CVE-2021-20995 WAGO: Managed Switches: Storage of user credentials in a cookie

In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials...

CVE-2021-20996

The CVE-2021-20996 entry concerns WAGO managed switches. Affected product: multiple WAGO managed switches across different versions. Vulnerability: specially crafted requests can cause cookies to be transferred to third parties, exposing session-related data. Root cause details are limited in the...

CVE-2021-20995

CVE-2021-20995 affects multiple WAGO managed switches across versions, where the web UI’s server cookies expose user credentials. The issue stems from the web server handling cookies insecurely, enabling exposure of authentication data. Documented impact relates to confidentiality (credentials di...

CVE-2021-20993 WAGO: Managed Switches: Exposure of sensitive information through directory listing

In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory...

CVE-2021-20994 WAGO: Managed Switches: Reflected Cross-site Scripting

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management...

CVE-2021-20994

CVE-2021-20994 concerns a cross-site scripting vulnerability in WAGO 750-88x series managed switches. The root cause is insufficient validation of client-side data in the WEB application, allowing an attacker to trick a legitimate user into clicking a link that injects malicious code into the web...

CVE-2021-20996 WAGO: Managed Switches: Unsecure Cookie settings

In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties...

PT-2021-14323

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows an attacker to trick a legitimate user into clicking a link, potentially injecting malicious code into the Web-Based Management of the switches...

PT-2021-14327

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows creation of users without authorization in multiple managed switches by WAGO, using specially crafted packets. Recommendations: At the moment, there is no...

PT-2021-14324

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The web-based UI of the managed switches by WAGO contains a security issue where the webserver cookies store user credentials. This potentially exposes user credentials to...

PT-2021-14326

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows an attacker to read out the password hashes of all Web-based Management users in multiple managed switches by WAGO. Recommendations: At the moment, there is n...

PT-2021-14322

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows an attacker to obtain the index of resources inside a directory due to the activated directory listing in multiple managed switches by WAGO. Recommendations: ...

PT-2021-14325

Name of the Vulnerable Software and Affected Versions: WAGO managed switches affected versions not specified Description: The issue allows special crafted requests to lead to cookies being transferred to third parties. Recommendations: At the moment, there is no information about a newer version...

CVE-2021-20998: Missing Authentication for Critical Function

In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create users...

CVE-2021-20997: Insufficiently Protected Credentials

In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users...

CVE-2021-20996: Incorrect Permission Assignment for Critical Resource

In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties...

CVE-2021-20993: Exposure of Sensitive Information to an Unauthorized Actor

In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory...

CVE-2021-20995: Cleartext Storage of Sensitive Information

In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials...

CVE-2021-20994: Improper Neutralization of Input During Web Page Generation

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management...

CVE-2021-32563: Improper Control of Dynamically-Managed Code Resources

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program based on the file type without user confirmation. This could be used to achieve code execution...