energigeni.se XSS vulnerability

Vulnerable URL: http://energigeni.se/requestXaX404/"';-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6213520 Google Pagerank| 3 VIP website status:| No Coordinated Disclosure...

用友某系统通用漏洞涉及多家银行、证券、能源行业、企业

简要描述： 用友某系统通用漏洞可以读取配置文件 详细说明： 用友某系统通用漏洞涉及多家银行、证券、能源行业、企业 测试了部分网站，还有大量的网站存在此漏洞 http://zhaopin.cnooc.com.cn/hrss/dorado/smartweb2.RPC.d?rpc=true http://nc.hbny.com.cn:9090/hrss/dorado/smartweb2.RPC.d?rpc=true http://59.173.0.46:8070/hrss/dorado/smartweb2.RPC.d?rpc=true...

GE Hydran M2 Predictable TCP Initial Sequence Vulnerability

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on February 10, 2015, and is being released to the NCCIC/ICS-CERT web site. Raheem Beyah, David Formby, and San Shin Jung of Georgia Tech, via a research project partially sponsored by the Georgia Tech National...

SDG Technologies Plug and Play SCADA Cross-Site Scripting Vulnerability

SDG Technologies Plug and Play SCADA is a suite of web-based SCADA and HMI software for use in the energy industry. SDG Technologies Plug and Play SCADA fails to adequately filter user-submitted input, allowing remote attackers to exploit vulnerabilities to inject malicious scripts or HTML code...

Janitza UMG Session Token Flaw Vulnerability

The Janitza UMG is an online power quality monitor for the energy industry from Janitza Germany. Janitza UMG 508, 509, 511, 604,605 has a session-token flaw. Allows a remote attacker to perform calculations on the session-token value and determine the PIN value...

GE Multilink Switch Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-013-04 GE MultiLink Switch Vulnerabilities that was published January 13, 2015, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 3 -------- Eireann Leverett of IOActive has identified three...

Honeywell Experion PKS Security Vulnerabilities

Update – Unsupported versions of Honeywell distributed control system software are vulnerable to publicly available remote exploits. The Industrial Control System Cyber Emergency Response Team ICS-CERT published on Tuesday an advisory warning organizations to upgrade to supported versions of...

Siemens RUGGEDCOM ROX-based Devices NTP Vulnerabilities

OVERVIEW Siemens has reported to NCCIC/ICS-CERT that NTP daemon vulnerabilities exist in the Siemens RUGGEDCOM ROX-based devices. Siemens has produced firmware updates to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS The following Siemens...

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise Absolute Path Traversal Vulnerability

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise are both products of General Electric Company GE, U.S.A. GE Digital Energy MDS PulseNET is a suite of software applications for monitoring and controlling industrial communication network devices. Enterprise is an enterprise version of MD...

CVE-2015-6459

Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname...

CVE-2015-6456

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password...

Path traversal

Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname...

CVE-2015-6459

Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname...

CVE-2015-6456

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise are affected versions prior to 3.1.5, which contain hard-coded credentials for a hidden support account. This enables remote attackers to obtain administrative access and potentially execute arbitrary code. Public advisories (ZDI-15-440; ...

CVE-2015-6459

CVE-2015-6459 covers an absolute path traversal in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise FileDownloadServlet prior to version 3.1.5. The vulnerability arises from insufficient validation in the download function, allowing remote attackers to read or delete arbitrary files via...

CVE-2015-6456

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password...

Researchers to Develop Long-Lasting Solid-State Batteries

Whenever you go to Buy any Electronic Gadget — Phone, Tablet, Laptop, Watch — the most important specification isn’t its processor speed or its camera quality. It’s how long the device’s battery backup is. Imagine easy access to such batteries that provide more battery power after charging it onc...

CVE-2015-6459: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or delete arbitrary files via a full pathname...

CVE-2015-6456: Undefined Security Weakness

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password...

PT-2015-3063

Name of the Vulnerable Software and Affected Versions GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise versions prior to 3.1.5 Description The issue is related to an absolute path traversal vulnerability in the download feature of the FileDownloadServlet. This vulnerability allows remot...