PT-2015-5013

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition version 7.7.2 Description The issue makes it easier for attackers to obtain access via a brute-force attack because it uses MD5 password hashes. Recommendations For version 7.7.2, consider updating the password...

PT-2015-5009

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition version 7.7.2 Description The issue allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception. This can be demonstrated by accessing pathname information...

CVE-2015-0991: Exposure of Sensitive Information to an Unauthorized Actor

Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information...

CVE-2015-0994: Undefined Security Weakness

Inductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force protection mechanism by using different session ID values in a series of HTTP requests...

CVE-2015-0995: Undefined Security Weakness

Inductive Automation Ignition 7.7.2 uses MD5 password hashes, which makes it easier for context-dependent attackers to obtain access via a brute-force attack...

PT-2015-4999

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition version 7.7.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For version 7.7.2, update to a newer version that contains a fix for this...

CVE-2015-0976: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Inductive Automation Ignition 7.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-5010

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition version 7.7.2 Description The issue allows local users to obtain sensitive information, specifically cleartext OPC Server credentials, via unspecified vectors. Recommendations For Inductive Automation Ignition...

PT-2015-5012

Name of the Vulnerable Software and Affected Versions Inductive Automation Ignition version 7.7.2 Description The issue allows remote authenticated users to bypass a brute-force protection mechanism. This is achieved by using different session ID values in a series of HTTP requests. Recommendatio...

Inductive Automation Ignition Brute Force Vulnerability

Ignition is an updated version of FactoryPMI, the HMI/SCADA product offered by Inductive Automation. Ignition suffers from a security vulnerability in the hash algorithm MD5 in use, which can lead to brute force attacks on database storage accounts...

Inductive Automation Ignition Information Disclosure Vulnerability (CNVD-2015-02155)

Ignition is an updated version of FactoryPMI, the HMI/SCADA product offered by Inductive Automation. Ignition stores the OPC Server username and password in plaintext in the settings file, which can be utilized by an attacker to obtain sensitive information...

Inductive Automation Ignition Security Bypass Vulnerability

Ignition is an updated version of FactoryPMI, the HMI/SCADA product offered by Inductive Automation. A security vulnerability exists in the Ignition brute force attack blocking mechanism, which can be bypassed by an attacker by setting the session ID parameter in the HTTP request...

Inductive Automation Ignition Invalid Session Expires Vulnerability

Ignition is an updated version of FactoryPMI, the HMI/SCADA product offered by Inductive Automation. Ignition does not delete the session after the user logs out, which can allow an attacker to reuse the current session...

Inductive Automation Ignition Information Disclosure Vulnerability (CNVD-2015-02154)

Ignition is an updated version of FactoryPMI, the HMI/SCADA product offered by Inductive Automation. Inductive Automation Ignition suffers from an information disclosure vulnerability that could be exploited by an attacker to gain access to sensitive information...

PT-2015-08: Bypass Anti-Bruteforce Mechanism in Inductive Automation Ignition

The specialists of the Positive Research center have detected a Bypass Anti-Bruteforce Mechanism vulnerability in Inductive Automation Ignition. The mechanism of blocking bruteforce attacks could be bypassed with resetting session id parameter in HTTP request. The mechanism blocking bruteforce...

Inductive Automation Ignition Vulnerabilities

OVERVIEW Evgeny Druzhinin, Alexey Osipov, Ilya Karpov, and Gleb Gritsai of Positive Technologies have identified several vulnerabilities in Inductive Automation’s Ignition Software. Inductive Automation has produced a patch that mitigates these vulnerabilities. These vulnerabilities could be...

Ignition 1.3 - Remote Code Execution Exploit

No description provided by source. ?php / Ignition 1.3 Remote Code Execution Exploit by cOndemned download: http://launchpad.net/ignition/trunk/1.3/+download/ignition-1.3.tar.gz source of i-options.php 1. ?php 2. sessionstart; 3. if $POST'submit' 4. if $FH = @fopen'data/settings.php', 'w' 5...

CMS Ignition SQL Injection Exploit

No description provided by source. |------------------------------------------------| | neavorc@gmaildotcom | ================================================== + SQL Injection Vulnerability + Dorks: allinurl:shop.htm?shopMGID= + Bug in shop.htm?shopMGID + Exploit:...

Ignition 1.3 (comment.php) Local File Inclusion Vulnerability

No description provided by source. Ignition 1.3 === Local File Include By n0n0x Homepage: http://priasantai.uni.cc/ Download script :http://launchpad.net/ignition/trunk/1.3/+download/ignition-1.3.tar.gz ========================================= xpl :...

Ignition 1.2 - Multiple Local File Inclusion Vulnerabilities

No description provided by source. Ignition 1.2 Multiple Local File Inclusion Vulnerabilities disclosed by cOndemned download: http://launchpadlibrarian.net/27567060/ignition1.2.zip note: magicquotesgpc should be turned off in order to exploit this vulnerability greetz: all friends, SecurityReaso...