Category Archives: Advisories

[SYSS-2024-041] DiCal-RED – Use of Unmaintained Third Party Components

Read Time:18 Second

Posted by Sebastian Hamann via Fulldisclosure on Aug 22

Advisory ID: SYSS-2024-041
Product: DiCal-RED
Manufacturer: Swissphone Wireless AG
Affected Version(s): Unknown
Tested Version(s): 4009
Vulnerability Type: Use of Unmaintained Third Party Components (CWE-1104)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2024-04-16
Solution Date: None
Public Disclosure: 2024-08-20…

Read More

[SYSS-2024-040] DiCal-RED – Improper Authentication

Read Time:17 Second

Posted by Sebastian Hamann via Fulldisclosure on Aug 22

Advisory ID: SYSS-2024-040
Product: DiCal-RED
Manufacturer: Swissphone Wireless AG
Affected Version(s): Unknown
Tested Version(s): 4009
Vulnerability Type: Improper Authentication (CWE-287)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2024-04-16
Solution Date: None
Public Disclosure: 2024-08-20
CVE Reference:…

Read More

[SYSS-2024-039] DiCal-RED – Path Traversal

Read Time:17 Second

Posted by Sebastian Hamann via Fulldisclosure on Aug 22

Advisory ID: SYSS-2024-039
Product: DiCal-RED
Manufacturer: Swissphone Wireless AG
Affected Version(s): Unknown
Tested Version(s): 4009
Vulnerability Type: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) (CWE-22)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2024-04-16
Solution Date:…

Read More

[SYSS-2024-038] DiCal-RED – Use of Password Hash Instead of Password for Authentication

Read Time:18 Second

Posted by Sebastian Hamann via Fulldisclosure on Aug 22

Advisory ID: SYSS-2024-038
Product: DiCal-RED
Manufacturer: Swissphone Wireless AG
Affected Version(s): Unknown
Tested Version(s): 4009
Vulnerability Type: Use of Password Hash Instead of Password for Authentication (CWE-836)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2024-04-16
Solution Date: None
Public Disclosure:…

Read More

[SYSS-2024-037] DiCal-RED – Use of Password Hash With Insufficient Computational Effort

Read Time:17 Second

Posted by Sebastian Hamann via Fulldisclosure on Aug 22

Advisory ID: SYSS-2024-037
Product: DiCal-RED
Manufacturer: Swissphone Wireless AG
Affected Version(s): Unknown
Tested Version(s): 4009
Vulnerability Type: Use of Password Hash With Insufficient Computational Effort (CWE-916)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2024-04-16
Solution Date: None
Public Disclosure:…

Read More

[SYSS-2024-035] DiCal-RED – Missing Authentication for Critical Function

Read Time:17 Second

Posted by Sebastian Hamann via Fulldisclosure on Aug 22

Advisory ID: SYSS-2024-035
Product: DiCal-RED
Manufacturer: Swissphone Wireless AG
Affected Version(s): Unknown
Tested Version(s): 4009
Vulnerability Type: Missing Authentication for Critical Function (CWE-306)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2024-04-16
Solution Date: None
Public Disclosure: 2024-08-20…

Read More

[SYSS-2024-036] DiCal-RED – Missing Authentication for Critical Function

Read Time:17 Second

Posted by Sebastian Hamann via Fulldisclosure on Aug 22

Advisory ID: SYSS-2024-036
Product: DiCal-RED
Manufacturer: Swissphone Wireless AG
Affected Version(s): Unknown
Tested Version(s): 4009
Vulnerability Type: Missing Authentication for Critical Function (CWE-306)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2024-04-16
Solution Date: None
Public Disclosure: 2024-08-20…

Read More

Re: Improper Authentication (CWE-287) CVE-2024-33897

Read Time:20 Second

Posted by Jeffrey Walton on Aug 22

I believe the problem lies elsewhere. The root cause is an
architectural or design problem.

Ewon Cosy+ should probably be using a protocol like Simple Certificate
Enrollment Protocol (SCEP) or Enrollment over Secure Transport (EST),
and not rolling their own scheme. Also see discussions like
<https://mailarchive.ietf.org/arch/msg/pkix/X94XpFJA5sKKkLTVkOYXL_dv8t4/>
and <>.

Jeff

Read More

` Piano `

Read Time:13 Second

Posted by Teri Olson on Aug 22

Hello,

I’m giving out my late husband’s Yamaha Baby Grand Piano for free to any passionate instrument lover. kindly let me
know if you want it or have someone else who wants it.

Thanks,
Teri

Read More

USN-6980-1: ImageMagick vulnerabilities

Read Time:15 Second

It was discovered that ImageMagick incorrectly handled certain malformed
image files. If a user or automated system using ImageMagick were tricked
into opening a specially crafted image, an attacker could exploit this to
cause a denial of service or possibly execute code with the privileges of
the user invoking the program.

Read More