EUVD-2013-0696

Malware in sbrugna...

CVE-2013-0686

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in...

CVE-2013-0685

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

CVE-2013-0684

SQL injection vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-0688

Cross-site scripting XSS vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

CVE-2013-0685

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

CVE-2013-0684

CVE-2013-0684 is a SQL injection vulnerability in Invensys Wonderware Information Server (WIS) affecting WIS 4.0 SP1SP1, 4.5 Portal, and 5.0 Portal. The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors (CWE-89). Multiple sources confirm the affected products...

CVE-2013-0688

Cross-site scripting XSS vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0688

CVE-2013-0688 (Wonderware Information Server): XSS in WIS 4.0 SP1, 4.5 Portal, and 5.0 Portal allows remote injection of script/HTML. Root cause: improper neutralization of input in web pages (CWE-79). Impact noted as potentially remote code execution, data disclosure, or session credential hijac...

CVE-2013-0688: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2013-2529

Name of the Vulnerable Software and Affected Versions Invensys Wonderware Information Server WIS versions 4.0 SP1 through 5.0 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. Recommendations For Invensys Wonderware Information Server WIS versions 4.0 SP...

CVE-2013-0685: Undefined Security Weakness

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

PT-2013-2531

Name of the Vulnerable Software and Affected Versions Invensys Wonderware Information Server WIS versions 4.0 SP1 through 5.0 Description The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via an XML document containing ...

PT-2013-2533

Name of the Vulnerable Software and Affected Versions Invensys Wonderware Information Server WIS version 4.0 SP1 Invensys Wonderware Information Server WIS versions 4.5 through 5.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via...

PT-2013-2530

Name of the Vulnerable Software and Affected Versions Invensys Wonderware Information Server WIS versions 4.0 SP1 through 5.0 Description The issue allows remote attackers to execute arbitrary code or cause a denial of service due to unrestricted size and amount values. Recommendations For versio...

CVE-2013-0686: Improper Input Validation

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in...

CVE-2013-0684: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-0226

Invensys Wonderware Information Server 4.0 SP1 and 4.5 Portal/Client are affected by CVE-2012-0226, a SQL injection vulnerability that could allow a remote attacker to execute arbitrary SQL commands via unspecified vectors. The ICS-CERT advisory confirms multiple vulnerabilities in these products...