Multiple Schneider Electric Modicon Product TCP Initial Serial Number Prediction Vulnerabilities

Schneider-Electric Modicon M251 and others are programmable controller products of Schneider Electric France. A security vulnerability exists in a number of Schneider Electric Modicon products, which arises from a program's failure to generate a sufficient number of random TCP initial serial...

Huawei AC6005/AC6605 Denial of Service Vulnerability

The AC6005 and AC6605 are both boxed wireless access controllers from Huawei, the AC6005 is a small boxed wireless access controller for small and medium-sized businesses, and the AC6605 is a boxed wireless access controller for large and medium-sized businesses. A denial of service vulnerability...

PT-2017-3707 · Schneider Electric · Modicon M340 +3

Name of the Vulnerable Software and Affected Versions: Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers affected versions not specified Description: The issue concerns a vulnerable hash algorithm used for password encryption in the communication...

Rockwell Automation Logix Controller Stack Buffer Overflow (CVE-2016-9343)

A stack buffer overflow vulnerability exists in Rockwell Automation Logix Controllers. The vulnerability is due to insufficient bounds checking. A successful exploitation could lead to arbitrary code execution...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

CVE-2016-9197

A vulnerability in the CLI command parser of the Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers could allow an authenticated, local attacker to obtain access to the underlying operating system shell with root-level privileges. More Information: CSCvb70351. Known Affected...

Design/Logic Flaw

A vulnerability in the CLI command parser of the Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers could allow an authenticated, local attacker to obtain access to the underlying operating system shell with root-level privileges. More Information: CSCvb70351. Known Affected...

CVE-2016-9197

CVE-2016-9197 affects Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers. The root cause is a vulnerability in the CLI command parser due to incorrect permissions assigned to configured users, enabling an authenticated, local attacker to obtain access to the underlying operating...

CVE-2016-9197

A vulnerability in the CLI command parser of the Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers could allow an authenticated, local attacker to obtain access to the underlying operating system shell with root-level privileges. More Information: CSCvb70351. Known Affected...

PT-2017-9993

Name of the Vulnerable Software and Affected Versions Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers version 8.3102.0 Description A vulnerability in the CLI command parser could allow an authenticated, local attacker to obtain access to the underlying operating system shell...

CVE-2016-9197: Undefined Security Weakness

A vulnerability in the CLI command parser of the Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers could allow an authenticated, local attacker to obtain access to the underlying operating system shell with root-level privileges. More Information: CSCvb70351. Known Affected...

Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers Shell Bypass Vulnerability

A vulnerability in the CLI command parser of the Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers could allow an authenticated, local attacker to obtain access to the underlying operating system shell with root-level privileges. Copyright C 2017 Greenbone Networks GmbH Some te...

Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers Shell Bypass Vulnerability

A vulnerability in the CLI command parser of the Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers could allow an authenticated, local attacker to obtain access to the underlying operating system shell with root-level privileges. The vulnerability is due to incorrect permission...

Rockwell Automation ControlLogix 5580 and CompactLogix 5380

CVSS v3 6.8 ATTENTION: Remotely exploitable. Vendor: Rockwell Automation Equipment: ControlLogix 5580 and CompactLogix 5380 Vulnerability: Resource Exhaustion REPOSTED INFORMATION This advisory was originally posted to the NCCIC Portal on April 4, 2017, and is being released to the NCCIC/ICS-CERT...

CVE-2017-7321

setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the configkey parameter to the setup/index.php?action=welcome URI...

PT-2017-17664

Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.5.4-pl and earlier Description The issue allows remote attackers to conduct attacks, potentially leading to a denial of service due to cookie quota exhaustion or HTTP Response Splitting attacks, which can result in...

CVE-2017-7320: Improper Neutralization of Input During Web Page Generation

setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...

CVE-2017-7321: Improper Control of Generation of Code

setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the configkey parameter to the setup/index.php?action=welcome URI...

This Ransomware Malware Could Poison Your Water Supply If Not Paid

Ransomware has been around for a few years, but in last two years, it has become an albatross around everyone's neck, targeting businesses, hospitals, financial institutions and personal computers worldwide and extorting millions of dollars. Ransomware is a type of malware that infects computers...

HP Smart Storage Administrator command injection

Added: 02/16/2017 CVE: CVE-2016-8523 BID: 95868 Background HP Smart Storage Administrator HP SSA is a web-based application that helps an administrator configure, manage, diagnose, and monitor HP ProLiant Smart Array Controllers and other storage devices such as host bus adapters HBAs and HP...