Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Simon Waters
Tissue-Free vs Tumor-Informed ctDNA Assays for Molecular Residual Disease Detection in Early Triple Negative Breast Cancer
Tissue-Free vs Tumor-Informed ctDNA Assays for Molecular Residual Disease Detection in Early Triple Negative Breast Cancer Supplement 1. eFigure 1. CONSORT Diagram eFigure 2. Tumor methylation fraction at first timepoint detection by clinical risk group in patients with ctDNA detected by the tissue-free assay eFigure 3. Tumor methylation fraction at first timepoint detection by recurrence status in patients with ctDNA detected by the tissue-free assay eFigure 4.
The Inside Man: The blockchain and licensing
Over the last 12 months, I’ve been fortunate to work with some very innovative web 3.0 companies. All of them are developing new IP worlds that could not have existed a few years ago. All of them believe they will change the world. Some of them will. They’re just not sure how yet. Web 3.0 is a bit of a bro-tech term that not everyone agrees on, but in its most basic form, it’s a world where users will all be connected via a decentralised network that gives us access and ownership of our own data.
The Inside Man: Being the brand. Literally
The marketing campaign for the current Deadpool & Wolverine theatrical is a masterclass in marketing. At the time of my writing, it’s the highest R-rated opening of all time, with a whopping great haul of $444.1m. It’s not just because Ryan Reynolds owns the marketing company that does all his marketing: Maximum Effort Productions. It’s not just because that same company is also his production company, helping make his movies.
The Inside Man: Life’s a pitch
I was trying to calculate how many pitches I’ve given or sat in over the years, and I came to the conclusion – through deep scientific discovery – that’s it’s probably somewhere north of 10,000, give or take a few. Yeah, I know, that’s a heck of a lot. Our industry is fueled by the pitch – how else do we open doors, filter options, decipher and choose between all the alternatives out there? A good pitch has the power to change minds. A great pitch has the power to change outcomes.
The Inside Man: Time for new words and approaches?
After last month’s Licensing Expo, I wrote a LinkedIn post about the need for our industry to introduce new words, approaches and models for licensing. Perhaps unsurprisingly, it garnered a lot of attention and agreement – it turns out that many of us are thinking the same thing. It’s easy to throw a post like that into the LinkedIn universe and then do a runner, but that would be just plain lazy. So, what did I mean by new words, approaches and models?
The Inside Man: Becoming evergreen
Evergreen… what a word. I hear it a lot in pitches and presentations. It’s usually followed by the word ‘franchise’, and I confess that now and then both words slip out of my mouth. And each time they do, I ask myself what does ‘evergreen franchise’ actually mean? The word evergreen is often placed before the word franchise, like IP fairy dust.
The Inside Man: Ten good reasons
For those of you young enough to remember Jason Donovan’s seminal 1989 album of the same title as this column, I salute you. Your 80’s soap opera pop-culture radar is very well-tuned. As someone who worked in the music industry in London early in his career, I look back at that business as almost unrecognisable since the heady days of physical media, despite today’s resurgence of vinyl. Technology came along back then, flipped the boat over and only had enough room on the lifeboats for a few.
How CPG Brands Can Survive Recession in 2023
By Maile Buker & Simon Waters With US GDP growth slowing from 2-6% per quarter in 2021 to -0.6% for Q2 2022 and another big interest rate hike on the horizon, the tail end of this year is providing mixed economic news. Job openings continue to rise despite improved employment figures indicating companies’ difficulties finding and retaining workers.
How CPG Companies Can Grow in a Recession
By Maile Buker & Simon Waters With US GDP growth slowing from 2-6% per quarter in 2021 to -0.6% for Q2 2022 and another big interest rate hike on the horizon, the tail end of this year is providing mixed economic news. Job openings continue to rise despite improved employment figures indicating companies’ difficulties finding and retaining workers.
