Phish Swims Past Email Security with Milanote Pages

The Milanote app, billed as the “Evernote for creatives” by reviewers, has attracted the notice of cybercriminals who are abusing it to carry out credential-stealing campaigns that skate past secure email gateways SEGs, researchers said. Milanote is a tool for organizing and collaborating on...

Security Bulletin: Vulnerability in SSL affects IBM DataPower Gateways (CVE-2016-8610)

Summary An SSL vulnerability was disclosed by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2016-8610 DESCRIPTION: SSL/TLS protocol is vulnerable to a denial of service, caused by an error when processing ALERT packets during a SSL...

Security Bulletin: A vulnerability in GSKit affects IBM DataPower Gateways (CVE-2015-1788)

Summary An OpenSSL denial of service vulnerability disclosed by the OpenSSL Project affects GSKit. IBM DataPower Gateways uses GSKit in certain moduels - namely MQ, ISAM/TAM, JMS. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2015-1788 DESCRIPTION:...

Security Bulletin: Certain cookies missing Secure attribute in IBM DataPower Gateways (CVE-2015-7427)

Summary IBM DataPower Gateways has addressed an issue with missing Secure attribute on certain HTTP cookies. Vulnerability Details CVEID: CVE-2015-7427 DESCRIPTION: IBM DataPower Gateways could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag f...

Security Bulletin: Vulnerabilities in XML processing affect IBM DataPower Gateways

Summary IBM DataPower Gateways has addressed vulnerabilities in processing certain XML files that could cause a denial of service. Vulnerability Details CVEID: CVE-2015-5312 DESCRIPTION: An unspecified error in Libxml2 related to an entity expansion flaw has an unknown impact and attack vector...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-3193, CVE-2015-3195, CVE-2015-1794)

Summary SSL vulnerabilities were disclosed on December 3rd, 2015. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3193 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the x8664 Montgomery...

Security Bulletin: Vulnerabilities in standard C library affect IBM DataPower Gateways (CVE-2013-7423, CVE-2015-1781)

Summary IBM DataPower Gateways has addressed a vulnerability in the standard C library that it uses to access DNS. Vulnerability Details CVEID: CVE-2013-7423 DESCRIPTION: GNU glibc could allow a local attacker to obtain sensitive information, caused by the writing of DNS queries to random file...

Security Bulletin: Multiple vulnerabilities in SSL affect IBM DataPower Gateways

Summary SSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error when parsing DSA privat...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-0287, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293)

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. IBM DataPower Gateway has addressed the corresponding applicable CVEs. Vulnerability Details CVEID: CVE-2015-0287 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways

Summary SSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2108 DESCRIPTION: OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a buffer...

Security Bulletin: Vulnerabilities in SSL affect IBM DataPower Gateways (CVE-2015-3197 )

Summary SSL vulnerabilities were disclosed on January 28, 2016 by the OpenSSL Project. IBM DataPower Gateways has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2015-3197 DESCRIPTION: OpenSSL could allow a remote attacker to conduct man-in-the-middle attacks, caused by an error...

Microsoft, Google Clouds Hijacked for Gobs of Phish

Threat actors are cashing in on the rapid shift to cloud-based business services during the pandemic, by hiding behind ubiquitous, trusted services from Microsoft and Google to make their email phishing scams look legit. And it’s working. In fact, in the first three months of 2021 alone,...

Forrester names Microsoft a Leader in The Forrester Wave™: Cloud Security Gateways, Q2 2021

I am thrilled to share that Forrester Research has named Microsoft Cloud App Security as a Leader in The Forrester Wave: Cloud Security Gateways, Q2 2021. Additionally, Microsoft received the highest score in the strategy category. People have increasingly used cloud apps to stay productive and...

Forrester names Microsoft a Leader in The Forrester Wave™: Cloud Security Gateways, Q2 2021

I am thrilled to share that Forrester Research has named Microsoft Cloud App Security as a Leader in The Forrester Wave: Cloud Security Gateways, Q2 2021. Additionally, Microsoft received the highest score in the strategy category. People have increasingly used cloud apps to stay productive and...

CVE-2021-20999

In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via external network interfaces. By exploiting this vulnerability the device may be manipulated or the operation may be stopped...

Spoofing

In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via external network interfaces. By exploiting this vulnerability the device may be manipulated or the operation may be stopped...

CVE-2021-20999 WEIDMUELLER: Accidentally open network port in u-controls and IoT-Gateways

In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally accessible via external network interfaces. By exploiting this vulnerability the device may be manipulated or the operation may be stopped...

CVE-2021-20999

The CVE-2021-20999 issue affects Weidmüller u-controls and IoT-Gateways (versions up to 1.12.1). A network port intended for device-internal use is reachable via external interfaces, enabling manipulation of the device or disruption of operation. The vulnerability is documented with high/critical...

PT-2021-14328 · Weidmüller · Iot-Gateways +1

Name of the Vulnerable Software and Affected Versions: Weidmüller u-controls and IoT-Gateways versions up to 1.12.1 Description: A network port intended for device-internal usage is accidentally accessible via external network interfaces, allowing the device to be manipulated or its operation to ...

CVE-2021-3275

Unauthenticated stored cross-site scripting XSS exists in multiple TP-Link products including WIFI Routers Wireless AC routers, Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper...