@[email protected] on mastodon

Multiple vulnerabilities in Lantronix EDS-MD IoT gateway for medical devices: pentagrid.ch/en/blog/multip… #itsecurity #infosec #pentesting #lantronix #iot #medical

♫ Ground control to Major Tom, take the patch and put secure mode on. ♫ github.com/pentagridsec/o… #openstage #openscape #unify

RCE and LPE in a wide range of Mitel Unify #OpenStage and #OpenScape VoIP phones with default config: pentagrid.ch/en/blog/rce-an… #itsecurity #infosec #pentesting #voip #unify

A few email-related Python libraries do not check server certificates. It is nothing new, but a bit surprisingly in 2023 and not everyone got the memo. pentagrid.ch/en/blog/python… #itsecurity #infosec #pentesting #python #email #bugbounty

The #Liferay Portal software < 7.4.3.88 respectively < 7.4.3.92 is affected by persistent cross-site-scripting vulnerabilities. pentagrid.ch/en/blog/stored… #itsecurity #infosec #pentesting

@Abraxus7331 There's also pentagrid.ch/en/blog/archiv… and pentagrid.ch/en/blog/busybo…

@Abraxus7331 don't know if you saw it, but as we mentioned your research specifically, I thought I'll give you a quick heads up: x.com/pentagridsec/s…

We wrote a tool in Python to create file archives such as zip, tar and cpio that include path traversal attacks: pentagrid.ch/en/blog/archiv… #itsecurity #infosec #pentesting

@dhn_ @nitram2342 @frycos @pentagridsec @Dinosn @SEPPmail so, wouldn't it be time to release some info? I really like to learn what we missed. Feel free to DM.

@nitram2342 @frycos @pentagridsec @Dinosn @SEPPmail Afaik there is just the mention in the changelog but no public writeup/advisory.

We conducted a security analysis of the secure e-mail software @SEPPmail 11.1.10 and found multiple vulnerabilities that have been fixed (and hopefully widely applied) by now pentagrid.ch/en/blog/multip… #itsecurity #infosec #pentesting

We analysed the security of a #WindRiver #VxWorks (the operating system running also on NASA's Curiosity mars rover) embedded device and found a critical vulnerability in the #tarExtract function: pentagrid.ch/en/blog/wind-r… #itsecurity #infosec #pentesting #cisa #vxworks

Wir haben uns das Liechtensteiner #Gesundheitsdossier und die zugrunde liegende Portal-Software #Liferay angeschaut. Im Ergebnis haben wir Verwundbarkeiten in Liferay gefunden und Schwächen im IT-Setup: pentagrid.ch/de/blog/it-sic… #itsicherheit #informationssicherheit #eHealth #eGD

We had a look at Liechtenstein's electronic health files and the underlying #Liferay portal software and found some weaknesses in the portal software as well as risks in the IT setup. Full article (in German only): pentagrid.ch/de/blog/it-sic… #itsecurity #infosec #eHealth #eGD

For some #Icinga #monitoring, we wrote a small plugin in Python that sends mail via SMTP and checks on another mail server via IMAP if the mail was received. Here is the code: github.com/pentagridsec/i…

@rootxharsh so about that VMWare Aria CVE-2023-34039... let me guess, the appliance simply had always the same SSH key that came out of the box?

Our advisory for Busybox cpio. When extracting cpio archives with BusyBox cpio, the cpio archiving tools may write files outside the destination directory and there is no option to prevent this. Full advisory: pentagrid.ch/en/blog/busybo… #itsecurity #infosec #pentesting #Busybox

As they are not responding to emails, we are looking for security contacts at Atos/Unify for #coordinatedDisclosure #responsibledisclosure purposes. Please help finding someone, the 2 week initial response deadline is ticking fast... #vulnerability

@Cocoatech hey cocoatech, I'd like to send a security issue in path finder towards you, unfortunately there is no cocoatech.io/.well-known/se… could you please tell me where to send it to?

Is Path Finder Secure? Cocoatech follows strict security standards in coding Path Finder and continuously updates it to keep up with tech advancements. For any bugs or other concerns, join our discord group for immediate support. #finderalternatives #filemanagement

Our advisory for @ATENconnect's Power Distribution Unit PE8108 is public now. We found multiple vulnerabilities regarding authn and authz. Aten failed to provide a FW update within a 90 days after initial contact. pentagrid.ch/en/blog/multip… #itsecurity #infosec #pentesting

@ant0inet @adfichter @MarcelWaldvogel Das ist ok, das kann man schwierig finden wenn man möchte. Man kann auch schwierig finden jeden Shop mit PCI DSS zu regulieren aber als Herausgeber das nicht gebacken zu kriegen. Wir reden hier ja nicht von einem Kühlschrankhersteller der das erste mal lernt was ein Pentest ist.

@adfichter @floyd_ch @MarcelWaldvogel nein, ich finds einfach schwierig organisationen blosszustellen wenn sie die schwachstelle entgegennehmen und schnell fixen. aber andererseits: die reputation des finanzsektors ist jetzt gerade eh am arsch 🤷‍♂️

@ant0inet @MarcelWaldvogel @adfichter Vielleicht liest du den Artikel nochmal? Diese Aussagen die du behauptest sehe ich nicht im Artikel.

@MarcelWaldvogel @adfichter @floyd_ch und das ist das problem, nur entrüsten und keine anerkennung hilft nicht die schwachstellen zu fixen