Gaukas

**Name of the Vulnerable Software and Affected Versions** Instructure Canvas LMS (affected versions not specified) **Description** The issue concerns improper access control in Instructure Canvas LMS, where unprivileged users can access locked or unpublished files through the DocViewer based file preview URL, referred to as `canvadoc session url`. This allows unauthorized access to sensitive information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Pion WebRTC versions prior to 3.0.15 Description: The issue arises from improper teardown of the DTLS connection when certificate verification fails. As a result, data channel communication is incorrectly allowed with users who have failed DTLS certificate verification. This can occur when an attacker knows the ICE password and the attack takes place during the PeerConnection handshake. The issue can be detected by monitoring the `PeerConnectionState` in all versions of Pion WebRTC. Recommendations: For versions prior to 3.0.15, users should upgrade to v3.0.15 to resolve the issue. As a temporary workaround, users should listen for when `PeerConnectionState` changes to `PeerConnectionStateFailed` and not continue using the PeerConnection when it enters this state.