Tracking People by their MAC Addresses

Yet another article on the privacy risks of static MAC addresses and always-on Bluetooth connections. This one is about wireless headphones. The good news is that product vendors are fixing this: Several of the headphones which could be tracked over time are for sale in electronics stores, but...

ASB-A-189392423

1188785118878711887891188792...

PT-2021-20546 · Pepperl+Fuchs · Pepperl+Fuchs Wirelesshart-Gateway

Name of the Vulnerable Software and Affected Versions: PEPPERL+FUCHS WirelessHART-Gateway versions 3.0.8 and earlier Description: A serious issue exists in the application if it is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or...

GHSA-54GP-QFF8-946C Insecure direct object reference of log files of the Import/Export feature

Impact Insecure direct object reference of log files of the Import/Export feature Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6...

Command injection in mail agent settings

Impact Command injection in mail agent settings Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of...

GHSA-XH55-2FQP-P775 Command injection in mail agent settings

Impact Command injection in mail agent settings Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of...

GHSA-9F8F-574Q-8JMF Manipulation of product reviews via API

Impact Manipulation of product reviews via API Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workarounds For older versions of 6....

The Increased Liability of Local In-home Propagation

Today I discuss an attack vector conducive to cross-organizational spread, in-home local propagation. Though often overlooked, this vector is especially relevant today, as many corporate employees remain working from home. In this post, I contrast in-home local propagation with traditional vector...

Insufficient Logging Monitoring☝️ — What you need to know

Insufficient Logging Monitoring☝️ — What you need to know Introduction API10:2019 Insufficient Logging & Monitoring What is Insufficient Logging & Monitoring? The title already says a lot but this vulnerability is a bit more complex than it was at first sight, of course the API is vulnerable if it...

Improper Assets Management☝️ — What you need to know

Improper Assets Management☝️ — What you need to know Introduction API9:2019 Improper Assets Management What is Improper Assets Management? We should always wonder for every API if all the current endpoint should even be available and if we maybe can’t do with only allowing the API to communicate...

The vulnerability of the feedback_process.php implementation in the online sales E-Commerce Website system allows attackers to perform cross-site scripting attacks.

The vulnerability of the feedbackprocess.php implementation in the online sales system for e-commerce websites is related to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows attackers to perform cross-site scripting attacks remotely...

Cybercriminals Selling Access to Compromised Networks: 3 Surprising Research Findings

Cybercriminals are innovative, always finding ways to adapt to new circumstances and opportunities. The proof of this can be seen in the rise of a certain variety of activity on the dark web: the sale of access to compromised networks. This type of dark web activity has existed for decades, but i...

API8: Injection☝️ — What you need to know

API8: Injection☝️ — What you need to know Introduction API8:2019 Injection What is Injection? API’s with the following properties are open to injection flaws: When we don’t sanitize the input from the front-end we are opening ourselves to a world of problems, this would allow the user to input...

GHSA-GCVV-GQ92-X94R Authenticated server-side request forgery in file upload via URL.

Impact Authenticated server-side request forgery in file upload via URL. Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workaround...

Authenticated server-side request forgery in file upload via URL.

Impact Authenticated server-side request forgery in file upload via URL. Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/shopware-6 Workaround...

Excessive Data Exposure☝️ — What you need to know

Excessive Data Exposure☝️ — What you need to know Introduction API3:Excessive Data Exposure What is Excessive Data Exposure? An API is only supposed to return the required data to the front-end clients but sometimes teams will make a mistake or take the easy route and implement APIs that return al...

CVE-2021-37711

Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin...

CVE-2021-37711

Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin...

Server side request forgery (ssrf)

Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin...

Cross site scripting

Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin...