Schneider Electric Wonderware Vulnerabilities

OVERVIEW Timur Yunusov, Ilya Karpov, Sergey Gordeychik, Alexey Osipov, and Dmitry Serebryannikov of the Positive Technologies Research Team have identified four vulnerabilities in the Schneider Electric Wonderware Information Server WIS. Schneider Electric has produced an update that mitigates...

CVE-2014-0933

The CVE-2014-0933 entry concerns a CSRF vulnerability in IBM InfoSphere Information Server Metadata Workbench 8.1 through 9.1 that allows remote attackers to hijack the authentication of arbitrary users. The vulnerability affects the product as described in the NVD entry, which lists Cross-site r...

PT-2014-3955

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server Metadata Workbench versions 8.1 through 9.1 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users. Recommendations For versions 8.1 through...

CVE-2014-0933: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in IBM InfoSphere Information Server Metadata Workbench 8.1 through 9.1 allows remote attackers to hijack the authentication of arbitrary users...

PT-2014-21: Multiple SQL injection vulnerabilities in Wonderware Information Server

The specialists of the Positive Research center have detected multiple SQL injection vulnerabilities in Wonderware Information Server. WIS is vulnerable to SQL Injection vulnerabilities by performing database operations that were unintended by the web application designer and, in some instances,...

PT-2014-19: Multiple Cross-Site Scripting (XSS) vulnerabilities in Wonderware Information Server

The specialists of the Positive Research center have detected multiple Cross-Site Scripting vulnerabilities in Wonderware Information Server. WIS fails to validate, filter, or encode user input before returning it to a user’s web client, which allows remote attackers to inject arbitrary web scrip...

PT-2014-17: Weak encryption of account data in Wonderware Information Server

The specialists of the Positive Research center have detected a Weak encryption of account data vulnerability in Wonderware Information Server. Encryption of WIS is insufficient. This vulnerability could allow elevation of privileges if an attacker decrypts the credentials. The system would need ...

PT-2014-18: Weak encryption of account data in Wonderware Information Server

The specialists of the Positive Research center have detected a Weak encryption of account data vulnerability in Wonderware Information Server. Encryption of WIS is insufficient. This vulnerability could allow elevation of privileges if an attacker decrypts the credentials. The system would need ...

CVE-2013-4057

Cross-site request forgery CSRF vulnerability in the XML Pack in IBM InfoSphere Information Server 8.5.x through 8.5 FP3, 8.7.x through 8.7 FP2, and 9.1.x through 9.1.2.0 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2013-4058

Multiple SQL injection vulnerabilities in IBM InfoSphere Information Server 8.x through 8.5 FP3, 8.7.x through 8.7 FP2, and 9.1.x through 9.1.2.0 allow remote authenticated users to execute arbitrary SQL commands via unspecified interfaces...

CVE-2013-4059

Multiple cross-site scripting XSS vulnerabilities in IBM InfoSphere Information Server 8.x through 8.5 FP3, 8.7.x through 8.7 FP2, and 9.1.x through 9.1.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified interfaces...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the XML Pack in IBM InfoSphere Information Server 8.5.x through 8.5 FP3, 8.7.x through 8.7 FP2, and 9.1.x through 9.1.2.0 allows remote attackers to hijack the authentication of arbitrary users...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IBM InfoSphere Information Server 8.x through 8.5 FP3, 8.7.x through 8.7 FP2, and 9.1.x through 9.1.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified interfaces...

CVE-2013-4059

CVE-2013-4059 affects IBM InfoSphere Information Server web interfaces across multiple versions (8.0/8.1/8.5/8.7/9.1). The issue enables content-spoofing and cross-site scripting via unspecified interfaces, potentially exposing sensitive information or unauthorized access. IBM advisories confirm ...

CVE-2013-4057

CVE-2013-4057 affects IBM InfoSphere Information Server XML Pack (versions 8.5.x up to FP3, 8.7.x up to FP2, and 9.1.x up to 9.1.2.0). The root cause is insufficient CSRF protections, allowing an attacker to trick a logged-in user into performing actions via a malicious URL, potentially hijacking...

CVE-2013-4057

Cross-site request forgery CSRF vulnerability in the XML Pack in IBM InfoSphere Information Server 8.5.x through 8.5 FP3, 8.7.x through 8.7 FP2, and 9.1.x through 9.1.2.0 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2013-4058

CVE-2013-4058 affects IBM InfoSphere Information Server, with vulnerability allowing remote authenticated users to execute arbitrary SQL commands via multiple Information Server web interfaces. Affected software ranges from IBM InfoSphere Information Server 8.0/8.1/8.5/8.7 on all platforms up to ...

PT-2014-2737

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server versions 8.x through 8.5 FP3 IBM InfoSphere Information Server versions 8.7.x through 8.7 FP2 IBM InfoSphere Information Server versions 9.1.x through 9.1.2.0 Description The issue allows remote attackers to...

PT-2014-2735

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server versions 8.5.x through 8.5 FP3 IBM InfoSphere Information Server versions 8.7.x through 8.7 FP2 IBM InfoSphere Information Server versions 9.1.x through 9.1.2.0 Description A cross-site request forgery CSRF...

PT-2014-2736

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server versions 8.x through 8.5 FP3 IBM InfoSphere Information Server versions 8.7.x through 8.7 FP2 IBM InfoSphere Information Server versions 9.1.x through 9.1.2.0 Description The issue allows remote authenticated...