CVE-2019-13516

In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect...

Information disclosure

OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information...

Cross site request forgery (csrf)

In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect...

CVE-2019-13516

CVE-2019-13516 affects OSIsoft PI Web API (and prior versions). The issue is a cross-site request forgery protection setting that has not taken effect, leaving the PI Web API vulnerable to direct attack. Affected products include PI Web API 2018 and earlier versions. Exploitation details are not ...

CVE-2019-13516

In OSIsoft PI Web API and prior, the affected product is vulnerable to a direct attack due to a cross-site request forgery protection setting that has not taken effect...

CVE-2019-13515

CVE-2019-13515 affects OSIsoft PI Web API 2018 and earlier, enabling disclosure of sensitive information via log files (CWE-532). The vulnerability exists in the PI Web API REST interface and is driven by how logs may contain sensitive data. Affected versions are PI Web API 2018 and prior. Remedi...

CVE-2019-13515

OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information...

CVE-2019-9012

An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS products and may result in a denial-of-service condition. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.2...

OSIsoft PI Web API

1. EXECUTIVE SUMMARY CVSS v3 8.5 ATTENTION: Exploitable remotely Vendor: OSIsoft LLC Equipment: OSIsoft PI Web API Vulnerabilities: Inclusion of Sensitive Information in Log Files, Protection Mechanism Failure 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow direct...

OS X Manage Sonic Pi

This module controls Sonic Pi via its local OSC server. The server runs on 127.0.0.1:4557 and receives OSC messages over UDP. Yes, this is RCE, but it's local. I suggest playing music. :- This module requires Metasploit: https://metasploit.com/download Current source:...

Hackers' Operating System Kali Linux Released for Raspberry Pi 4

We've got some really exciting news for you... Offensive Security has released an official version of Kali Linux for Raspberry Pi 4—the most powerful version of the compact computer board yet that was released just two weeks ago with the full 4GB of RAM at low cost and easy accessibility. Based o...

Hackers' Operating System Kali Linux Released for Raspberry Pi 4

We've got some really exciting news for you... Offensive Security has released an official version of Kali Linux for Raspberry Pi 4—the most powerful version of the compact computer board yet that was released just two weeks ago with the full 4GB of RAM at low cost and easy accessibility. Based o...

BKS EBK Ethernet-Buskoppler Pro Shell Upload Vulnerability

BKS EBK Ethernet-Buskoppler Pro versions prior to 3.01 suffer from a remote shell upload vulnerability. Product: BKS EBK Ethernet-Buskoppler Pro Manufacturer: BKS GmbH Affected Versions: 3.01 Vulnerability Type: Unrestricted Upload of File with Dangerous Type CWE-434 Risk Level: High Solution...

BKS EBK Ethernet-Buskoppler Pro Shell Upload

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2019-017 Product: BKS EBK Ethernet-Buskoppler Pro Manufacturer: BKS GmbH Affected Versions: 3.01 Vulnerability Type: Unrestricted Upload of File with Dangerous Type CWE-434 Risk Level: High Solution Status: Fixed Manufacturer...

FaceSentry Access Control System 6.4.8 - Remote Root Exploit

FaceSentry Access Control System 6.4.8 - Remote Root Exploit !/usr/bin/env python -- coding: utf-8 -- FaceSentry Access Control System 6.4.8 Remote Root Exploit Vendor: iWT Ltd. Product web page: http://www.iwt.com.hk Affected version: Firmware 6.4.8 build 264 Algorithm A16 Firmware 5.7.2 build 5...

FaceSentry Access Control System 6.4.8 Reflected Cross Site Scripting

FaceSentry Access Control System 6.4.8 Reflected Cross-Site Scripting Vendor: iWT Ltd. Product web page: http://www.iwt.com.hk Affected version: Firmware 6.4.8 build 264 Algorithm A16 Firmware 5.7.2 build 568 Algorithm A14 Firmware 5.7.0 build 539 Algorithm A14 Summary: FaceSentry 5AN is a...

FaceSentry Access Control System 6.4.8 Cleartext Password Storage

Summary FaceSentry 5AN is a revolutionary smart identity management appliance that offers entry via biometric face identification, contactless smart card, staff ID, or QR-code. The QR-code upgrade allows you to share an eKey with guests while you're away from your Office and monitor all activity...

FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure

Summary FaceSentry 5AN is a revolutionary smart identity management appliance that offers entry via biometric face identification, contactless smart card, staff ID, or QR-code. The QR-code upgrade allows you to share an eKey with guests while you're away from your Office and monitor all activity...

OpenJPEG De-Zero Vulnerability

OpenJPEG is a C-based open source JPEG2000 codec . OpenJPEG 2.3.0 and earlier versions of the openmj2/pi.c file have a divide-by-zero error vulnerability in the 'pinextpcrl' function, the 'pinextcprl' function, and the ' pinextrpcl' functions have a divide-by-zero error vulnerability. A remote...

OpenJPEG Out-of-Bounds Access Vulnerability

OpenJPEG is an open source JPEG 2000 codec written in C language. An out-of-bounds access vulnerability exists in the pinextlrcp, pinextrlcp, pinextrpcl, pinextrpcl, pinextpcrl, pinextrpcl, and pinextcprl functions in OpenMJ2/pi.c in OpenJPEG 2.3.0 and earlier versions. A remote attacker could...