VARIoT latest news about IoT security

Iranian Hackers Exploiting Microsoft, Fortinet Vulnerabilities: Feds Trust: 3.75 Fetched: Nov. 23, 2021, 9:28 a.m., Published: Nov. 17, 2021, 1:55 p.m.	Vulnerabilities: privilege escalation

Affected products

External IDs

vendor:	fortigate	model:	fortios
vendor:	filezilla	model:	server
vendor:	filezilla	model:	filezilla

New vulnerabilities found in Intel processors - Aroged Related entries in the VARIoT vulnerabilities database: VAR-202111-1151, VAR-202111-1193 Trust: 4.25 Fetched: Nov. 23, 2021, 9:28 a.m., Published: Nov. 16, 2021, 11:13 p.m.	Vulnerabilities: privilege escalation

Affected products

External IDs

db:

NVD

ids:

CVE-2021-0157, CVE-2021-0146, CVE-2021-0158

Hackers Exploit Vulnerability Targeting Routers and Modems Running Arcadyan Firmware \| Trend Micro News Related entries in the VARIoT vulnerabilities database: VAR-202104-0768 Trust: 4.75 Fetched: Nov. 23, 2021, 9:28 a.m., Published: Aug. 26, 2021, 4:47 p.m.	Vulnerabilities: path traversal

Affected products

External IDs

vendor:	trend micro	model:	home network security
vendor:	trend micro	model:	security
vendor:	trend micro	model:	micro home network security
vendor:	trend	model:	home network security
vendor:	trend	model:	security
vendor:	trend	model:	micro home network security

db:

NVD

ids:

CVE-2021-20090

Disclosing CVE-2021-40823 and CVE-2021-40824: E2EE vulnerability in multiple Matrix clients \| Matrix.org Trust: 3.0 Fetched: Nov. 23, 2021, 9:28 a.m., Published: Sept. 13, 2021, midnight	Vulnerabilities: -

Affected products

External IDs

db:

NVD

ids:

CVE-2021-40824, CVE-2021-40823

CVE-2021-40829 : Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1 Trust: 3.75 Fetched: Nov. 23, 2021, 9:28 a.m., Published: -	Vulnerabilities: -

Affected products

External IDs

vendor:

node.js

model:

node.js

db:

NVD

ids:

CVE-2009-1234, CVE-2021-40829

2021-10 Security Bulletin: Junos OS: Stored Cross-Site Scripting (XSS) vulnerability in captive portal (CVE-2021-31355) - Juniper Networks Related entries in the VARIoT vulnerabilities database: VAR-202110-0608 Trust: 4.25 Fetched: Nov. 23, 2021, 9:28 a.m., Published: Oct. 15, 2021, midnight	Vulnerabilities: cross-site scripting

Affected products

External IDs

db:

NVD

ids:

CVE-2021-31355

Philips discloses patient monitoring device, medical device interfacing vulnerabilities Trust: 3.5 Fetched: Nov. 23, 2021, 9:28 a.m., Published: Nov. 18, 2021, 3:50 p.m.	Vulnerabilities: denial of service, authentication bypass

Affected products

External IDs

vendor:

philips

model:

intellibridge ec40

OpenVPN Vulnerabilities in Industrial Remote Access Clients Related entries in the VARIoT vulnerabilities database: VAR-202108-1048 Trust: 4.25 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Nov. 18, 2021, 9:29 p.m.	Vulnerabilities: command execution, code execution, request forgery...

Affected products

External IDs

vendor:	wireshark	model:	wireshark
vendor:	serve	model:	serve

db:

NVD

ids:

CVE-2021-27406, CVE-2021-33527, CVE-2021-31338, CVE-2020-14498, CVE-2021-33526

Trend Micro Patches Critical Vulnerability in Server Protection Solution \| SecurityWeek.Com Trust: 5.75 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Jan. 15, 2022, midnight	Vulnerabilities: authentication bypass

Affected products

External IDs

vendor:	novell	model:	netware
vendor:	trend	model:	home network security
vendor:	trend	model:	security
vendor:	trend micro	model:	home network security
vendor:	trend micro	model:	security

db:

NVD

ids:

CVE-2021-36745

Tech Library \| Welcome Trust: 3.75 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Jan. 5, 2022, midnight	Vulnerabilities: -

