2232 matches found
CVE-2016-8367
CVE-2016-8367 affects Schneider Electric Magelis HMI panels (GTO, GTU, STO/STU, XBT) with web server functionality. The issue is uncontrolled resource consumption: an attacker can open multiple connections to the Web Gate Server and keep them open, causing denial of service by exhausting the serv...
CVE-2016-10224
The CVE-2016-10224 entry concerns Sauter NovaWeb web HMI where a protection check relies on a cookieâs existence/values but does not verify that the cookie is valid for the associated user. Affected component: the web HMI protection mechanism. Root cause: inadequate validation of user-bound cooki...
CVE-2016-8374
An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen...
CVE-2016-9360
The CVE-2016-9360 issue affects GE Proficy HMI/SCADA iFIX (Version 5.8 SIM 13 and earlier), CIMPLICITY (Version 9.0 and earlier), and Historian (Version 6.0 and earlier). Root cause: Insufficiently protected credentials enabling password retrieval when an attacker has access to an authenticated s...
GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian Vulnerability
OVERVIEW This advisory was originally posted to the NCCIC Portal on December 1, 2016, and is being released to the ICS-CERT web site. GE has reported an insufficiently protected credentials vulnerability in Proficy Human-Machine Interface/Supervisory Control and Data Acquisition HMI/SCADA iFIX,...
GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian Vulnerability (Update A)
OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-336-05 GE Proficy HMI/SCADA IFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian Vulnerability that was published January 17, 2017, on the NCCIC/ICS-CERT web site. GE has reported an insufficiently protecte...
UCanCode - Multiple Vulnerabilities
Exploit for windows platform in category dos / poc UCanCode multiple vulnerabilities Url: http://www.hmi-software.com/ http://www.ucancode.net/index.htm http://www.ucancode.net/bbs/zhuce/login.htm Description: Form vendor's web page "UCanCode Software is a Market Leading provider of HMI & SCADA,...
UCanCode - Multiple Vulnerabilities
UCanCode - Multiple Vulnerabilities UCanCode multiple vulnerabilities Url: http://www.hmi-software.com/ http://www.ucancode.net/index.htm http://www.ucancode.net/bbs/zhuce/login.htm Description: Form vendor's web page "UCanCode Software is a Market Leading provider of HMI & SCADA, CAD, UML, GIS,...
UCanCode - Multiple Vulnerabilities
UCanCode multiple vulnerabilities Url: http://www.hmi-software.com/ http://www.ucancode.net/index.htm http://www.ucancode.net/bbs/zhuce/login.htm Description: Form vendor's web page "UCanCode Software is a Market Leading provider of HMI & SCADA, CAD, UML, GIS, Vector Graphics and Real Time Data...
Phoenix Contact ILC PLC Authentication Vulnerabilities
OVERVIEW Matthias Niedermaier and Michael Kapfer of HSASec Hochschule Augsburg have identified authentication vulnerabilities in Phoenix Contactâs ILC inline controller PLCs. Phoenix Contact GmbH & Co. KG has produced a mitigation plan that includes an update and recommended security practices to...
Resource Consumption Vulnerability in Multiple Schneider Electric Products
Schneider Electric Magelis HMI Magelis GTO Advanced Optimum panels and so on are the HMI human-machine panel series products of France Schneider Electric Schneider Electric. A resource depletion vulnerability exists in multiple Schneider Electric products. An attacker could exploit the...
Schneider Electric Magelis HMI Resource Consumption Vulnerabilities (Update B)
OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-16-308-02A Schneider Electric Magelis HMI Resource Consumption Vulnerabilities that was published November 22, 2016, on the NCCIC/ICS-CERT web site. ICS-CERT is aware of a public report of resource consumption...
Mitigations Available for PanelShock Vulnerabilities in Schneider HMIs
One week after addressing a critical vulnerability in its industrial controller management software, Schneider Electric is in the midst of handling two more serious flaws in a number of its Magelis HMI products. HMI is short for human machine interface, a graphical visualization of an industrial...
Schneider Electric Magelis HMI Advanced Panel denial of service vulnerability (PanelShock)
IMPROPER IMPLEMENTATION OF HTTP GET REQUEST CVE-2016-8367 / SVE-82003201 The timeout value for closing an HTTP client's requests in the Web Gate service is too long and allows a malicious attacker to open multiple connections to the targeted web server and keep them open for as long as possible b...
Schneider Electric Magelis HMI Resource Consumption Vulnerabilities (Update B)
OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-16-308-02A Schneider Electric Magelis HMI Resource Consumption Vulnerabilities that was published November 22, 2016, on the NCCIC/ICS-CERT web site. ICS-CERT is aware of a public report of resource consumption...
CVE-2016-5787
General Electric GE Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service DACLs, which allows local users to modify a service configuration via unspecified vectors...
Design/Logic Flaw
General Electric GE Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service DACLs, which allows local users to modify a service configuration via unspecified vectors...
CVE-2016-5787
CVE-2016-5787 affects GE Digital Proficy HMI/SCADA CIMPLICITY, prior to version 8.2 SIM 27. The root cause is improper handling of service DACLs, allowing a local user to modify the CIMPLICITY service configuration via unspecified vectors, enabling privilege elevation by tampering with the servic...
CVE-2016-5787
General Electric GE Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service DACLs, which allows local users to modify a service configuration via unspecified vectors...
Scan Reveals Hydropower Plants, Other Critical Infrastructure Exposed Online
An Internet scan of the IPv4 address space uncovered more than 100 critical facilities exposed to the public Internet, including hydropower plants in Germany and Italy, and a smart building in Israel hosting luxury apartments. The investigation, conducted by researchers at Internet Wache of Berli...