Open Smart Grid Protocol Alliance Plan to Fix its Weak Crypto

The Open Smart Grid Protocol Alliance, which recently came under fire for a weak crypto implementation in its protocol, will upgrade existing devices, likely starting in September. Harry Crijns, secretary of the OSGP Alliance in The Netherlands, said fixes have been developed and are “under a...

CSRF to add admin user Vulnerability In Manage Engine Device Expert

=============================================================================== CSRF to add admin user Vulnerability In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title : CSRF to add...

Manage Engine Device Expert 5.9.9.0 Cross Site Scripting

=============================================================================== Reflected XSS Vulnerability in XSS In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title :Reflected XSS...

Manage Engine Device Expert 5.9.9.0 Cross Site Scripting

=============================================================================== Stored XSS Vulnerability In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title :Stored XSS Vulnerability I...

Manage Engine Device Expert 5.9.9.0 CSRF

=============================================================================== CSRF to add admin user Vulnerability In Manage Engine Device Expert =============================================================================== . contents:: Table Of Content Overview ======== Title : CSRF to add...

Peerio — End-to-End Encrypted Secure Messenger and File Sharing App

On one end, where governments of countries like U.K is criticizing end-to-end encryption and considering to ban the encrypted communication apps like Snapchat, CryptoCat, WhatsApp and Apple’s iMessage. On the other hand, the Internet community has come up with a new and rather more secure encrypt...

Schneider Electric StruxureWare SCADA Expert ClearSCADA Parsing Vulnerability

OVERVIEW Andrew Brooks identified and reported to The Zero Day Initiative ZDI a File Parsing Vulnerability: Schneider Electric StruxureWare SCADA Expert ClearSCADA ServerMain.exe OPF File Parsing Vulnerability. Schneider Electric has prepared workarounds and helped develop security upgrades for a...

Law Firm - Forensics Services

As cyber threats and attacks have increased year over year, Coalfire has seen a drastic increased need for support to law firms in cybersecurity cases. Attacks and threats vary so often, many law firms lack the skills required to properly evaluate cyber-attacks involving their clients. As such la...

Schneider Electric Floating License Manager Vulnerability

OVERVIEW Schneider Electric had become aware of an “unquoted service path” vulnerability in the Schneider Electric Floating License Manager, produced a patchSchneider Electric Security Notification SEVD 2014-015-01v3,...

UBUNTU-CVE-2014-8712

The buildexpertdata function in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 does not properly initialize a data structure, which allows remote attackers to cause a denial of service application crash via a crafted packet...

DAMM - Differential Analysis of Malware in Memory

An open source memory analysis tool built on top of Volatility. It is meant as a proving ground for interesting new techniques to be made available to the community. These techniques are an attempt to speed up the investigation process through data reduction and codifying some expert knowledge...

PT-2014-8687

Name of the Vulnerable Software and Affected Versions Wireshark versions 1.10.x through 1.10.10 Wireshark versions 1.12.x through 1.12.1 Description The issue is related to the build expert data function in the NCP dissector, which does not properly initialize a data structure. This allows remote...

PT-2014-8688

Name of the Vulnerable Software and Affected Versions Wireshark versions 1.10.x through 1.10.10 Wireshark versions 1.12.x through 1.12.1 Description The issue is related to a stack-based buffer overflow in the build expert data function within the NCP dissector. This can be exploited by remote...

Schneider Electric ClearSCADA Uncontrolled Resource Consumption Vulnerability

OVERVIEW Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an uncontrolled resource consumption vulnerability in the Schneider Electric SCADA Expert ClearSCADA software. Schneider Electric has produced a new version that mitigates this vulnerability. Adam Crain has...

Schneider Electric SCADA Expert ClearSCADA < 2014 R1.1 and Schneider Electric ClearSCADA < 2010 R3.2 Multiple Vulnerabilities

Binary data 8391.prm...

Schneider Electric SCADA Expert ClearSCADA Authentication Bypass (CVE-2014-5412)

An information disclosure vulnerability exists in Schneider Electric SCADA Expert ClearSCADA. This vulnerability is due to insufficient restrictions of the preconfigured guest account. A remote attacker can exploit this vulnerability to disclose sensitive system information...

CVE-2014-5411

Multiple cross-site scripting XSS vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-5412: Improper Authentication

Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allows remote attackers to read database records by leveraging access to the guest account...

CVE-2014-5411: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-5413: Undefined Security Weakness

Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm...