Category: Research & Alerts

VU#447516: Linksys SMART WiFi firmware contains multiple vulnerabilities 0

VU#447516: Linksys SMART WiFi firmware contains multiple vulnerabilities

Vulnerability Note VU#447516 Linksys SMART WiFi firmware contains multiple vulnerabilities Original Release date: 31 Oct 2014 | Last revised: 31 Oct 2014 Overview Linksys EA series routers running the Linksys SMART WiFi firmware contain multiple vulnerabilities. Description CWE-320 : Key Management Errors – CVE-2014-8243 An unauthenticated attacker on the local area network (LAN) can read the router’s .htpassword file by requesting http(s):// /.htpasswd . The .htpasswd file contains the MD5 hash of the administrator password

CSAM Month of False Postives – False Positives from Management, (Thu, Oct 30th) 0

CSAM Month of False Postives – False Positives from Management, (Thu, Oct 30th)

Often the start of a problem and its solution is receiving a call from a manger, project manager or other non-technical decision maker. Youll know going in that the problem is absolutely real, but the information going in might be a total red herring. Some classic examples are: The network is slow I ran a speed test, we should being seeing 10x the speed

The Wonderful World of CMS strikes again, (Wed, Oct 29th) 0

The Wonderful World of CMS strikes again, (Wed, Oct 29th)

I think that I will start this Diary with the following statement: If you use an open source CMS, and you do not update it frequently, there is a very high chance that your website if not only compromised but also part of a botnet. You probably already saw several of our diaries mentioning vulnerabilities in very well-known CMS systems like WordPress and Joomla, which are quite powerful and easy to use/install, and also full of vulnerabilities and requires frequent updates. The third one in this list is Drupal.

VU#973460: drchrono Electronic Health Record (EHR) web applications vulnerable to cross-site scripting and cross-site request forgery 0

VU#973460: drchrono Electronic Health Record (EHR) web applications vulnerable to cross-site scripting and cross-site request forgery

Vulnerability Note VU#973460 drchrono Electronic Health Record (EHR) web applications vulnerable to cross-site scripting and cross-site request forgery Original Release date: 29 Oct 2014 | Last revised: 29 Oct 2014 Overview drchrono Electronic Health Record (EHR) web applications allow cross-site scripting (XSS) and cross-site request forgery (CSRF) that could allow an attacker to obtain sensitive patient information. Description drchrono provides an EHR web application service at drchrono.com, onpatient.com, and possibly other domains