CVE-2017-12734

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

CVE-2017-12735

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

CVE-2017-12734

Siemens LOGO! 8 BM (incl. SIPLUS variants): all versions prior to V1.81.2 are affected by CVE-2017-12734 (Insufficiently Protected Credentials). An attacker with network access to the integrated web server on port 80/tcp can obtain the session ID of an active user session, requiring a logged-in u...

CVE-2017-12735

Siemens LOGO! 8 BM (incl. SIPLUS variants) is affected by CVE-2017-12735. All versions before v8.3 are vulnerable to a Man-in-the-Middle attack that could allow an attacker to decrypt and modify traffic between the LOGO! BM and other devices. The issue is mitigated by updating to firmware v8.3 (n...

CVE-2017-12735

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic...

CVE-2017-12734

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V1.81.2. An attacker with network access to the integrated web server on port 80/tcp could obtain the session ID of an active user session. A user must be logged in to the web interface. Siemens recommends to use...

Siemens Fixes Session Hijacking Bug in LOGO!, Warns of Man-in-the-Middle Attacks

Administrators who have Siemens’ LOGO! logic module deployed in automation setups are being urged to update its firmware. The German industrial manufacturing giant pushed out an update for its LOGO! 8 BM devices Wednesday morning to fix a vulnerability CVE-2017-12734 that could let an attacker...

Siemens LOGO! (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: LOGO! Vulnerabilities: Insufficiently Protected Credentials, Man-in-the-Middle 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...

Synology Photo Station File Upload Vulnerability (CNVD-2017-27721)

Synology Photo Station is an online photo album and blog owned and managed by DSM users. A file upload vulnerability exists in synothemeupload.php in Synology Photo Station, which can be exploited by remote attackers to upload arbitrary files without authentication via the logoupload operation...

CVE-2017-11151

A vulnerability in synothemeupload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logoupload action...

File upload vulnerability in SchoolCMS backend SiteController.class.php

SchoolCMS is a school teaching management system based on PHP+MySQL. A file upload vulnerability exists in the SchoolCMS backend SiteController.class.php, due to the system Upload function not effectively filtering user-submitted data. A remote attacker can arbitrarily write files to gain web...

Qualys new look and new products

As you all know, it's Black Hat 2017 time. This year Qualys seems to be the main newsmaker among Vulnerability Management vendors. Qualys Team renewed logo and website, updated marketing strategy, presented two new products: CloudView and CertView. I decided to take a look. Talking about design, ...

Fedora 26 : 1:chromium-native_client (2017-c11d7ef69a)

Chromium 59. Add smaller logo files. Fix lots of security bugs: Security fix for CVE-2017-5070, CVE-2017-5071, CVE-2017-5072, CVE-2017-5073, CVE-2017-5074, CVE-2017-5075, CVE-2017-5086, CVE-2017-5076, CVE-2017-5077, CVE-2017-5078, CVE-2017-5079, CVE-2017-5080, CVE-2017-5081, CVE-2017-5082,...

Fedora 25 : 1:chromium-native_client (2017-a66e2c5b62)

Chromium 59. Add smaller logo files. Fix lots of security bugs: Security fix for CVE-2017-5070, CVE-2017-5071, CVE-2017-5072, CVE-2017-5073, CVE-2017-5074, CVE-2017-5075, CVE-2017-5086, CVE-2017-5076, CVE-2017-5077, CVE-2017-5078, CVE-2017-5079, CVE-2017-5080, CVE-2017-5081, CVE-2017-5082,...

Oracle E-Business Suite (EBS) Detection (HTTP)

HTTP based detection of Oracle E-Business Suite EBS. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SQL Injection Vulnerability in Love Channel Music V10.01 System logo.php Page

Love Channel Music System is an audio-visual management system developed using php+Mysql. An SQL injection vulnerability exists in the logo.php page of the Love Channel Music V10.01 system. The lack of filtering of the 'cdid' parameter allows attackers to exploit the vulnerability to obtain...

WordPress Admin Custom Login 2.4.5.2 Cross Site Scripting

------------------------------------------------------------------------ Admin Custom Login WordPress plugin affected by persistent Cross-Site Scripting via Logo URL field ------------------------------------------------------------------------ Burak Kelebek, July 2016...

PHP Logo Designer Script Arbitrary File Upload

Exploit Title: PHP Logo Designer Script - Arbitrary File Upload Google Dork: N/A Date: 30.01.2017 Vendor Homepage: https://codecanyon.net/item/php-logo-designer/19362231 Software Buy: https://codecanyon.net/item/php-logo-designer/19362231 Demo: http://phplogodesigner.000webhostapp.com/ Version: N...

PHP Logo Designer Script - Arbitrary File Upload

PHP Logo Designer Script - Arbitrary File Upload Exploit Title: PHP Logo Designer Script - Arbitrary File Upload Google Dork: N/A Date: 30.01.2017 Vendor Homepage: https://codecanyon.net/item/php-logo-designer/19362231 Software Buy: https://codecanyon.net/item/php-logo-designer/19362231 Demo:...

PHP Logo Designer Script - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: PHP Logo Designer Script - Arbitrary File Upload Google Dork: N/A Date: 30.01.2017 Vendor Homepage: https://codecanyon.net/item/php-logo-designer/19362231 Software Buy: https://codecanyon.net/item/php-logo-designer/19362231 Demo...