smartfactory-iot.com Cross Site Scripting vulnerability OBB-3232609

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Leverage cloud-powered security with Microsoft Defender for IoT

Traditionally, operational technology OT and IT have occupied separate sides of enterprise security. But with digital transformation and the advent of Industry 4.0, the old, siloed approach is showing its age.1 The rise of manufacturing execution systems has enabled more “smart factories” to...

Leverage cloud-powered security with Microsoft Defender for IoT

Traditionally, operational technology OT and IT have occupied separate sides of enterprise security. But with digital transformation and the advent of Industry 4.0, the old, siloed approach is showing its age.1 The rise of manufacturing execution systems has enabled more “smart factories” to...

CVE-2023-28116

Contiki-NG is an open-source, cross-platform operating system for internet of things IoT devices. In versions 4.8 and prior, an out-of-bounds write can occur in the BLE L2CAP module of the Contiki-NG operating system. The network stack of Contiki-NG uses a global buffer packetbuf for processing o...

CVE-2023-28116

CVE-2023-28116 concerns Contiki-NG (IoT OS) prior to v4.9, where the BLE L2CAP module can cause an out-of-bounds write due to a mis sized packet buffer. The global packetbuf (size PACKETBUF_SIZE) may be exceeded when processing large packets with BLE L2CAP in the default configuration, leading to...

CVE-2023-28116 Buffer overflow in L2CAP due to misconfigured MTU

Contiki-NG is an open-source, cross-platform operating system for internet of things IoT devices. In versions 4.8 and prior, an out-of-bounds write can occur in the BLE L2CAP module of the Contiki-NG operating system. The network stack of Contiki-NG uses a global buffer packetbuf for processing o...

Contec CONPROSYS IoT Gateway 加密问题漏洞

Contec CONPROSYS IoT Gateway is an IoT gateway software from Contec Japan. Contec CONPROSYS IoT Gateway suffers from a security vulnerability that stems from insufficient encryption strength, which can be exploited by an authenticated attacker to cause a denial of service DoS and execute arbitrar...

PT-2023-21574 · Unknown · Contiki-Ng

Name of the Vulnerable Software and Affected Versions: Contiki-NG versions 4.8 and prior Description: Contiki-NG is an open-source, cross-platform operating system for internet of things IoT devices. In the affected versions, an out-of-bounds write can occur in the BLE L2CAP module of the...

Exploit for OS Command Injection in Netmodule Netmodule_Router_Software

Analyzing and Reproducing the Command Injection Vulnerabilit...

National Cybersecurity Strategy Document: What you need to know

The US Government has been working on the National Cybersecurity Strategy Document 2023 for some time now, and its finally been released. The strategy document, which replaces the last such piece of work from 2018, attempts to indicate the general direction of the US approach to cybercrime and...

New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices

A pair of serious security defects has been disclosed in the Trusted Platform Module TPM 2.0 reference library specification that could potentially lead to information disclosure or privilege escalation. One of the vulnerabilities, CVE-2023-1017, concerns an out-of-bounds write, while the other,...

CVE-2023-0847

The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementation version 0.5.0. If the protocol has been compiled using default settings, this will only grant the attacker access to allocated but unused memory. However,...

CVE-2023-0847

The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementation version 0.5.0. If the protocol has been compiled using default settings, this will only grant the attacker access to allocated but unused memory. However,...

Out-of-bounds

The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementation version 0.5.0. If the protocol has been compiled using default settings, this will only grant the attacker access to allocated but unused memory. However,...

CVE-2023-0847

The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementation version 0.5.0. If the protocol has been compiled using default settings, this will only grant the attacker access to allocated but unused memory. However,...

CVE-2023-0847

The CVE-2023-0847 vulnerability affects Sub-IoT DASH 7 Alliance protocol implementations prior to version 0.5.0. The issue is an out-of-bounds write that, with default settings, may expose allocated but unused memory; with non-default settings, exploitation could crash the system or enable remote...

Sub-IoT 缓冲区错误漏洞

Sub-IoT is an open source stack of the Dash7 Alliance protocol for Sub-IoT. A buffer error vulnerability exists in Sub-IoT DASH 7 Alliance protocol implementation prior to version 0.5.0, which stems from Sub-IoT A security issue exists that can lead to out-of-bounds writes, which would only allow...

Sub-IoT DASH 7 Alliance Protocol stack implementation

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sub-IoT project Equipment: DASH 7 Alliance Protocol stack implementation Vulnerability: Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

New Mirai Botnet Variant 'V3G4' Exploiting 13 Flaws to Target Linux and IoT Devices

A new variant of the notorious Mirai botnet has been found leveraging several security vulnerabilities to propagate itself to Linux and IoT devices. Observed during the second half of 2022, the new version has been dubbed V3G4 by Palo Alto Networks Unit 42, which identified three different...

Researchers Warn of Critical Security Bugs in Schneider Electric Modicon PLCs

Security researchers have disclosed two new vulnerabilities affecting Schneider Electric Modicon programmable logic controllers PLCs that could allow for authentication bypass and remote code execution. The flaws, tracked as CVE-2022-45788 CVSS score: 7.5 and CVE-2022-45789 CVSS score: 8.1, are...