Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12512PUBLISHED: 2021-01-22Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513PUBLISHED: 2021-01-22Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
CVE-2020-12514PUBLISHED: 2021-01-22Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd
CVE-2020-12525PUBLISHED: 2021-01-22M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
CVE-2020-12511PUBLISHED: 2021-01-22Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.
User Rank: Strategist
8/14/2018 | 8:49:21 AM
I am currently working on a doctorate in computer science in the area of usable security. And, there ARE things that can be explored to keep users safer.
1. We can alter the visual format of security messages from one instance to the next. Security messages that morph (changing shape, color, wording) - get a user's attention. Messages that look the same and read the same put users into "autopilot". Something "different" causes them to stop and pay attention - even if only briefly. But, in that brief moment - getting their attention is critical to stopping them from making a careless mistake.
2. Security messages that make no sense to the typical end-user who is NOT a security freak or techie.
3. We rail about insecure passwords - so why aren't password managers part of every corporate security stack? Users would need minimal training and it would go far to stop the "Post-it note"- syndrome. People select the same password over and over because they can remember it. A password manager can generate a new and complex password of any length - and users don't have to remember it.
As a security researcher and analyst, I believe that the development community could stop sighing "weakest link" and do more to support the user and business community. Security awareness training has a shelf-life of approximately two weeks according to most research. Expensive, but it provides a false sense of security.
I suggest re-thinking how development teams and designers approach user security.
Make security usable - and users will use it.