CVE-2017-1345

The CVE-2017-1345 entry concerns IBM Insights Foundation for Energy 2.0, where a cross-site scripting vulnerability exists in the Web UI. The incident allows an attacker to inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to credentials disclosure within...

CVE-2017-1311

IBM Insights Foundation for Energy 2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 125719...

CVE-2017-1345

IBM Insights Foundation for Energy 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 126460...

PT-2017-12917

Name of the Vulnerable Software and Affected Versions IBM Insights Foundation for Energy version 2.0 Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end database...

PT-2017-12980

Name of the Vulnerable Software and Affected Versions IBM Insights Foundation for Energy version 2.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

Iranian APT33 Targets U.S. Firms with Destructive Malware

The Iranian group known as APT33 is believed to be behind a cyberespionage campaign targeting aerospace, petrochemical and energy sector firms located in the United States, Saudi Arabia and South Korea. The group’s latest attack leverages a dropper called DropShot that is tied to the StoneDrill...

rebelenergy.ca XSS vulnerability

Vulnerable URL:...

Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware

When discussing suspected Middle Eastern hacker groups with destructive capabilities, many automatically think of the suspected Iranian group that previously used SHAMOON – aka Disttrack – to target organizations in the Persian Gulf. However, over the past few years, we have been tracking a...

Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware

When discussing suspected Middle Eastern hacker groups with destructive capabilities, many automatically think of the suspected Iranian group that previously used SHAMOON – aka Disttrack – to target organizations in the Persian Gulf. However, over the past few years, we have been tracking a...

new-energy-bracelet.com XSS vulnerability

Open Bug Bounty ID: OBB-299208 Description| Value ---|--- Affected Website:| new-energy-bracelet.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

The vulnerability of the Low Energy Audio Protocol (LEAP) operating system on iOS allows a hacker to execute arbitrary code.

The vulnerability of the Low Energy Audio Protocol LEAP in the iOS operating system exists due to the lack of proper checks on commands sent using LEAP. Exploiting this vulnerability allows a malicious actor to remotely exploit buffer overflows and gain full control over the device...

Unauthorized Access Vulnerability in the Android Version of Xinlian Energy Cloud APP

Xinlian Electricity Cloud App is an electric energy application that allows you to view the overall electricity consumption information and the information of each electricity sub-circuit online. Xinlian Electricity Cloud APP Android version has an unauthorized access vulnerability, which allows...

Apple Bluetooth LEAP and Apple TV Heap Buffer Overflow Vulnerability

Low-Energy Audio Protocol LEAP, a protocol designed to transmit audio streams to low-energy audio peripherals such as low-energy headphones or Siri Remote, Apple TV is a high-definition television set-top box product from Apple, which allows users to watch television programs online via Apple TV ...

CVE-2017-14315

In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP Low Energy Audio Protocol, a large audio command can be sent to a targeted device and lead to a heap overflow with attacker-controlled data. Since the audio commands sent via LEAP are not properly validated, an attack...

PT-2017-2792

Name of the Vulnerable Software and Affected Versions Apple iOS versions 7 through 9 Description The issue is related to a flaw in the implementation of the Low Energy Audio Protocol LEAP in Apple iOS, which can lead to a heap overflow with attacker-controlled data when a large audio command is...

Dragonfly 2.0: Hacking Group Infiltrated European and US Power Facilities

The notorious hacking group that has been in operation since at least 2011 has re-emerged and is still interested in targeting the United States and European companies in the energy sector. Yes, I am talking about the 'Dragonfly,' a well-resourced, Eastern European hacking group responsible for...

Attacking Critical Infrastructure: The Evolution Of Kinetic Warfare

I said earlier in 2017 I believed it was quite possible that during the year a major cyberattack will occur in either the United States, the United Kingdom, or another friendly country that will require a response equivalent to a kinetic attack. In other words, a cyberattack will occur that will ...

store.energysistem.com XSS vulnerability

Vulnerable URL: https://store.energysistem.com/es/productos/auriculares/39420-energyheadphonesbt9bluetoothprettyPhoto/0,%3Cimg%20src=x%20onerror=alert%28/XSSPOSED/%29%3E/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 21.11.2017 Vulnerability type:| XSS Vulnerability...

JVN#71104430: Installer of Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program may insecurely load Dynamic Link Libraries

Installer of Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program provided by Agency for Natural Resources and Energy of METI contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege...

Nigerian Man Hacked Thousands of Global Oil & Gas and Energy Firms

By Uzair Amir The IT security researchers at CheckPoint cyber security firm headquartered in This is a post from HackRead.com Read the original post: Nigerian Man Hacked Thousands of Global Oil Gas and Energy Firms...