PT-2022-26224 · Gl.Inet · Gl.Inet Goodcloud Iot Device Management System

Name of the Vulnerable Software and Affected Versions: GL.iNet GoodCloud IoT Device Management System version 1.00.220412.00 Description: The issue concerns multiple stored cross-site scripting XSS vulnerabilities. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via...

CVE-2022-42055

GL.iNet GoodCloud IoT Device Management System v1.00.220412.00 is affected by multiple command-injection vulnerabilities in its ping and traceroute tools that allow an attacker to read arbitrary files. Exploitation requires network access with low privileges, and the issues are classified with a ...

CVE-2022-42054

GL.iNet GoodCloud IoT Device Management System, v1.00.220412.00, contains multiple stored XSS vulnerabilities in the Company Name and Description fields. Root cause: insufficient input sanitization allowing injected scripts/HTML to be stored and later rendered. Impact per sources: potential arbit...

Why Secure Hub being an MDM Agent needs all these permissions.

Why Secure Hub being an MDM Agent needs all these permissions...

The vulnerability in the web interface of Cisco Expressway micro-programming software and Cisco TelePresence Video Communication Server micro-programming device management software allows a attacker to perform a CSRF attack.

The vulnerability in the web interface of Cisco Expressway microprogramming software and Cisco TelePresence Video Communication Server control devices is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack using a...

The vulnerability of software for centralized device management in the Zyxel Cloud network lies in the lack of protective measures for SQL query structures, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the software for centralized device management in the Zyxel Cloud network is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information through MySQL queries lik...

The vulnerability of software for centralized device management in the Zyxel Cloud network lies in the unencrypted storage of user credentials, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the software for centralized device management in the Zyxel Cloud network is related to the unencrypted storage of user credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of software for centralized device management in the Zyxel Cloud network lies in the insufficient protection of user credentials, allowing attackers to gain full access to devices in the network.

The vulnerability of the software for centralized device management in the Zyxel Cloud network is related to insufficient protection of user credentials. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full access to devices in the network...

CVE-2020-11015

CVE-2020-11015 affects the thinx-device-api IoT Device Management Server prior to firmware 2.5.0. The root issue allows a spoofed MAC address to bypass UDID checks during initial registration, potentially enabling creation of a new UDID with the same MAC address (noted to apply to ESP8266/ESP32 d...

CVE-2020-11015 Device Authentication Vulnerability in thinx-device-api IoT Device Management Server

A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed. This means initial registration requests without UDID and spoofed MAC address may pass to create new UDID with same MAC address. Full impact needs to be...

CVE-2020-11015 Device Authentication Vulnerability in thinx-device-api IoT Device Management Server

A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed. This means initial registration requests without UDID and spoofed MAC address may pass to create new UDID with same MAC address. Full impact needs to be...

Dataprobe iBoot-PDU

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Dataprobe Equipment: iBoot-PDU FW Vulnerabilities: OS Command Injection, Path Traversal, Exposure of Sensitive Information to an Unauthorized Actor, Improper Access Control, Improper Authorization,...

Authorization

Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decompiling and static research using Jadx,...

PT-2022-4288 · Huawei · Huawei Jad-Al50

Name of the Vulnerable Software and Affected Versions: Huawei JAD-AL50 version 102.0.0.225C00E220R3P4 Description: A permission bypass issue in Huawei's cross-device task management could allow an attacker to access certain resources on the attacked devices. This is related to insecure privilege...

How IT and security teams can work together to improve endpoint security

For executives in the IT and security spaces, the current climate offers reasons to worry. As workers become accustomed to new flexibility in the workplace, hybrid and remote work options present more challenges. Users want to access corporate resources from their own devices without the...

Attacking EFB updates

Software So who actually develops the software installed on Electronic Flight Bags EFBs? The software can originate from a large range of sources: System software developers including the OS, drivers, firmware and utility The aircraft manufacturer for Installed & Portable EFB devices The airline...

The vulnerability of cross-platform solutions for managing mobile devices from FileWave lies in the use of a rigidly encrypted cryptographic key, which allows attackers to gain access to protected information.

The vulnerability of the cross-platform solution for managing mobile devices by FileWave lies in the use of a rigidly encrypted cryptographic key. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the protected information...

The vulnerability of the web server of the cross-platform solution for managing mobile devices by FileWave, related to errors during authentication procedures, allows a hacker to gain full access to the platform.

The vulnerability of the FileWave cross-platform server for managing mobile devices is related to errors during the authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full access to the platform...

KubeEdge Denial of Service Vulnerability

KubeEdge is an open source edge computing framework built on Kubernetes and extends containerized application orchestration and device management to hosts on the end. A denial-of-service vulnerability exists in KubeEdge versions prior to 1.11.0, prior to 1.10.1, and prior to 1.9.3, which can be...

Top Six Security Bad Habits, and How to Break Them

Cybercrime is on the rise, and attacks are getting faster, more nuanced and increasingly sophisticated. The number of cyberattack-related data breaches rose 27 percent in 2021 — an upward trend that shows no signs of slowing down. Bad security habits, such as using the same password more than onc...