energytrust.org Cross Site Scripting vulnerability OBB-2134122

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Cybersecurity in the Infrastructure Bill

On August 10, 2021, the U.S. Senate passed the Infrastructure Investment and Jobs Act of 2021 H.R.3684. The bill comes in at 2,700+ pages, provides for $1.2T in spending, and includes several cybersecurity items. We expect this legislation to become law around late September and do not expect...

DIAEnergie Cross-Site Request Forgery Vulnerability

DIAEnergie is an industrial energy management system from Delta Electronics. A cross-site request forgery vulnerability exists in DIAEnergie 1.7.5 and earlier versions. An attacker can exploit this vulnerability to perform unauthorized operations...

DIAEnergie Weak Hash Algorithm Vulnerability

DIAEnergie is an industrial energy management system from Delta Electronics. A weak hash algorithm vulnerability exists in DIAEnergie 1.7.5 and earlier versions. An attacker can exploit this vulnerability to retrieve plaintext passwords...

DIAEnergie File Upload Vulnerability

DIAEnergie, an industrial energy management system from Delta Electronics, is vulnerable to a file upload vulnerability in DIAEnergie 1.7.5 and earlier versions. An attacker could exploit this vulnerability to achieve remote code execution...

DIAEnergie Certification Bypass Vulnerability

DIAEnergie, an industrial energy management system from Delta Electronics, is vulnerable to an authentication bypass in DIAEnergie 1.7.5 and earlier. An attacker could use this vulnerability to add a new administrative user without authentication or authorization to be able to log in and use the...

Delta Electronics DIAEnergie 加密问题漏洞

DIAEnergie is an industrial energy management system from Delta Electronics. A weak hash algorithm vulnerability exists in DIAEnergie 1.7.5 and earlier versions. An attacker can exploit this vulnerability to retrieve plaintext passwords...

SQL Injection Vulnerability in Smart Meter Integrated Management System of Xintian Technology Corporation (CNVD-2021-70022)

Xintian Technology Co., Ltd. is a professional manufacturer and supplier of water meters, energy meters and gas meters. A SQL injection vulnerability exists in the Smart Meter Integrated Management System of Xintian Technology Corporation, which can be exploited by attackers to obtain sensitive...

Delta Electronics DIAEnergie SQL注入漏洞

A SQL blind injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint in DIAEnergie 1.7.5 and earlier versions. The vulnerability stems from the application not properly validating the value provided by the user via the parameter egyid before using the value as part of a...

SQL Injection Vulnerability in Smart Meter Integrated Management System of Xintian Technology Corporation (CNVD-2021-70043)

Xintian Technology Co., Ltd. is a professional manufacturer and supplier of water meters, energy meters and gas meters. A SQL injection vulnerability exists in the Smart Meter Integrated Management System of Xintian Technology Corporation, which can be exploited by attackers to obtain sensitive...

SQL Injection Vulnerability in Smart Gas System of New Day Technology Co.

Founded in 2000, Xintian Technology Co. It is a benchmark enterprise in China's electronic information industry. With the core competitiveness of "mastering core technology and continuous innovation", we continue to provide competitive products and intelligent solutions to realize energy saving,...

Cisco Energy Management Suite Default PostgreSQL Password Vulnerability

The version of Cisco Energy Management Suite installed on the remote host is prior to 5.2.3. It, therefore, potentially has a default password for the postgres account for the bundled PostgresSQL database. An unauthenticated, local attacker can exploit this to gain privileged or administrator...

Baker Hughes Bently Nevada 3500

1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Bently Nevada, a Baker Hughes subsidiary Equipment: 3500 Vulnerability: Use of Password Hash with Insufficient Computational Effort 2. REPOSTED INFORMATION This advisory was originally posted to the...

xArrow SCADA

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: xArrow Equipment: xArrow SCADA Vulnerabilities: Cross-site Scripting, Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in remote code execution...

SQL Injection Vulnerability in Smart Meter Integrated Management System of Xintian Technology Co.

Xintian Technology Co., Ltd. is a professional manufacturer and supplier of water meters, energy meters and gas meters. A SQL injection vulnerability exists in the Smart Meter Integrated Management System of Xintian Technology Corporation, which can be exploited by attackers to obtain sensitive...

Siemens Energy AGT and SGT Solutions

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SGT Vulnerability: Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could lead to remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2021-29736)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

Longjing Technology BEMS API 1.21 Remote Arbitrary File Download

Longjing Technology BEMS API 1.21 Remote Arbitrary File Download Vendor: Longjing Technology Product web page: http://www.ljkj2012.com Affected version: 1.21 Summary: Battery Energy Management System. Desc: The application suffers from an unauthenticated arbitrary file download vulnerability. Inp...

Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013

Summary This Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework, Version 9. See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques. Note: CISA released technical information, including indicators of compromise IOCs,...

KevinLAB BEMS 1.0 - Undocumented Backdoor Account

Exploit Title: KevinLAB BEMS 1.0 - Undocumented Backdoor Account Date: 05.07.2021 Exploit Author: LiquidWorm Vendor Homepage: http://www.kevinlab.com Vendor: KevinLAB Inc. Product web page: http://www.kevinlab.com Affected version: 4ST L-BEMS 1.0.0 Building Energy Management System Summary:...