Affected products

External IDs

vendor:	axis communications	model:	axis
vendor:	axis communications	model:	communications
vendor:	axis communications	model:	communications ab
vendor:	ipswitch	model:	whatsup
vendor:	cisco	model:	linksys
vendor:	cisco	model:	unity
vendor:	cisco	model:	telepresence
vendor:	cisco	model:	catalyst
vendor:	cisco	model:	cisco systems
vendor:	cisco	model:	umbrella
vendor:	cisco	model:	webex
vendor:	cisco	model:	nexus
vendor:	canary	model:	canary
vendor:	canary	model:	flex
vendor:	couchbase	model:	server
vendor:	francisco	model:	gallery
vendor:	citrix	model:	netscaler
vendor:	citrix	model:	gateway
vendor:	lexmark	model:	w
vendor:	lexmark	model:	lexmark
vendor:	palo	model:	palo alto networks
vendor:	palo	model:	networks
vendor:	motorola	model:	motorola
vendor:	nokia	model:	nokia
vendor:	nokia	model:	impact
vendor:	ringcentral	model:	ringcentral
vendor:	sun microsystems	model:	convergence
vendor:	sun microsystems	model:	linux
vendor:	sophos	model:	mobile
vendor:	zoom	model:	zoom
vendor:	dell	model:	unisphere
vendor:	lacie	model:	fuel
vendor:	nozomi	model:	guardian
vendor:	rpath	model:	linux
vendor:	toshiba	model:	home gateway
vendor:	tableau software	model:	server
vendor:	axis	model:	axis
vendor:	axis	model:	communications
vendor:	axis	model:	communications ab
vendor:	parallels	model:	tools
vendor:	sonicwall	model:	switch
vendor:	lg electronics	model:	mobile
vendor:	lg electronics	model:	network storage
vendor:	2wire	model:	gateway
vendor:	winston	model:	winston
vendor:	essential	model:	phone
vendor:	sagem	model:	sagem
vendor:	teradata	model:	express
vendor:	teradata	model:	gateway
vendor:	trend	model:	micro trend micro
vendor:	trend	model:	security
vendor:	hewlett-packard	model:	comware
vendor:	hewlett-packard	model:	arcsight
vendor:	hewlett-packard	model:	stream
vendor:	hewlett-packard	model:	integrity
vendor:	palo alto networks	model:	palo alto networks
vendor:	palo alto networks	model:	networks
vendor:	pronto	model:	pronto
vendor:	emc corporation	model:	unisphere
vendor:	check point software technologies	model:	express
vendor:	check point software technologies	model:	check point
vendor:	unbound	model:	unbound
vendor:	samsung	model:	mobile
vendor:	samsung	model:	samsung
vendor:	samsung	model:	galaxy
vendor:	apple	model:	safari
vendor:	raritan	model:	dominion
vendor:	lenovo	model:	flex
vendor:	lenovo	model:	system
vendor:	siemens	model:	nucleus
vendor:	broadcom	model:	messaging
vendor:	broadcom	model:	linux
vendor:	broadcom	model:	broadcom
vendor:	huawei technologies	model:	toronto
vendor:	huawei technologies	model:	nova
vendor:	huawei technologies	model:	atlas
vendor:	huawei technologies	model:	home gateway
vendor:	huawei technologies	model:	huawei
vendor:	huawei technologies	model:	nice
vendor:	huawei	model:	toronto
vendor:	huawei	model:	nova
vendor:	huawei	model:	atlas
vendor:	huawei	model:	home gateway
vendor:	huawei	model:	huawei
vendor:	huawei	model:	nice
vendor:	trend micro	model:	micro trend micro
vendor:	trend micro	model:	security
vendor:	citrix systems	model:	netscaler
vendor:	citrix systems	model:	gateway
vendor:	aastra	model:	limited
vendor:	siemens ag	model:	nucleus
vendor:	radware	model:	gateway
vendor:	ingres	model:	database
vendor:	check point	model:	express
vendor:	check point	model:	check point
vendor:	tippingpoint	model:	tippingpoint
vendor:	dell emc	model:	unisphere
vendor:	cisco systems	model:	linksys
vendor:	cisco systems	model:	unity
vendor:	cisco systems	model:	telepresence
vendor:	cisco systems	model:	catalyst
vendor:	cisco systems	model:	cisco systems
vendor:	cisco systems	model:	umbrella
vendor:	cisco systems	model:	webex
vendor:	cisco systems	model:	nexus
vendor:	silver peak	model:	silver peak
vendor:	blackberry	model:	storm
vendor:	blackberry	model:	blackberry
vendor:	blackberry	model:	link
vendor:	tableau	model:	server
vendor:	checkpoint	model:	express
vendor:	checkpoint	model:	check point
vendor:	google	model:	home
vendor:	google	model:	nexus
vendor:	plum	model:	compass

CVE-2021-3059 PAN-OS: OS Command Injection Vulnerability When Performing Dynamic Updates Trust: 4.5 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Nov. 10, 2021, 5 p.m.	Vulnerabilities: os command injection, command injection

Affected products

External IDs

vendor:	palo	model:	firewall
vendor:	palo	model:	palo alto networks
vendor:	palo	model:	pan-os
vendor:	palo	model:	networks
vendor:	paloaltonetworks	model:	firewall
vendor:	paloaltonetworks	model:	palo alto networks
vendor:	paloaltonetworks	model:	pan-os
vendor:	paloaltonetworks	model:	networks
vendor:	palo alto networks	model:	firewall
vendor:	palo alto networks	model:	palo alto networks
vendor:	palo alto networks	model:	pan-os
vendor:	palo alto networks	model:	networks

db:

NVD

ids:

CVE-2021-3059

Claroty Team82, JFrog Research BusyBox Vulnerabilities Trust: 3.5 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Nov. 9, 2021, 2 p.m.	Vulnerabilities: denial of service, information leak, code execution...

