CVE-2017-6772: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to view sensitive information. The vulnerability is due to insufficient protection of sensitive data. An attacker could exploit this vulnerability by authenticating to the application and...

CVE-2017-6777: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the ConfD server of the Cisco Elastic Services Controller ESC could allow an authenticated, remote attacker to acquire sensitive system information. The vulnerability is due to insufficient protection of sensitive files on the system. An attacker could exploit this vulnerabilit...

Code injection

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...

CVE-2017-6709

A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller ESC and Cisco OpenStack deployments in an affected system. The vulnerability exists because the...

CVE-2017-6709

The CVE-2017-6709 case concerns Cisco’s Ultra Services Framework AutoVNF, where the AutoVNF tool logs administrative credentials in plaintext. This creates a risk that an unauthenticated, remote attacker could read credentials from the log files stored at the AutoVNF URL, enabling access to Cisco...

CVE-2017-6713

CVE-2017-6713 affects Cisco Elastic Services Controller (ESC) where the Play Framework UI uses static, default credentials shared across installations. The root cause is these credentials enabling an unauthenticated attacker to generate an admin session token and gain full web UI access. Affected...

esc-obog.org XSS vulnerability

Vulnerable URL: http://www.esc-obog.org/bulletin/post.asp?depth=2=1"...

gaswcc.org XSS vulnerability

Vulnerable URL: http://www.gaswcc.org/esc-courses.php?courselevel=1/-///'/"//--...

Cisco Elastic Services Controller Arbitrary Command Execution Vulnerability

Cisco Elastic Services Controller is a cloud and systems management solution. A security vulnerability in the esclistener.py script in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to run arbitrary commands as the tomcat user on an affected system...

CVE-2017-6683

A vulnerability in the esclistener.py script of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to execute arbitrary commands as the tomcat user on an affected system, aka an Authentication Request Processing Arbitrary Command Execution Vulnerability. More...

Command injection

A vulnerability in the esclistener.py script of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to execute arbitrary commands as the tomcat user on an affected system, aka an Authentication Request Processing Arbitrary Command Execution Vulnerability. More...

CVE-2017-6683

CVE-2017-6683 affects Cisco Elastic Services Controller, specifically the esc_listener.py script. An authenticated, remote attacker could execute arbitrary commands as the tomcat user due to insufficient sanitization of arguments during authentication to the monitoring daemon (port 6000). Affecte...

PT-2017-2759

Name of the Vulnerable Software and Affected Versions Cisco Elastic Services Controllers version 2.29.76 Description A vulnerability in the esc listener.py script could allow an authenticated, remote attacker to execute arbitrary commands as the tomcat user on an affected system. The issue arises...

Apple macOS/iOS Kernel 10.12.3 (16D32) - 'bpf' Heap Overflow

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1125 The bpf ioctl BIOCSBLEN allows userspace to set the bpf buffer length: case BIOCSBLEN: / uint / if d-bdbif != 0 error = EINVAL; else uint size; bcopyaddr, &size, sizeof size; if size bpfmaxbufsize size = bpfmaxbufsize; else ...

esc-larochelle.fr XSS vulnerability

Vulnerable URL: http://www.esc-larochelle.fr/content/search?SearchText=%22%3E%3Cscript%3Ealert%27OPENBUGBOUNTY%27%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 24.11.2017 Latest check for patch:| 24.11.2017 18:54 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

IoT Insecurity: Top Connected Device Security Concerns

It’s a coin toss whether or not that Internet of Things device you depend on is secure. Those unacceptable 50/50 odds come from a survey by IOActive where technology professionals were asked about the security of connected devices from thermostats, security cameras to alarm systems. Those numbers...

The plant controller has a remote vulnerability and no patch-vulnerability warning-the black bar safety net

Power station use of an industrial control system has not patched the vulnerability, an attacker can remotely exploit it to gain network control. Remedy method? Turning off the function or replace the equipment. Power station use of an industrial control system has not patched the vulnerability, ...

Authentication flaw

Environmental Systems Corporation ESC 8832 Data Controller 3.02 and earlier mishandles sessions, which allows remote attackers to bypass authentication and make arbitrary configuration changes via unspecified vectors...

Design/Logic Flaw

Environmental Systems Corporation ESC 8832 Data Controller 3.02 and earlier allows remote attackers to bypass intended access restrictions and execute arbitrary functions via a modified parameter...

CVE-2016-4501

CVE-2016-4501 affects ESC 8832 Data Controller (v3.02 and earlier). Root cause: improper session handling enables authentication bypass, allowing remote attackers to perform arbitrary configuration changes. Public exploitation is evidenced by a Metasploit module; advisories (ICS-CERT ICSA-16-147-...