Command injection

In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials...

CVE-2021-20998 WAGO: Managed Switches: Unauthorized creation of user accounts

In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users...

CVE-2021-20997

CVE-2021-20997 affects multiple WAGO managed switches. It enables reading password hashes of all Web-based Management users. NVD reports CVSSv3.1 base score 7.5 (NETWORK, LOW attack complexity, no privileges required) with HIGH confidentiality impact; CVSSv2 base score 5.0 (PARTIAL confidentialit...

CVE-2021-20998

CVE-2021-20998 affects WAGO 750-88x series managed switches/PLCs. The vulnerability enables unauthorized creation of user accounts via specially crafted packets, indicating an unauthenticated access path that can impact confidentiality, integrity, and availability. Public references describe the ...

CVE-2021-20997 WAGO: Managed Switches: Unauthorized access to password hashes

In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users...

CVE-2021-20996 WAGO: Managed Switches: Unsecure Cookie settings

In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties...

CVE-2021-20995 WAGO: Managed Switches: Storage of user credentials in a cookie

In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials...

CVE-2021-20994

CVE-2021-20994 concerns a cross-site scripting vulnerability in WAGO 750-88x series managed switches. The root cause is insufficient validation of client-side data in the WEB application, allowing an attacker to trick a legitimate user into clicking a link that injects malicious code into the web...

CVE-2021-20994 WAGO: Managed Switches: Reflected Cross-site Scripting

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management...

CVE-2021-20993 WAGO: Managed Switches: Exposure of sensitive information through directory listing

In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory...

CVE-2021-20995

CVE-2021-20995 affects multiple WAGO managed switches across versions, where the web UI’s server cookies expose user credentials. The issue stems from the web server handling cookies insecurely, enabling exposure of authentication data. Documented impact relates to confidentiality (credentials di...

CVE-2021-20993

CVE-2021-20993 affects multiple WAGO managed switches where an activated directory listing exposes the index of resources inside a directory. The root cause is an information-disclosure path via directory listing, enabling an attacker to enumerate resources. Impact is limited to confidentiality (...

CVE-2021-20996

The CVE-2021-20996 entry concerns WAGO managed switches. Affected product: multiple WAGO managed switches across different versions. Vulnerability: specially crafted requests can cause cookies to be transferred to third parties, exposing session-related data. Root cause details are limited in the...

Cisco Nexus 9000 Series Fabric Switches ACI Mode Fabric Infrastructure VLAN Unauthorized Access (cisco-sa-n9kaci-unauth-access-5PWzDx2w)

According to its self-reported version, the fabric infrastructure VLAN connection establishment of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI is affected by unauthorized access vulnerability due to insufficient security requirements during the Link Layer...

Security Bulletin: Vulnerability in Fabric OS used by IBM b-type SAN directors and switches.

Summary Public disclosed vulnerability from OpenSSL in the Fabric OS used by IBM b-type SAN directors and switches. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an...

CVE-2021-20997

In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users...

CVE-2021-20994

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management...

CVE-2021-20995

In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials...

Cisco Catalyst 9200 Series Switches Jumbo Frame DoS (cisco-sa-JP-DOS-g5FfGm8y)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service vulnerability due to insufficient packet size validation. An unauthenticated, remote attacker can exploit this, by sending jumbo frames or frames larger than the configured MTU size to the management...

CVE-2021-25669

A vulnerability has been identified in SCALANCE X200-4P IRT All versions 5.5.1, SCALANCE X201-3P IRT All versions 5.5.1, SCALANCE X201-3P IRT PRO All versions 5.5.1, SCALANCE X202-2 IRT All versions 5.5.1, SCALANCE X202-2P IRT incl. SIPLUS NET variant All versions 5.5.1, SCALANCE X202-2P IRT PRO...