Affected products

External IDs

db:

NVD

ids:

CVE-2021-42386, CVE-2021-42376, CVE-2021-42373, CVE-2021-42374, CVE-2021-42377, CVE-2021-42375, CVE-2021-42378

Braktooth Bluetooth Bugs Bite: Exploit Code, Poc Released: SoylentNews Submission Trust: 3.5 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Nov. 6, 2021, 8:47 a.m.	Vulnerabilities: denial of service, code execution

Affected products

External IDs

vendor:

samsung

model:

samsung

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities \| CISA Related entries in the VARIoT vulnerabilities database: VAR-201906-0815, VAR-202008-0193, VAR-202007-0079 Trust: 4.5 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Nov. 19, 2021, midnight	Vulnerabilities: privilege escalation

Affected products

External IDs

vendor:	fortigate	model:	fortios
vendor:	filezilla	model:	server
vendor:	filezilla	model:	filezilla

db:

NVD

ids:

CVE-2018-13379, CVE-2019-5591, CVE-2021-34473, CVE-2020-12812

Microsoft: Shrootless bug lets hackers install macOS rootkits Related entries in the VARIoT vulnerabilities database: VAR-202108-2056 Trust: 3.75 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Oct. 28, 2021, midnight	Vulnerabilities: -

Affected products

External IDs

vendor:	apple	model:	macos
vendor:	netgear	model:	router
vendor:	netgear	model:	netgear router

db:	NVD	ids:	CVE-2021-30892
db:	POSIVITIVE TECHNOLOGY	ids:	ID:10

10 fatal mistakes in embedded systems security - Embedded.com Trust: 3.75 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Oct. 26, 2021, 1:03 p.m.	Vulnerabilities: denial of service

Affected products

External IDs

db:

NVD

ids:

CVE-2021-21284

Zero Day Initiative - The November 2021 Security Update Review Related entries in the VARIoT vulnerabilities database: VAR-202111-0789, VAR-202111-0473, VAR-202111-0697, VAR-202111-0660 Trust: 3.5 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Nov. 9, 2021, midnight	Vulnerabilities: security feature bypass, cross-site scripting, cross-site request forgery...

Affected products

External IDs

db:

NVD

ids:

CVE-2021-42283, CVE-2021-41378, CVE-2021-42300, CVE-2021-41376, CVE-2021-41367, CVE-2021-41379, CVE-2021-42285, CVE-2021-41374, CVE-2021-42323, CVE-2021-41368, CVE-2021-42277, CVE-2021-41373, CVE-2021-42287, CVE-2021-42278, CVE-2021-42291, CVE-2021-42301, CVE-2021-26443, CVE-2021-42319, CVE-2021-42292, CVE-2021-26444, CVE-2021-42274, CVE-2021-41370, CVE-2021-42275, CVE-2021-43208, CVE-2021-43209, CVE-2021-42316, CVE-2021-41366, CVE-2021-42286, CVE-2021-42282, CVE-2021-42296, CVE-2021-41349, CVE-2021-41377, CVE-2021-42304, CVE-2021-42322, CVE-2021-42276, CVE-2021-42288, CVE-2021-41351, CVE-2021-42279, CVE-2021-42305, CVE-2021-42321, CVE-2021-42302, CVE-2021-42298, CVE-2021-38665, CVE-2021-41375, CVE-2021-40442, CVE-2021-41372, CVE-2021-42303, CVE-2021-38666, CVE-2021-3711, CVE-2021-41356, CVE-2021-42284, CVE-2021-41371, CVE-2021-42280, CVE-2021-36957, CVE-2021-38631

Google discovers ‘watering hole’ hacking campaign that used zero-day macOS flaw - SiliconANGLE Related entries in the VARIoT vulnerabilities database: VAR-202108-1374 Trust: 5.75 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Nov. 12, 2021, 6:28 p.m.	Vulnerabilities: privilege escalation

Affected products

External IDs

vendor:	apple	model:	webkit
vendor:	apple	model:	macos
vendor:	apple	model:	safari

db:

NVD

ids:

CVE-2021-30869

Non-root Containers And Devices \| Kubernetes Trust: 3.75 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Nov. 9, 2021, midnight	Vulnerabilities: -

Affected products

External IDs

vendor:

dpdk

model:

dpdk

db:

NVD

ids:

CVE-2019-5736, cve-2019-5736

NIST Special Publication 800-63B Trust: 3.5 Fetched: Nov. 22, 2021, 8:12 a.m., Published: Jan. 15, 2022, 1:20 p.m.	Vulnerabilities: cross-site request forgery, request forgery, cross-site scripting...

Affected products

External IDs

vendor:

essential

model:

phone

VARIoT news about IoT security