Information disclosure

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI...

CVE-2018-12634

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI...

CVE-2018-12635

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

CVE-2018-12634

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI...

CirCarLife Scada Unauthorized Upgrade Vulnerability

Circontrol CirCarLife Scada is a parking lot automation system from Circontrol, Spain. A security vulnerability exists in Circontrol CirCarLife Scada version 4.2.4. The vulnerability can be exploited to disclose sensitive information by sending requests to the html/upgrade.html and...

CirCarLife Scada Information Disclosure Vulnerability

Circontrol CirCarLife Scada is a parking lot automation system from Circontrol, Spain. A security vulnerability exists in Circontrol CirCarLife Scada version 4.2.4. A remote attacker can exploit this vulnerability by sending a direct request to the html/log or services/system/info.html URIs to...

CVE-2018-12634

CirCarLife Scada is affected prior to version 4.3. A remote attacker can disclosure sensitive information by issuing a direct HTTP request to html/log or services/system/info.html, exposing system logs and potentially other data. The issue is triggered by exposing log/system information via unaut...

PT-2018-1720

Name of the Vulnerable Software and Affected Versions: LAquis SCADA versions 4.1.0.3870 and prior Description: The issue is related to a path traversal vulnerability, which may allow remote code execution. It is associated with insufficient checking of the directory path name, potentially enablin...

PT-2018-11299

Name of the Vulnerable Software and Affected Versions CirCarLife Scada version 4.2.4 Description The issue allows unauthorized upgrades through specific requests. This can be achieved by sending requests to the "html/upgrade.html" and "services/system/firmware.upgrade" API endpoints...

CVE-2018-12635

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

CVE-2018-12634: Exposure of Sensitive Information to an Unauthorized Actor

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI...

CVE-2018-12635: Improper Input Validation

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

CVE-2018-12634

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI...

CVE-2018-12635

CirCarLife Scada v4.2.4 is affected by an unauthorized upgrade vulnerability, exploitable via requests to html/upgrade.html and services/system/firmware.upgrade URIs. The provided documents describe the issue as an ability to perform upgrades without authorization, but do not specify the underlyi...

PT-2018-11298

Name of the Vulnerable Software and Affected Versions CirCarLife Scada versions prior to 4.3 Description The issue allows remote attackers to obtain sensitive information. This can be achieved by making a direct request for specific URI endpoints, such as "html/log" or "services/system/info.html"...

CirCarLife Scada 未授权访问信息泄露

...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of June 11, 2018

As a native Texan, I’ve seen more than my fair share of bugs - actual physical bugs that love the hot, humid Texas climate and my curly hair for some reason. The Zero Day Initiative ZDI sees many bugs of the software variety, including those that affect SCADA control systems. Fritz Sands recently...

Router Vulnerability and the VPNFilter Botnet

On May 25, the FBI asked us all to reboot our routers. The story behind this request is one of sophisticated malware and unsophisticated home-network security, and it's a harbinger of the sorts of pervasive threats ­ from nation-states, criminals and hackers ­ that we should expect in coming year...

PT-2018-1717

Name of the Vulnerable Software and Affected Versions: LAquis SCADA versions 4.1.0.3870 and prior Description: The issue is related to out-of-bounds read vulnerabilities in the LQS file parsing functionality of LAquis SCADA, which may allow remote code execution. This is due to a buffer overflow ...

Honeywell Scada System - Information Disclosure Vulnerability

Exploit for linux platform in category web applications Exploit Title: Honeywell Scada System - Information Disclosure Exploit Author: t4rkd3vilz Vendor Homepage: https://www.honeywell.com Version: WebVersion : 3.2.1.294365 - DeviceType : IPC-HFW2320R-ZS Tested on: Linux To be written after the...