PT-2015-10: Privilege Gaining in Siemens SIMATIC STEP 7 (TIA Portal)

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in Siemens SIMATIC STEP 7 TIA Portal. Vulnerability exists in TIA Portal due to improper integrity protection of project-file fields containing user’s privileges, which allows attackers to modify user...

Google Warning Users About State-Sponsored Attacks

Google, whose users have been frequent targets of suspected attacks by foreign governments, is deploying a new warning system for users who may be victims of those kinds of attacks. The new system is in addition to existing warnings that Google will show Gmail users when their accounts may have...

Siemens SIMATIC STEP 7 DLL Vulnerability

Overview Siemens has released a software update for a DLL hijacking vulnerability in SIMATIC STEP 7 and SIMATIC PCS 7 software. Previous versions of SIMATIC STEP 7 and PCS 7 allowed the loading of malicious DLL files into the STEP 7 project folder that can be used to attack the system on which ST...

Security feature bypass

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

Fedora Update for step FEDORA-2011-13417

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

#Security Alert : Facebook Two-Factor Authentication fail !

Security Alert : Facebook Two-Factor Authentication fail ! Last year Facebook has launched a security feature called Login Approvals or two-factor authentication. This is a follow-up security update regarding Facebook Login from Facebook. They have already integrated Facebook login email alerts t...

Woven dream CMS system - visitors unlimited brush the top step on the value-vulnerability warning-the black bar safety net

Brief description: only tested DEDECMS V5. 7 system,the previous version of the estimates is the same. In the official address to be a simple test,should be regarded as a small BUG,using this you can infinite brush an article of the top/tread value. Detailed description: although the front page d...

CVE-2011-4693

Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file, as demonstrated by the first of two vulnerabilities exploited by the Intevydis vdadobefp module in VulnDisco Step Ahead SA. NOTE: as of...

Design/Logic Flaw

Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file, as demonstrated by the second of two vulnerabilities exploited by the Intevydis vdadobefp module in VulnDisco Step Ahead SA. NOTE: as of...

Input validation

Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file, as demonstrated by the first of two vulnerabilities exploited by the Intevydis vdadobefp module in VulnDisco Step Ahead SA. NOTE: as of...

CVE-2011-4694

Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file, as demonstrated by the second of two vulnerabilities exploited by the Intevydis vdadobefp module in VulnDisco Step Ahead SA. NOTE: as of...

CVE-2011-4693

Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file, as demonstrated by the first of two vulnerabilities exploited by the Intevydis vdadobefp module in VulnDisco Step Ahead SA. NOTE: as of...

Dillon Beresford Talked Siemens Vulnerabilities

NSS researcher Dillon Beresford continued his research into the security of SCADA and industrial control systems with a talk on vulnerabilities in Siemens Step 7 programmable logic controllers. Read more: Black Hat: Remote DOS, Backdoor, Easter Egg Among Newly Discovered Siemens Holes...

Xitami Web Server 2.5b4 Remote Buffer Overflow

!/usr/bin/perl ------------------------------------------------------------- Xitami Web Server 2.5b4 - Remote Buffer Overflow Exploit. Exploit coded by mr.pr0n http://s3cure.gr . Many greetz to krumel for his help :-. -------------------------------------------------------------...

[SECURITY] Fedora 14 Update: kdeedu-4.6.2-1.fc14

Educational/Edutainment applications: blinken: Simon Says Game kalzium: A periodic table of the elements kanagram: Anagram game kgeography: Learn geography khangman: Hangman Game kiten: Japanese Reference/Study Tool klettres: French alphabet tutor ktouch: Learn and practice touch typing kturtle:...

[SECURITY] Fedora 15 Update: kdeedu-4.6.2-1.fc15

Educational/Edutainment applications: blinken: Simon Says Game kalzium: A periodic table of the elements kanagram: Anagram game kgeography: Learn geography khangman: Hangman Game kiten: Japanese Reference/Study Tool klettres: French alphabet tutor ktouch: Learn and practice touch typing kturtle:...

2-step verification, Advanced sign-in security for your Google account !

Has anyone you know ever lost control of an email account and inadvertently sent spam—or worse—to their friends and family? There are plenty of examples like the classic "Mugged in London" scam that demonstrate why it's important to take steps to help secure your activities online. Your Gmail...

Google Adds Two-Factor Verification to Gmail

Google has introduced a new two-step authentication feature for Gmail users that it says will significantly increase the security of the free mail service. The system enables users to set up a method for obtaining a secret code that will be required, along with a password, to access a Gmail...

VB Installation - Add NEW Administrator user

Exploit for php platform in category web applications ============================================= VB Installation - Add NEW Administrator user ============================================= Title: VB Installation- Add NEW Administrator user Date: 2010-10-06 Author: King of Larestan Version:...

CS Cart 1.3.3 Cross Site Scripting

Exploit Title: CS CART 1.3.3 INSTALL.PHP XSS Date: 2010-09-08 Author: LogicGate Software Link: http://cs-cart.smartcode.com/ Version: 1.3.3 Tested on: N/A CVE : N/A If "install.php" was not removed after installation simply make an html file with the following code and replace by the PATH to...