Shanghai Sunfull Automation BACnet Server HMI1002-ARM 安全漏洞

The Shanghai Sunfull Automation BACnet Server HMI1002-ARM is a WEB configuration gateway from Shanghai Sunfull in China. A security vulnerability exists in the Shanghai Sunfull Automation BACnet Server HMI1002-ARM version 2.0.4, which is caused by a buffer overflow...

VulnCheck KEV: CVE-2023-4474

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

CVE-2024-3378

A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack...

CVE-2024-3378

A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack...

CVE-2024-3378 iboss Secure Web Gateway Login Portal login cross site scripting

A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack...

CVE-2024-3378

The iboss Secure Web Gateway is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to 10.1 (and specifically noted as prior to 10.2.0 ). The flaw exists within the Login Portal component, specifically in the /login file, where the application fails to properly neutralize input in the ...

CVE-2024-3378: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack...

VulnCheck KEV: CVE-2012-0297

The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by 1 injecting crafted data or 2 including crafted data...

The vulnerability in the McAfee Web Gateway, related to code errors, allows attackers to trigger a service failure.

The vulnerability of the McAfee Web Gateway is related to errors in the code. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

How to block access URL https://x.x.x.x/oauth/idp/.well-known/openid-configuration

This article will guide on how to block access to the URL https://x.x.x.x/oauth/idp/.well-known/openid-configuration, where x.x.x.x is the URL of the gateway...

Weintek cMT Operating System Command Injection Vulnerability

Weintek cMT is a human machine interface application from Weintek. A security vulnerability exists in the Weintek cMT3000 HMI Web CGI that originates from an anonymous attacker who can execute arbitrary commands while logged into the device...

CVE-2023-4400

A password management vulnerability in Skyhigh Secure Web Gateway SWG in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was...

CVE-2023-4400

A password management vulnerability in Skyhigh Secure Web Gateway SWG in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was...

CVE-2023-4400

A password management vulnerability in Skyhigh Secure Web Gateway SWG in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was...

CVE-2023-4400

Skyhigh Secure Web Gateway (SWG) is affected: versions 11.x prior to 11.2.14, 10.x prior to 10.2.25, and 12.x prior to 12.2.1 contain a password-management issue where authentication information stored in configuration files can be extracted via the SWG REST API because passwords are stored in pl...

CVE-2023-4400: Plaintext Storage of a Password

A password management vulnerability in Skyhigh Secure Web Gateway SWG in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was...

McAfee Skyhigh Secure Web Gateway Security Vulnerability

McAfee Skyhigh Secure Web Gateway McAfee Skyhigh SWG is a family of secure gateways from McAfee, Inc. A security vulnerability exists in McAfee Skyhigh Secure Web Gateway that stems from a password management vulnerability that allows passwords to be stored in plain text...

Microsoft Entra expands into Security Service Edge and Azure AD becomes Microsoft Entra ID

A year ago when we announced the Microsoft Entra product family, we asked what the world could achieve if we had trust in every digital experience and interaction.1 This question inspired us to offer a vision for securing the millions and millions of connections that happen every second between...

What is Secure Web Gateway’s (SWG) Role in Zero Trust?

Explore why secure web gateway SWG is important to effectively secure cloud resources and reduce cyber risk across the attack surface and the role a zero trust strategy can play...

The vulnerability of the WSGI Werkzeug web application library, related to the distribution of resources without restrictions or regulation, allows a hacker to replace the cookie file.

The vulnerability of the WSGI Werkzeug web application lies in the fact that the application does not properly control the consumption of internal resources when processing data with a complex structure and containing a large number of fields. Exploiting this vulnerability could allow an attacker...