that anonymizes the reporting entity sources, we won't see any real open collaboration. The fundamental problem in this interchange model is that the closer you get to anonymity the farther you get from assurance and authenticity. Meaning, the reliability of threat articulation from an anonymous source is less than a vetted representative from "MegaCorp, LLC" proper. This could be overcome by a intermediate, sanctioned broker to ensure the reporting entity is genuine.
Until the exchange mechanism is sexy and "now" it won't work either. The threat intelligence collaboration and sharing service needs to solidly be edgy social media. Think "HackedIn" and not some cold, corporate or government offering that reads like RFC's and NIST documentation.
Until the threat intelligence interchange is highly automated, it won't be accepted. MegaCorp is not going to dedicate service agents or ongoing labor to the contributions nor consuming content. If the end-all solution doesn't facilitate fast-flux transactions in both directions and provide actionable output that itself can be automated, it won't be widely adopted.