A week in security (August 20 – August 26)

Last week on Labs, we took a look at insider threats, doubled back on the privacy of search browser extensions, profiled green card scams, revisited Defcon badgelife, and talked about what happens to a user's accounts when they die. Other cybersecurity news There was an archiving error in Twitch...

Green card scams: preying on the desperate

Thanks to @nullcookies for providing leads. Most online scams depend on two things for success: a broken or otherwise onerous process to deal with a legitimate entity, and a desperate target population. With immigration, there are many, many burdensome processes to navigate, and most applicants...

[SECURITY] Fedora 27 Update: uwsgi-2.0.17.1-1.fc27

uWSGI is a fast pure C, self-healing, developer/sysadmin-friendly application container server. Born as a WSGI-only server, over time it has evolved in a complete stack for networked/clustered web applications, implementing message/object passing, caching, RPC and process management. It uses the...

CVE-2016-6552

Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged access to a vulnerable device...

Default credentials

Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged access to a vulnerable device...

CVE-2016-6552 Green Packet DX-350 uses default credentials

Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged access to a vulnerable device...

CVE-2016-6552

CVE-2016-6552 affects Green Packet DX-350, which uses non-random default credentials (root:wimax). A remote attacker on the network can gain privileged access, with a critical CVSSv3 base score (9.8) and full impact on confidentiality, integrity, and availability. The documents corroborate a cred...

GreenCMS Cross-Site Request Forgery Vulnerability

GreenCMS is a content management system CMS based on ThinkPHP. A cross-site request forgery vulnerability exists in GreenCMS version 2.3.0603. A remote attacker can add an administrator account with the help of the index.php?m=admin&c=access&a=adduserhandle URL...

jira.limegreensoftware.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-637037 Description| Value ---|--- Affected Website:| jira.limegreensoftware.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

A week in security (May 7 – May 13)

Last week on Labs, we looked at the case of a fake Android AV, an annoying adware that goes by the name of Kuik, the return of threat actors behind the Shopper Stop tech scam, a new Netflix phishing scam, the recent zero-day vulnerability in Internet Explorer, and the insufficiency of merely...

green-tehnika.ru XSS vulnerability

Open Bug Bounty ID: OBB-585704 Description| Value ---|--- Affected Website:| green-tehnika.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

green-shop.co.il XSS vulnerability

Open Bug Bounty ID: OBB-577837 Description| Value ---|--- Affected Website:| green-shop.co.il Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

green-e.org XSS vulnerability

Open Bug Bounty ID: OBB-458847 Description| Value ---|--- Affected Website:| green-e.org Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

green-your-life.de XSS vulnerability

Open Bug Bounty ID: OBB-318055 Description| Value ---|--- Affected Website:| green-your-life.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Netflix scam warning

Always be on your toes While we are used to receiving scam attempts pretending to be from banks, online shops, credit card companies, and international courier services that does not mean all the other emails are safe. Far from it. To demonstrate this point we will show you a scam aimed at Netfli...

bestcareerleap.com XSS vulnerability

Open Bug Bounty ID: OBB-298160 Description| Value ---|--- Affected Website:| bestcareerleap.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Unspecified Vulnerability in Green Packet DX-350

The Green Packet DX-350 is a network access point device from Green Packet USA. A security vulnerability exists in the Green Packet DX-350 using firmware version 2.8.9.5-g1.4.8-atheeb, which stems from the administrator account having a default password. No details of the vulnerability are provid...

Green Packet DX-350 Injection Command Vulnerability

The Green Packet DX-350 is a network access point device from Green Packet USA. A security vulnerability exists in the PING function of the web interface in the Green Packet DX-350. The vulnerability can be exploited by an attacker to inject commands with the help of the 'pip' parameter...

Green Packet Routers OS Command Injection Vulnerability

Green Packet Routers are prone to an arbitrary OS command injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Green Packet DX-350 Cross-Site Request Forgery Vulnerability

The Green Packet DX-350 is a network access point device from Green Packet USA. A cross-site request forgery vulnerability exists in the Green Packet DX-350 using firmware version 2.8.9.5-g1.4.8-atheeb. A remote attacker can exploit this vulnerability by sending a request to the ajax.cgi file to...