⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Multiple vulnerabilities have been identified in CareCam CM2507 firmware version v251211.1507 that could allow an attacker to access live video feeds and sensitive device information, enable unauthorized services, execute arbitrary code, modify device operation, and recover stored credentials. The vulnerabilities include missing authentication for critical functions and use of empty passwords, with a CVSS v3 base score of 7.5.
View CSAF Summary Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring and control.
Siemens has disclosed multiple vulnerabilities affecting its Reyrolle 7SR5 protection relays running versions prior to V2.70. The vulnerabilities include integer overflow or wraparound, improper neutralization of delimiters, use of out-of-range pointer offsets, missing authentication for critical functions, insufficient entropy, improper input validation, out-of-bounds writes, allocation of resources without limits, authentication bypass, insertion of sensitive information into debugging code, and download of code without integrity check.
Advisory on CHOSEN BRICK malware, including technical analysis and advice to help individuals and organisations protect themselves.
Developed by the National Institute of Standards and Technology (NIST) and CISA, this interagency report provides federal agencies and cloud service providers with guidelines to protect the identity assertions, access tokens, and cryptographic mechanisms that support modern authentication and authorization. As agencies adopt hybrid and multi-cloud environments, single sign-on, federation, and application programming interface (API)-based access increasingly depend on signed tokens and assertions that adversaries may target for forgery, theft, and misuse to move laterally across enterprise networks and access sensitive data.
View CSAF Summary A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user's session by crafting a malicious URL. Successful exploitation may enable the attacker to read data or perform actions within the victim's Teamcenter session. Siemens has released new versions for the affected products and recommends to update to the latest versions.