Philips Gemini PET/CT Family

1. EXECUTIVE SUMMARY CVSS v3 2.4 ATTENTION: Low skill level to exploit Vendor: Philips Equipment: Gemini PET/CT Family Vulnerability: Storage of Sensitive Data in a Mechanism Without Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability involving removable media could...

Two Russians Charged in $17M Cryptocurrency Phishing Spree

U.S. authorities today announced criminal charges and financial sanctions against two Russian men accused of stealing nearly $17 million worth of virtual currencies in a series of phishing attacks throughout 2017 and 2018 that spoofed websites for some of the most popular cryptocurrency exchanges...

Wawa Breach: Hackers Put 30 Million Stolen Payment Card Details for Sale

Remember the recent payment card breach at Wawa convenience stores? If you're among those millions of customers who shopped at any of 850 Wawa stores last year but haven't yet hotlisted your cards, it's high time to take immediate action. That's because hackers have finally put up payment card...

Wawa Breach May Have Affected More Than 30 Million Customers

A recent dump of payment card information being sold on a popular online fraud marketplace suggests that more than 30 million payment cards may have been affected by a malware attack and data breach at Wawa convenience stores and gas stations that was first revealed in December. The Joker’s Stash...

Wawa Breach May Have Compromised More Than 30 Million Payment Cards

In late December 2019, fuel and convenience store chain Wawa Inc. said a nine-month-long breach of its payment card processing systems may have led to the theft of card data from customers who visited any of its 850 locations nationwide. Now, fraud experts say the first batch of card data stolen...

Sale of 4 Million Stolen Cards Tied to Breaches at 4 Restaurant Chains

On Nov. 23, one of the cybercrime underground's largest bazaars for buying and selling stolen payment card data announced the immediate availability of some four million freshly-hacked debit and credit cards. KrebsOnSecurity has learned this latest batch of cards was siphoned from four different...

Takeaways from the $566M BriansClub breach

Reporting on the exposure of some 26 million stolen credit cards leaked from a top underground cybercrime store highlighted some persistent and hard truths. Most notably, that the world's largest financial institutions tend to have a much better idea of which merchants and bank cards have been...

JVN#60978548: WordPress plugin "Site Reviews" vulnerable to cross-site scripting

The WordPress plugin "Site Reviews" provided by Gemini Labs contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on a logged in user's web browser. Solution Update the plugin Update the plugin according to the information provided by the develope...

gemini-coatings.com XSS vulnerability

Open Bug Bounty ID: OBB-411659 Description| Value ---|--- Affected Website:| gemini-coatings.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

bielskobiala.geminipark.pl XSS vulnerability

Vulnerable URL: http://bielskobiala.geminipark.pl/1/%22%3E%3Csvg/onload=%22alert'OPENBUGBOUNTY'%22%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...

Yahoo Gemini Cross Site Request Forgery

Document Title: =============== Yahoo Bug Bounty 32 - CSRF bulkImport Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1552 Release Date: ============= 2015-09-03 Vulnerability Laboratory ID VL-ID: ==================================== 15...

Researchers Outline Bugs in Yahoo, PayPal, Magento

Researchers recently discovered a smattering of vulnerabilities in web applications and mobile applications belonging to companies like Yahoo, PayPal, Magento, and Shopify that could have led to account theft, session hijacking, and phishing, among other consequences. Hadji Samir, Ebrahim Hegazy,...

Yahoo Bug Bounty #32 - CSRF bulkImport Web Vulnerability

Document Title: =============== Yahoo Bug Bounty 32 - CSRF bulkImport Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1552 Release Date: ============= 2015-09-03 Vulnerability Laboratory ID VL-ID: ==================================== 15...

DreamBox DM500s Cross Site Scripting

DreamBox DM500s Reflected XSS Vendor: Dream Multimedia GmbH Product web page: http://www.dream-multimedia-tv.de Summary: The Dreambox DM500s is a Linux-powered DVB satellite, terrestrial and cable digital television receivers set-top box. Tested on: Linux Kernel 2.6.9, The Gemini Project, Enigma...

The Gemini Portal <= 4.7 Insecure Cookie Handling Vulnerability

No description provided by source. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- The Gemini Portal = 4.7 / Insecure Cookie Handling Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Program: The Gemini Portal Version: = 4.7 File affected: admin/...

DreamBox DM500(+) - Arbitrary File Download

DreamBox DM500+ Arbitrary File Download Vulnerability Vendor: Dream Multimedia GmbH Product web page: http://www.dream-multimedia-tv.de Affected version: DM500, DM500+, DM500HD and DM500S Summary: The Dreambox is a series of Linux-powered DVB satellite, terrestrial and cable digital television...

DreamBox DM500+ File Download

DreamBox DM500+ Arbitrary File Download Vulnerability Vendor: Dream Multimedia GmbH Product web page: http://www.dream-multimedia-tv.de Affected version: DM500, DM500+, DM500HD and DM500S Summary: The Dreambox is a series of Linux-powered DVB satellite, terrestrial and cable digital television...

CVE-2008-7024

admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting the user cookie to "admin" and setting the name parameter to "users."...

CVE-2008-7024

CVE-2008-7024 affects Arz Development The Gemini Portal 4.7 and earlier. The vulnerability allows remote attackers to bypass authentication and obtain administrator privileges by manipulating the user cookie to the value "admin" and setting the name parameter to "users" in admin.php. The root cau...

CVE-2008-7024

admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privileges by setting the user cookie to "admin" and setting the name parameter to "users."...