Schneider Electric Conext ComBox

CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Schneider Electric Equipment: Conext ComBox Vulnerability: Resource Exhaustion AFFECTED PRODUCTS Schneider Electric reports that the vulnerability affects the following Conext ComBox solar battery monitor: Conext...

Siemens RUGGEDCOM NMS Equipment Vulnerable to CSRF, XSS

Enterprise network management equipment made by Siemens suffers from vulnerabilities that could allow an attacker to perform administrative actions. Two flaws, a cross-site scripting XSS vulnerability and a cross-site request forgery CSRF vulnerability, exist in the company’s RUGGEDCOM NMS line o...

VIPA Controls WinPLC7

CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: VIPA Controls Equipment: WinPLC7 Vulnerability: Stack Buffer Overflow AFFECTED PRODUCTS The following versions of WinPLC7, a PLC programming software, are affected: WinPLC Versions 5.0.45.5921 and prior. IMPACT...

CVE-2016-6189

Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the 1 ics or 2 XML calendar feeds...

CVE-2016-6189: Incomplete List of Disallowed Inputs

Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the 1 ics or 2 XML calendar feeds...

Geutebruck 5.02024 G-Cam/EFD-2250 - Remote Command Execution Exploit

Exploit for hardware platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Geutebruck testaction.cgi Remote Command Execution', 'Description' = %q...

Siemens SIMATIC Authentication Bypass (Update A)

CVSS v3 9.0 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Siemens Equipment: SIMATIC Vulnerability: Authentication Bypass UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-17-045-03 Siemens SIMATIC Authentication Bypass that was...

Siemens SIMATIC Authentication Bypass (Update B)

CVSS v3 9.0 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Siemens Equipment: SIMATIC Vulnerability: Authentication Bypass UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-17-045-03A Siemens SIMATIC Authentication Bypass that was...

ICSA-17-045-03 Siemens SIMATIC Authentication Bypass (Update D)

1. EXECUTIVE SUMMARY CVSS v3 9.0 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: Siemens Equipment: SIMATIC Vulnerability: Improper Authentication 2. UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-17-045-03C Siemens SIMATIC...

ICS, SCADA Security Woes Linger On

A handful of worrisome vulnerabilities in Honeywell building automation system software disclosed last week are case in point of how far the industry continues to lag in securing SCADA and industrial control systems. Honeywell published in September new firmware that patches vulnerabilities...

Honeywell SCADA Controllers Exposed Passwords in Clear Text

A series of remotely exploitable vulnerabilities exist in a popular web-based SCADA system made by Honeywell that make it easy to expose passwords and in turn, give attackers a foothold into the vulnerable network. The flaws exist in some versions of Honeywell’s XL Web II controllers, systems...

BINOM3 Electric Power Quality Meter

CVSS v3 10 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: BINOM3 Equipment: Electric Power Quality Meter Vulnerabilities: Cross-site scripting, access control issues, cross-site request forgery CSRF, sensitive information stored in clear-text, and weak credentials management...

Ecava IntegraXor

CVSS v3 7.3 ATTENTION: Remotely Exploitable/low skill level to exploit Vendor: Ecava Equipment: IntegraXor Vulnerability: SQL Injection AFFECTED PRODUCTS The following IntegraXor version is affected: IntegraXor Version 5.0.413.0 IMPACT A successful exploit of this vulnerability could lead to...

Design/Logic Flaw

The icalpropertynewclone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service use-after-free via a crafted ics file...

Out-of-bounds

The icalparserparsestring function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service out-of-bounds heap read via a crafted ics file...

UBUNTU-CVE-2016-5825

The icalparserparsestring function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service out-of-bounds heap read via a crafted ics file...

CVE-2016-5824

libical 1.0 allows remote attackers to cause a denial of service use-after-free via a crafted ics file...

CVE-2016-5823

The icalpropertynewclone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service use-after-free via a crafted ics file...

CVE-2016-5825

The icalparserparsestring function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service out-of-bounds heap read via a crafted ics file...

CVE-2016-5825

The icalparserparsestring function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service out-of-bounds heap read via a crafted ics file...