CVE-2017-18547

The CVE concerns the WordPress Nelio Ab Testing plugin prior to version 4.6.4, where a CSRF flaw exists in the experiment forms. Multiple connected sources (Red Hat CVE entry, CNVD/CVE listings, CVE records, and WP vulnerability databases) corroborate that the vulnerability is a CSRF issue in the...

PT-2019-8481

Name of the Vulnerable Software and Affected Versions nelio-ab-testing plugin versions prior to 4.6.4 Description The issue concerns a CSRF problem in experiment forms. Recommendations For versions prior to 4.6.4, update to version 4.6.4 or later to resolve the issue...

CVE-2017-18547: Cross-Site Request Forgery (CSRF)

The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms...

Jigsaw Bought a Russian Twitter Troll Campaign as an Experiment

In a controversial move, the Alphabet-owned tech firm played both sides of an online argument in Russia with the aim of testing disinformation-for-hire services...

The Danger in Assange’s Charges, a Memory Experiment, and More News

Catch up on the most important news from today in two minutes or less...

Personal Data Left on Used Laptops

A recent experiment found all sorts of personal data left on used laptops and smartphones. This should come as no surprise. Simson Garfinkel performed the same experiment in 2003, with similar results...

GangWang GPS Navigation Attack Leads Unsuspecting Drivers Astray

A proof-of-concept attack that uses realistic fake turn-by-turn navigation directions for in-car GPS systems has managed to fool drivers into following them a full 95 percent of the time in testing. Mobile navigation services are used by billions of users around the globe today. While GPS spoofin...

Experiment: Improving Page Load Times with Script Streaming

...

A week in security (July 2 – July 8)

Last week, we tracked back a large mining operation from their Coinhive shortlink, we took a look at online project management tools, we described a new macro-less technique to distribute malware, and talked about a Mac malware that targets crypto-mining users. Other news: Huawei enterprise comms...

Detecting Laptop Tampering

Micah Lee ran a two-year experiment designed to detect whether or not his laptop was ever tampered with. The results are inconclusive, but demonstrate how difficult it can be to detect laptop tampering...

eLabFTW experiment infos component cross-site scripting vulnerability

Elabftw is an open source platform for hosting experimental data. The platform runs on Linux and supports storing a variety of objects. experiment infos component is one of the experiment infos storage components. A cross-site scripting vulnerability exists in the experiment infos component in...

Cross site scripting

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

CVE-2017-1000478

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

CVE-2017-1000478

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

PT-2018-5243

Name of the Vulnerable Software and Affected Versions ELabftw version 1.7.8 Description The issue concerns stored cross-site scripting in the experiment infos component, which can lead to the arbitrary execution of JavaScript and denial of service. Recommendations For ELabftw version 1.7.8, updat...

CVE-2017-1000478: Improper Neutralization of Input During Web Page Generation

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

Facebook Awards $100K to Researchers for Credential Spearphishing Detection Method

A group of researchers recently identified a real-time way to detect credential spearphishing attacks in enterprise settings. The discovery net the researchers $100,000 last week from Facebook, which awards money as part of its annual Internet Defense Prize partnership with USENIX Association. Th...

Curiosity Kills Security When it Comes to Phishing

Regardless of the amount of training and technology applied to phishing prevention, people are going to click on links, trust messages from supposedly known sources and get into trouble online. A recent academic paper collates the results of an experiment conducted with more than 1,200 German...

wandb

Use W&B to build better models faster. Track and visualize all t...

Gravity Balls Experiment - WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application Gravity Balls Experiment published at the 'play' market has multiple vulnerabilities...