PT-2022-19806

Name of the Vulnerable Software and Affected Versions Delta Controls enteliTOUCH versions 3.33.4005, 3.40.3706, 3.40.3935 Description The issue allows attackers to intercept HTTP Cookie authentication credentials via a man-in-the-middle attack because sensitive information is transmitted and stor...

CVE-2022-29732: Improper Neutralization of Input During Web Page Generation

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting XSS vulnerability via the Username parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2022-19808

Name of the Vulnerable Software and Affected Versions Delta Controls enteliTOUCH versions 3.33.4005, 3.40.3706, 3.40.3935 Description The issue allows attackers to execute arbitrary commands via a crafted HTTP request. Recommendations For versions 3.33.4005, 3.40.3706, and 3.40.3935, at the momen...

PT-2022-19805

Name of the Vulnerable Software and Affected Versions Delta Controls enteliTOUCH versions 3.33.4005, 3.40.3706, 3.40.3935 Description A cross-site scripting XSS issue was found, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload, specifically through the Username...

CVE-2022-29735: Cross-Site Request Forgery (CSRF)

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a crafted HTTP request...

CVE-2022-29733: Cleartext Transmission of Sensitive Information

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive information in cleartext. This vulnerability allows attackers to intercept HTTP Cookie authentication credentials via a man-in-the-middle attack...

Understanding compliance platform capabilities: black box automation has its limitations

Compliance is hard. It is not a "black box" of opaque inputs and outputs, where systems and data are hidden and where users are oblivious to their inner workings. There has yet to be a product made that can magically produce all the evidence sufficient for testing and verification across the wide...

Qualys FIM: Be Compliance Ready with Intuitive, Ready-to-Use File Monitoring Profiles

Requirements for file-level security are often set by laws, regulations, and audit standards. These include identification of what must be protected, the various controls required to implement security, and outcomes required to successfully pass audits for compliance. This blog describes these an...

Improper Certificate Validation in MongoDB

Specific versions of the Java driver that support client-side field level encryption CSFLE fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffi...

GHSA-5HCX-VG88-HGPM Magento 2 Community Edition Insufficient Access Controls

Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes...

Publify has Improper Access Controls

A low-privileged user can modify and delete admin articles by changing the value of the articleid parameter prior to 9.2.9...

GHSA-C273-C6VG-4PV5 Publify has Improper Access Controls

A low-privileged user can modify and delete admin articles by changing the value of the articleid parameter prior to 9.2.9...

Put SecOps in the Driver’s Seat with Custom Assessment and Remediation

When zero-day threats emerge, time is of the essence. Security teams struggle to manage and respond to a range of challenges that often require custom approaches outside of existing vulnerability and security programs. Recently, many companies scrambled to mount their defenses against the Log4She...

Easy authentication and authorization in Azure Active Directory with No-Code Datawiza

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. The acceleration of cloud journeys fueled by the pandemic and ever-increasing concerns about data security and information privacy have made access management one of the hottest topi...

Weak Security Controls and Practices Routinely Exploited for Initial Access

The cybersecurity authorities of the United States, Canada, New Zealand, the Netherlands, and the United Kingdom have issued a joint Cybersecurity Advisory CSA on 10 routinely exploited weak security controls, poor configurations, and bad practices that allow malicious actors to compromise...

CVE-2021-27444

The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator...

CVE-2021-27444

The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator...

CVE-2021-27444

The CVE-2021-27444 issue affects Weintek EasyWeb cMT product line, arising from improper access controls that allow an unauthenticated remote attacker to access sensitive data and perform administrative actions as a legitimate administrator. The CVE is documented with a high/critical impact (CVSS...

Got the security controls wrong in OT and maritime? Watch as engineers work around them

Industrial control systems security is slowly improving, partly a result of attention from regulators and lawmakers. However, we often see security controls implemented that don’t take account of the unique challenges that engineers looking after OT environments face. We see controls brought in...

PT-2022-9823

Name of the Vulnerable Software and Affected Versions Weintek cMT affected versions not specified Description The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perfo...