How CPG Companies Can Grow In A Recession
With US GDP growth slowing from 2-6% per quarter in 2021 to -0.6% for Q2 2022 and another 75 bp interest rate hike on the horizon, the tail end of this year is providing mixed economic news. Job openings continue to rise despite improved employment figures indicating companies’ difficulties finding and retaining workers.
Jetty 6.1.6 Cross-Site Scripting (XSS)
The demise of the MortBay and Codehaus websites doesn't help, this isn't the sort of forensics I expected to do. https://web.archive.org/web/20090709110650/http://jira.codehaus.org/browse/JETTY-980 Suggests semicolon after any directory listing, led to inclusion of the text after into the document. echo -e "GET /cometd/dijit/; alert(document.title); HTTP/1.0\n\n" | nc 127.0.0.1 8080 The patch file is also archived in the wayback machine.
Jetty 6.1.6 Cross-Site Scripting (XSS)
Title: Jetty 6.1.6 Cross-Site Scripting Date: 8/14/2018 Author: 1N3@CrowdShield -https://crowdshield.com Software Link:http://www.mortbay.org/jetty/ Tested on: Jetty 6.1.6 (other versions may also be vulnerable) CVE: N/A Background: Jetty 6.1.6 is vulnerable to Cross-Site Scripting (XSS) which allows an attacker to inject malicious code into the affected site.
Ignite Realtime Openfire Version 3.7.1 Reflected Cross Site Scripting (CVE-2018-11688)
Thanks Yavuz, this appears to have been addressed in 3.9.2 release of OpenFire in May 2014. I'm unable to reproduce in OpenFire 4.2.3. I would strongly suggest running the latest version of OpenFire (4.2.3 at time of writing) as there were multiple XSS and other security issues (missing CSRF for example) addressed since 3.7.1.
Starling Murmurations
Starling murmurations are one of the most spectacular wildlife sights that we enjoy in this country. If you ever get to see this awe-inspiring event jump at the chance. Being less than an hours drive away I often visit Minsmere as I have a real passion for wildlife. My latest foray was actually to the neighbouring village of Eastridge. A glossy ibis had been very cooperative in feeding close to the road.
Security risk of vim swap files
The specific website issue, the web server config can exclude dot files. Apache ships with Order allow,deny Deny from all The obvious generalisations of this work. Although some sources also recommend blocking in "Location" to prevent requests with "*/.*stuff" which are parsed by templating libraries or other directives.
MacOS 10.13 Beta (17A306f)
From: "Simon Waters (Surevine)" Date: Mon, 24 Jul 2017 10:30:32 +0100 Noted that the 2.4.0 build immediately crashes on 10.13 beta of Mac OS. QWidget: Must construct a QApplication before a QWidget Abort trap: 6 Not the first Qt app to fail under 10.13, almost certainly a library mismatch. Thought I’d flag it here in case work is needed, although given the bugs filed last week I may be reverting to stable Mac OS X till it is less beta.
MacOS 10.13 Beta (17A306f)
From: "Simon Waters (Surevine)" Date: Mon, 24 Jul 2017 12:47:20 +0100 On 24 Jul 2017, at 11:45, Roland Knall wrote: If you havn't already, could you add the crash report? Which Qt versions and XCode versions are you using? So far I cannot find this issue in the Qt bugs list, and the crash report would help loads. I meant the public released version.
Full Disclosure: Re: Tenda, Dlink & Tplink TD-W8961ND
From: "Simon Waters (Surevine)" Date: Mon, 28 Nov 2016 14:42:57 +0000 XSS in DHCP name has been reported on the Full Disclosure mailing list for other models of TP-Link Router before. Seems to be generic to many TP-Link models. My model has a regular line wrap to the DHCP hostname field, so you need to insert a comment into HTML or JS every N characters into any exploit code, but it is fully exploitable, and you can write arbitrary JS in that space with a little effort.
