A week in security (March 12 – March 18)

Last week on Malwarebytes Labs, we took a look at the inner workings of a fileless attack, explored what happened in a zero day ransomware attack aimed at South Koreans, gave you hints and tips for avoiding cold calls, and took a deep dive into the secretive world of GrayKey. Other news The Equif...

Facebook Data Privacy Policies Bashed By Critics After Cambridge Analytica Incident

Facebook is in hot water after acknowledging that a consulting group – that has worked on several high profile political campaigns, including that of President Donald Trump’s – used the social media company’s platform to harvest the data of 50 million users. The company last week said that in 201...

[SECURITY] Fedora 26 Update: exim-4.90.1-2.fc26

Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal ...

cambridgeexams-avo.com XSS vulnerability

Open Bug Bounty ID: OBB-556136 Description| Value ---|--- Affected Website:| cambridgeexams-avo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

[SECURITY] Fedora 26 Update: exim-4.89-7.fc26

Exim is a message transfer agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. It is freely available under the terms of the GNU General Public Licence. In style it is similar to Smail 3, but its facilities are more general. There is a great deal ...

cambridgepavers.com XSS vulnerability

Open Bug Bounty ID: OBB-359358 Description| Value ---|--- Affected Website:| cambridgepavers.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

downloads.sms.cam.ac.uk XSS vulnerability

Vulnerable URL: https://downloads.sms.cam.ac.uk/mediaplayer.swf?file=http://content.bitsontherun.com/videos/bkaovAYt-364766.flv=falseℑ=http://appsec.ws/ExploitDB/cMon.jpg=true=javascript:confirm/openbugbounty/;//=blank&.swf Details: Description| Value ---|--- Patched:| No Latest check for patch:|...

nena.ames.cam.ac.uk XSS vulnerability

Open Bug Bounty ID: OBB-264974 Description| Value ---|--- Affected Website:| nena.ames.cam.ac.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Security and Human Behavior (SHB 2017)

I'm in Cambridge University, at the tenth Workshop on Security and Human Behavior. SHB is a small invitational gathering of people studying various aspects of the human side of security, organized each year by Ross Anderson, Alessandro Acquisti, and myself. The 50 or so people in the room include...

cambridge.wickedlocal.com XSS vulnerability

Open Bug Bounty ID: OBB-216546 Description| Value ---|--- Affected Website:| cambridge.wickedlocal.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

trinhall.cam.ac.uk XSS vulnerability

Vulnerable URL: http://www.trinhall.cam.ac.uk/contact/contact-directory.asp?searchType=fellows=xss4=2='"--!=Search+Fellows Details: Description| Value ---|--- Patched:| Yes, at 22.02.2017 Latest check for patch:| 22.02.2017 15:43 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

Xen elevation of privilege vulnerability (CNVD-2016-12348)

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. An elevation of privilege...

RedHat Update for bind RHSA-2016:2141-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

cambridgecyrenians.org.uk XSS vulnerability

Vulnerable URL: http://www.cambridgecyrenians.org.uk/index.php?option=comk2=itemlist=user=9537=" onload='prompt/OPENBUGBOUNTY/' Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 18:19 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

Japan's Softbank buys semiconductor giant ARM for $32 Billion in Cash

Japanese telecommunication giant SoftBank has confirmed that the company intends to acquire UK chip designer ARM Holdings for almost $32 Billion £24.3 Billion in an all-cash deal. ARM has also agreed to this offer from SoftBank and said that its board would recommend the all-cash deal to...

koo.corpus.cam.ac.uk XSS vulnerability

Vulnerable URL: http://koo.corpus.cam.ac.uk/mixerton/mixertones/spec.php?usecode=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 11:55 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

Xen Information Disclosure Vulnerability (CNVD-2015-08349)

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. Xen has a security vulnerability that allows an attacker to exploit the vulnerability to gain access to sensitive information...

data.lib.cam.ac.uk XSS vulnerability

Vulnerable URL: http://data.lib.cam.ac.uk/record.php?uri=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Googl...

cdextras.cambridge.org XSS vulnerability

Open Bug Bounty ID: OBB-107910 Description| Value ---|--- Affected Website:| cdextras.cambridge.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

dictionary.cambridge.org XSS vulnerability

Vulnerable URL: http://dictionary.cambridge.org/spellcheck/british/?q=+ Details: Description| Value ---|--- Patched:| Yes, at 11.10.2015 Latest check for patch:| 11.10.2015 09:09 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google...