PT-2022-9225

Name of the Vulnerable Software and Affected Versions Sealevel Systems, Inc. SeaConnect 370W version 1.3.34 Description An out-of-bounds write issue exists in the URL decode functionality. A specially-crafted MQTT payload can lead to an out-of-bounds write. An attacker can perform a...

PT-2022-9217

Name of the Vulnerable Software and Affected Versions Sealevel Systems, Inc. SeaConnect 370W version 1.3.34 Description An information disclosure issue exists in the Web Server functionality. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attack...

CVE-2021-21962: Heap-based Buffer Overflow

A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A series of specially-crafted MQTT payloads can lead to remote code execution. An attacker must perform a man-in-the-middle attack in order to trigger th...

CVE-2021-21959: Improper Certificate Validation

A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality...

PT-2022-9216

Name of the Vulnerable Software and Affected Versions SeaConnect 370W version 1.3.34 Description A heap-based buffer overflow issue exists in the OTA Update u-download functionality. This can be triggered by a series of specially-crafted MQTT payloads, potentially leading to remote code execution...

Low-Detection Phishing Kits Increasingly Bypass MFA

More and more phishing kits are focusing on bypassing multi-factor authentication MFA methods, researchers have warned – typically by stealing authentication tokens via a man-in-the-middle MiTM attack. As MFA continues to see widespread consumer and business adoption – a full 78 percent of...

Unpatched Security Bugs in Medical Wearables Allow Patient Tracking, Data Theft

Telehealth care is on the rise as medical service providers cope with the strain of a pandemic and rising costs. But the rush to roll out remote healthcare has also unleashed a universe of wearable medical devices to collect sensitive data, which researchers say are widely vulnerable to attack...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect Snapshot for VMware (CVE-2014-7810, CVE-2018-8039)

Summary IBM WebSphere Application Server Liberty is affected by Apache Tomcat and CXF vulnerabilities that affect IBM Spectrum Protect Snapshot formerly Tivoli Storage FlashCopy Manager for VMware. Vulnerability Details CVEID: CVE-2014-7810 DESCRIPTION: Apache Tomcat could allow a remote attacker...

ROS-20220125-13

Vulnerability of PostgreSQL database management system is related to failure to take measures to encrypt protected data of protected data. Exploitation of the vulnerability could allow a remote attacker, realize a man-in-the-middle attack Vulnerability in libpq library of PostgreSQL database...

Sealevel Systems SeaConnect 370W Trust Management Vulnerability

Sealevel Systems SeaConnect 370W is an Industrial Internet of Things Iiot edge device from Sealevel Systems, Inc. The Sealevel Systems SeaConnect 370W is vulnerable to a trust management issue stemming from a misconfiguration of the product's MQTTS functionality, which could be exploited by an...

Sealevel Systems, Inc. SeaConnect 370W OTA update task file overwrite vulnerability

Summary A file write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Tested Version...

Sealevel Systems, Inc. SeaConnect 370W MQTTS Certificate Validation vulnerability

Summary A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality. Tested Versions Sealevel Systems, Inc. SeaConnect 370...

Sealevel Systems, Inc. SeaConnect 370W OTA update task out-of-bounds write vulnerability

Summary An out-of-bounds write vulnerability exists in the OTA update task functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to denial of service. An attacker can perform a man-in-the-middle attack to trigger this vulnerability. Tested...

CVE-2022-21199

An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.13620121102. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

Information disclosure

An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.13620121102. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2022-21199

An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.13620121102. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

CVE-2022-21199

CVE-2022-21199 concerns the Reolink RLC-410W WiFi security camera. Talos reports a root cause of a hardcoded TLS private key in firmware for version v3.0.0.136_20121102, enabling a network attacker to perform MITM attacks and disclose sensitive data. The vulnerability affects the camera’s TLS tra...

CVE-2022-21199

An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.13620121102. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. An attacker can perform a man-in-the-middle attack to trigger this vulnerability...

IBM Security Guardium Insights Information Disclosure Vulnerability (CNVD-2022-08968)

IBM Security Guardium Insights is a data security solution from IBM Corporation. IBM Security Guardium Insights has an information disclosure vulnerability in version 3.0 that stems from a failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to...

Mageia: Security Advisory (MGASA-2018-0283)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...