@[email protected] on mastodon

@[email protected]

[Pentagrid AG @pentagridsec]

Multiple vulnerabilities in Lantronix EDS-MD IoT gateway for medical devices: https://t.co/anoPWCyjNz #itsecurity #infosec #pentesting #lantronix #iot #medical

[Pentagrid AG @pentagridsec]

♫ Ground control to Major Tom, take the patch and put secure mode on. ♫ https://t.co/0XIY5yudxf #openstage #openscape #unify

[Pentagrid AG @pentagridsec]

RCE and LPE in a wide range of Mitel Unify #OpenStage and #OpenScape VoIP phones with default config: https://t.co/W4AkdPaX7u #itsecurity #infosec #pentesting #voip #unify

[Pentagrid AG @pentagridsec]

A few email-related Python libraries do not check server certificates. It is nothing new, but a bit surprisingly in 2023 and not everyone got the memo. https://t.co/MUpVKknaTl #itsecurity #infosec #pentesting #python #email #bugbounty

[Pentagrid AG @pentagridsec]

The #Liferay Portal software < 7.4.3.88 respectively < 7.4.3.92 is affected by persistent cross-site-scripting vulnerabilities. https://t.co/bEiCselrh7 #itsecurity #infosec #pentesting

[@[email protected] on mastodon @floyd_ch]

@Abraxus7331 There's also https://t.co/c4WQ266mOO and https://t.co/oCGxGtHlrC

[@[email protected] on mastodon @floyd_ch]

@Abraxus7331 don't know if you saw it, but as we mentioned your research specifically, I thought I'll give you a quick heads up: https://t.co/5y5JsZuT6a

[Pentagrid AG @pentagridsec]

We analysed the security of a #WindRiver #VxWorks (the operating system running also on NASA's Curiosity mars rover) embedded device and found a critical vulnerability in the #tarExtract function: https://t.co/EDXpoNUtMn #itsecurity #infosec #pentesting #cisa #vxworks

[Pentagrid AG @pentagridsec]

We wrote a tool in Python to create file archives such as zip, tar and cpio that include path traversal attacks: https://t.co/SjLoCzdjoB #itsecurity #infosec #pentesting

[@[email protected] on mastodon @floyd_ch]

@dhn_ @nitram2342 @frycos @pentagridsec @Dinosn @SEPPmail so, wouldn't it be time to release some info? I really like to learn what we missed. Feel free to DM.

[Pentagrid AG @pentagridsec]

We analysed the security of a #WindRiver #VxWorks (the operating system running also on NASA's Curiosity mars rover) embedded device and found a critical vulnerability in the #tarExtract function: https://t.co/EDXpoNUtMn #itsecurity #infosec #pentesting #cisa #vxworks

[Pentagrid AG @pentagridsec]

Wir haben uns das Liechtensteiner #Gesundheitsdossier und die zugrunde liegende Portal-Software #Liferay angeschaut. Im Ergebnis haben wir Verwundbarkeiten in Liferay gefunden und Schwächen im IT-Setup: https://t.co/FkJ3XFuSvZ #itsicherheit #informationssicherheit #eHealth #eGD

[Pentagrid AG @pentagridsec]

We had a look at Liechtenstein's electronic health files and the underlying #Liferay portal software and found some weaknesses in the portal software as well as risks in the IT setup. Full article (in German only): https://t.co/FkJ3XFuSvZ #itsecurity #infosec #eHealth #eGD

[Pentagrid AG @pentagridsec]

For some #Icinga #monitoring, we wrote a small plugin in Python that sends mail via SMTP and checks on another mail server via IMAP if the mail was received. Here is the code: https://t.co/gcgAxYJLVI

[@[email protected] on mastodon @floyd_ch]

@rootxharsh so about that VMWare Aria CVE-2023-34039... let me guess, the appliance simply had always the same SSH key that came out of the box?

[Pentagrid AG @pentagridsec]

Our advisory for Busybox cpio. When extracting cpio archives with BusyBox cpio, the cpio archiving tools may write files outside the destination directory and there is no option to prevent this.

Full advisory: https://t.co/X8quvoJE7C

#itsecurity #infosec #pentesting #Busybox

[@[email protected] on mastodon @floyd_ch]

As they are not responding to emails, we are looking for security contacts at Atos/Unify for #coordinatedDisclosure #responsibledisclosure purposes. Please help finding someone, the 2 week initial response deadline is ticking fast... #vulnerability

[@[email protected] on mastodon @floyd_ch]

@Cocoatech hey cocoatech, I'd like to send a security issue in path finder towards you, unfortunately there is no https://t.co/v0BLDvXfGJ could you please tell me where to send it to?

[Pentagrid AG @pentagridsec]

Our advisory for @ATENconnect's Power Distribution Unit PE8108 is public now. We found multiple vulnerabilities regarding authn and authz. Aten failed to provide a FW update within a 90 days after initial contact.
https://t.co/Kz5BV4HAA2
#itsecurity #infosec #pentesting

[@[email protected] on mastodon @floyd_ch]

@ant0inet @adfichter @MarcelWaldvogel Das ist ok, das kann man schwierig finden wenn man möchte. Man kann auch schwierig finden jeden Shop mit PCI DSS zu regulieren aber als Herausgeber das nicht gebacken zu kriegen. Wir reden hier ja nicht von einem Kühlschrankhersteller der das erste mal lernt was ein Pentest ist.

[@[email protected] on mastodon @floyd_ch]

@ant0inet @MarcelWaldvogel @adfichter Vielleicht liest du den Artikel nochmal? Diese Aussagen die du behauptest sehe ich nicht im Artikel.