Blind SQL injections in CivicRM
From: "Simon Waters \(Surevine\)" Date: Mon, 11 Apr 2016 08:59:13 +0100 CivicRM extends common CMS platforms (WordPress, Drupal) with a module to manage Civic campaigns, tracking donors, amounts, and campaign CRM type activity. I tested the WordPress integration of CivicRM 4.7b3 which was found to have blind SQL Injections that allow authenticated users to download arbitrary database content. The first was in the columns[0][data] parameter when querying a contact relationship in the AJAX query.
Blind SQL injections in CivicRM
From: "Simon Waters (Surevine)" Date: Fri, 8 Apr 2016 18:17:15 +0100 CivicRM extends common CMS platforms (WordPress, Drupal) with a module to manage Civic campaigns, tracking donors, amounts, and campaign CRM type activity. I tested the WordPress integration of CivicRM 4.7b3 which was found to have blind SQL Injections that allow authenticated users to download arbitrary database content. The first was in the columns[0][data] parameter when querying a contact relationship in the AJAX query.
Multiple vulnerabilities in Open Real Estate v 1.15.1
From: "Simon Waters (Surevine)" Date: Fri, 5 Feb 2016 23:11:04 +0000 Introduction: Open Real Estate is an open source CMS for managing estate agent websites. It is written in PHP and uses the YII CMF. It supports multiple languages. It is supported by MonoRay.net The product has a number of commercial support offerings available and an internal market for extensions.
Multiple vulnerabilities in Open Real Estate v 1.15.1
From: "Simon Waters \(Surevine\)" Date: Fri, 5 Feb 2016 23:11:04 +0000 Introduction: Open Real Estate is an open source CMS for managing estate agent websites. It is written in PHP and uses the YII CMF. It supports multiple languages. It is supported by MonoRay.net The product has a number of commercial support offerings available and an internal market for extensions.
Incorrect handling of self signed certificates in OpenFire XMPP Server
Incorrect handling of self signed certificates in OpenFire XMPP Server From: Simon Waters Date: Fri, 24 Apr 2015 14:32:31 +0100 Incorrect handling of self signed certificates in OpenFire XMPP Server Affected software: OpenFire XMPP server Affected versions: 3.9.3 and earlier Vulnerabilities addressed: CVE-2014-3451, CVE-2015-2080 Openfire is a real time collaboration (RTC) server licensed under the Open Source Apache License.
Incorrect handling of self signed certificates in OpenFire XMPP Server
Incorrect handling of self signed certificates in OpenFire XMPP Server From: Simon Waters Date: Thu, 23 Apr 2015 13:05:46 +0100 Incorrect handling of self signed certificates in OpenFire XMPP Server Affected software: OpenFire XMPP server Affected versions: 3.9.3 and earlier Vulnerabilities addressed: CVE-2014-3451, CVE-2015-2080 Openfire is a real time collaboration (RTC) server licensed under the Open Source Apache License.
Insecure file upload in Berta CMS
Your analysis is similar to mine, and private correspondence with the developer. I've added a comment to PHP docs for getimagesize to remind folks it doesn't validate images, I don't think this is a bug.
Insecure file upload in Berta CMS
From: Simon Waters Date: Fri, 27 Mar 2015 10:18:34 +0000 Can a CVE id be allocated for this? Begin forwarded message: From: Simon Waters Subject: Insecure file upload in Berta CMS Date: 26 March 2015 18:01:09 GMT To: bugtraq () securityfocus com, fulldisclosure () seclists org Berta CMS is a web based content management system using PHP and local file storage.
Insecure file upload in Berta CMS
From: Simon Waters Date: Thu, 26 Mar 2015 18:01:09 +0000 Berta CMS is a web based content management system using PHP and local file storage. http://www.berta.me/ Due to use of a 3rd party Berta CMS website to redirect links within a phishing email brought to our attention we checked the file upload functionality of this software. We found that the file upload didn't require authentication.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Simon
Contact Simon, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack