The vulnerability of microprogrammed logic controllers from Schneider Electric Modicon, related to insufficient protection of the web page structure, allows attackers to inject JavaScript that will be executed in the user’s browser.

The vulnerability of the microprogrammed logic controllers from Schneider Electric Modicon relates to insufficient protection of the web page structure. Exploiting this vulnerability allows an intruder to inject JavaScript, which will be executed in the user’s browser...

The vulnerability of the microprogrammed software of Schneider Electric Modicon programmable logic controllers, related to the lack of necessary checks during password changes, allows unauthorized access to the password-changing function of the web server.

The vulnerability of the microprogrammed logic controllers from Schneider Electric Modicon lies in the lack of necessary checks during password changes. Exploiting this vulnerability could allow unauthorized individuals to gain access to the password-changing function of the web server...

The vulnerability of the TeNIX operating system for programmable logic controllers MFC1500 and MFC3000 allows a hacker to gain full access to the system.

The vulnerability of the TeNIX operating system for programmable logic controllers MFC1500 and MFC3000 is related to the use of a default weak password for the root account, information about which is not available in the documentation. Exploiting this vulnerability could allow an attacker,...

The vulnerability of the pnp-receive.sh service in the TeNIX operating system for programmable logic controllers MFC1500 and MFC3000 allows a hacker to write arbitrary data onto the device and exhaust the available disk space.

The vulnerability of the pnp-receive.sh service on the TeNIX programmable logic controllers MFC1500 and MFC3000 operating system is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to exhaust the device’s disk space by sending arbitrary...

The vulnerability of the Taserver web service on the TeNIX operating system for programmable logic controllers MFC1500 and MFC3000 allows a perpetrator to execute arbitrary code.

The vulnerability of the TAserver web service for the TeNIX programmable logic controllers MFC1500 and MFC3000 lies in the lack of name filtering when generating a 404 HTTP error page. As a result, the name of the non-existent web page is passed unchanged to the generated error page. Exploiting...

Remote Code Execution (RCE)

samba4 is vulnerable to remote code execution RCE attacks. The vulnerability exists through a heap-based buffer overflow in the dcerpcreadncacnpacketdone function in librpc/rpc/dcerpcutil.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain...

PT-2019-6168

Name of the Vulnerable Software and Affected Versions ThinkPHP versions prior to 3.2.4 Open Source BMS version 1.1.1 zzzcms zzzphp Description A flaw exists in ThinkPHP related to improper handling of code generation when using backslashes '' as delimiters in the controller name. This can allow a...

Wifi-soft's Unibox Controllers Remote Code Injection Vulnerability

Wifi-soft's Unibox Controllers are fast-paced network controllers for all large and small venues. A remote code injection vulnerability exists in Wifi-soft's Unibox Controllers. An attacker can exploit the vulnerability to inject arbitrary code...

Wifi-soft's Unibox Controllers Remote Command Injection Vulnerability (CNVD-2019-00770)

Wifi-soft's Unibox Controllers are fast-paced network controllers for all large and small venues. A remote code injection vulnerability exists in Wifi-soft's Unibox Controllers. An attacker can exploit the vulnerability to inject arbitrary code...

Wifi-soft's Unibox Controllers Remote Command Injection Vulnerability (CNVD-2019-00771)

Wifi-soft's Unibox Controllers are fast-paced network controllers for all large and small venues. A remote code injection vulnerability exists in Wifi-soft's Unibox Controllers. An attacker can exploit the vulnerability to inject arbitrary code...

The vulnerability of Modicon microprogrammed control devices, related to insufficient verification of input data, allows attackers to redirect users to malicious websites.

The vulnerability of Modicon controller microprogramming software is related to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to redirect users to a malicious website remotely...

Protection Mechanism Failure Vulnerability in Multiple Siemens Products (CNVD-2018-25417)

Siemens SINUMERIK 808D and so on are the German Siemens Siemens company's CNC machine tool system controller. A security vulnerability exists in the Siemens SINUMERIK CNC Controller. A local attacker can exploit this vulnerability by modifying the CRAMFS archive file to cause the system to load t...

CVE-2018-11466

A vulnerability has been identified in SINUMERIK 808D V4.7 All versions, SINUMERIK 808D V4.8 All versions, SINUMERIK 828D V4.7 All versions V4.7 SP6 HF1, SINUMERIK 840D sl V4.7 All versions V4.7 SP6 HF5, SINUMERIK 840D sl V4.8 All versions V4.8 SP3. Specially crafted network packets sent to port...

Rockwell Automation MicroLogix Detection Consolidation

Consolidation of Rockwell Automation MicroLogix detections. This VT has been deprecated and replaced by the VT SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

ICSA-18-345-02 Siemens SINUMERIK Controllers (Update A)

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SINUMERIK Controllers Vulnerabilities: Heap-based Buffer Overflow, Integer Overflow or Wraparound, Protection Mechanism Failure, Permissions, Privileges, and Access Controls,...

WAGO PLC Detection (HTTP)

HTTP based detection of WAGO PLC Controllers. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

WAGO PLC Detection (EtherNet/IP)

This script performs EtherNet/IP based detection of WAGO PLC Controllers. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

DEBIAN-CVE-2018-16857

Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords to restrict brute forcing of passwords in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been...

[SECURITY] Fedora 29 Update: mosquitto-1.5.3-1.fc29

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware

Cybersecurity firm FireEye claims to have discovered evidence that proves the involvement of a Russian-owned research institute in the development of the TRITON malware that caused some industrial systems to unexpectedly shut down last year, including a petrochemical plant in Saudi Arabia. TRITON...