CVE-2021-32978 Automation Direct CLICK PLC CPU Modules Plaintext Storage of a Password

The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00...

CVE-2021-32978

The CVE-2021-32978 entry describes a vulnerability in Automation Direct CLICK PLC CPU Modules (C0-1x) with firmware prior to v3.00 where a previously entered password and lock state can be read from the programming protocol, effectively exposing credentials and enabling unlocks if the password wa...

CVE-2021-32980 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

CVE-2021-32980

CVE-2021-32980 affects Automation Direct CLICK PLC CPU Modules, specifically the C0-1x CPUs with firmware older than 3.00. The issue is an authentication bypass via an alternate path or channel, caused by the firmware not protecting against additional software programming connections. An attacker...

CVE-2021-32980 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

CVE-2021-32984: Authentication Bypass Using an Alternate Path or Channel

All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can connect to the PLC and read the project...

PT-2022-10176

Name of the Vulnerable Software and Affected Versions Automation Direct CLICK PLC CPU Modules: C0-1x CPUs versions prior to v3.00 Description The issue allows an attacker to connect to the PLC and read the project without authorization during the time it is unlocked by an authorized user, resulti...

PT-2022-10172

Name of the Vulnerable Software and Affected Versions Automation Direct CLICK PLC CPU Modules: C0-1x CPUs versions prior to v3.00 Description The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was...

PT-2022-10173

Name of the Vulnerable Software and Affected Versions Automation Direct CLICK PLC CPU Modules versions prior to v3.00 Description The issue allows an attacker to connect to the PLC while an existing connection is already active, due to insufficient protection against additional software programmi...

CVE-2021-32986: Authentication Bypass Using an Alternate Path or Channel

After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is interrupted, the PLC remains unlocked. All subsequent programming connections are allowed without...

CVE-2021-32978: Plaintext Storage of a Password

The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00...

CVE-2021-32980: Authentication Bypass Using an Alternate Path or Channel

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...

PT-2022-10175

Name of the Vulnerable Software and Affected Versions Automation Direct CLICK PLC CPU Modules versions prior to v3.00 Description The issue concerns the transmission of passwords in plaintext during unlocking and project transfers for Automation Direct CLICK PLC CPU Modules. An attacker with...

PT-2022-10178 · Automationdirect · Automation Direct Click Plc Cpu Modules

Name of the Vulnerable Software and Affected Versions: Automation Direct CLICK PLC CPU Modules: C0-1x CPUs versions prior to v3.00 Description: The issue arises when an authorized user unlocks the Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00. The unlocked state...

CVE-2021-32982: Cleartext Transmission of Sensitive Information

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange...

Apple Rushes Out Patches for 0-Days in MacOS, iOS

Apple rushed out patches for two zero-days affecting macOS and iOS Thursday, both of which are likely under active exploitation and could allow a threat actor to disrupt or access kernel activity. Apple released separate security updates for the bugs – a vulnerability affecting both macOS and iOS...

Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is affected by arbitrary code execution and other attacks due to multiple vulnerabilities.

Summary Multiple vulnerabilities in IBM WebSphere Application Server allow arbitrary code execution, LDAP injection, unauthorized access, and click hijacking as described in the CVEs listed in the vulnerability details section. IBM WebSphere Application Server Liberty for IBM i has addressed the...

Ukraine shuts down disinformation bot farm

Given current world events, there’s an incredible amount of misinformation and disinformation around at the moment. Whether we’re talking 5G, the pandemic, vaccines, or invasions, there’s a lot out there. One of the biggest problems where bad information placed online is concerned is bot farms. A...

FORCEDENTRY: Sandbox Escape

Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture SEAR group for collaborating with us on the technical analysis. Any editorial opinions reflected below ar...

ftp.stg.maturedatingclick.com Cross Site Scripting vulnerability OBB-2455502

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...