CVE-2021-20994: Improper Neutralization of Input During Web Page Generation

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management...

CVE-2021-20996: Incorrect Permission Assignment for Critical Resource

In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties...

CVE-2021-20995: Cleartext Storage of Sensitive Information

In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials...

PT-2021-14323

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows an attacker to trick a legitimate user into clicking a link, potentially injecting malicious code into the Web-Based Management of the switches...

PT-2021-14327

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows creation of users without authorization in multiple managed switches by WAGO, using specially crafted packets. Recommendations: At the moment, there is no...

PT-2021-14324

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The web-based UI of the managed switches by WAGO contains a security issue where the webserver cookies store user credentials. This potentially exposes user credentials to...

PT-2021-14326

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows an attacker to read out the password hashes of all Web-based Management users in multiple managed switches by WAGO. Recommendations: At the moment, there is n...

PT-2021-14322

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows an attacker to obtain the index of resources inside a directory due to the activated directory listing in multiple managed switches by WAGO. Recommendations: ...

PT-2021-14325

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows special crafted requests to lead to cookies being transferred to third parties. Recommendations: At the moment, there is no information about a newer version...

CVE-2021-20993: Exposure of Sensitive Information to an Unauthorized Actor

In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory...

CVE-2021-20998: Missing Authentication for Critical Function

In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users...

CVE-2021-32563: Improper Control of Dynamically-Managed Code Resources

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program based on the file type without user confirmation. This could be used to achieve code execution...

MDR Vendor Must-Haves, Part 10: Included Security Orchestration and Automation

This blog post is part of an ongoing series about evaluating Managed Detection and Response MDR providers. For more insights, check out our guide, “10 Things Your MDR Service Must Do.” Cybersecurity teams continue to be challenged by resource constraints and disconnected toolsets. One method of...

CVE-2021-20995

In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials...

CVE-2021-20996

In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties...

Citrix ShareFile storage zones controller security update

Description of Problem A security issue has been identified in the Citrix ShareFile storage zones controller which, if exploited, would allow an unauthenticated attacker to remotely compromise the storage zones controller. The issue has been given the following identifier: CVE-ID | Description |...

ansible: multiple modules expose secured values

A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the nolog feature. An...

MDR Vendor Must-Haves, Part 8: Rapid7 Incident Response (Breach) Support

This blog post is part of an ongoing series about evaluating Managed Detection and Response MDR providers. For more insights, check out our guide, “10 Things Your MDR Service Must Do.” This is possibly the most overlooked aspect of selecting an MDR partner. But when you get to a hair-on-fire,...

Shopify: Add new managed stores without permission

Details A staff member who has permission to add, archive and unarchive development stores as shown in managedStoreA.png can also add new managed stores. I can't tell if the issue I pointed out in 1167453 has the same root cause as this. A staff member with the said permission can access...

MDR Vendor Must-Haves, Part 7: Managed Response Actions

This blog post is part of an ongoing series about evaluating Managed Detection and Response MDR providers. For more insights, check out our guide, “10 Things Your MDR Service Must Do.” Security teams face unprecedented challenges as the threat landscape expands in scope and complexity. More...