Advantech WebAccess SCADA webeye.ocx ip_address Parameter Buffer Overflow - ver 2 (CVE-2014-8388)

A stack buffer overflow exists in Advantech's WebAccess SCADA software. The vulnerability is due to insufficient input validation of the ipaddress parameter contained in the webeye.ocx ActiveX control, a part of the WebAccess Client. A remote, unauthenticated attacker could exploit this...

Procyon Core Server HMI Memory Corruption SCADA Remote Code Execution - Ver2 (CVE-2011-3322)

A remote stack overflow vulnerability has been reported in Procyon Core Server HMI service. The vulnerability is due to a boundary check error. A remote attacker may exploit this issue by sending specially crafted messages to the target server. Successful exploitation could allow an attacker to...

Advantech WebAccess HMI and SCADA Software CrossSite Scripting - Ver2 (CVE-2012-0233)

A cross-site scripting vulnerability has been reported in Advantech Webaccess. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

HP's Zero Day Initiative Changes Bug-Buying Guidelines

HP’s Zero Day Initiative has decided to adjust its guidelines and criteria or buying some vulnerabilities in the future, eliminating some large classes of bugs from its menu. The group, which has been among the more visible and prominent of the vulnerability purchasing programs since its inceptio...

Industrial safety: BlackEnergy（dark）the use of the Siemens WinCC system has been repaired loopholes to launch attacks-vulnerability warning-the black bar safety net

Researchers recently found that the malware BlackEnergy（dark forces are using Siemens SIMATIC WinCC（Siemens the most classic process monitoring system has been repaired loopholes to re-attack the SCADA HMI system. ! Comeback: the BlackEnergy then update the BlackEnergy（dark）is an automated networ...

Soitec SmartEnergy 1.4 - SCADA Login SQL Injection Authentication Bypass

Soitec SmartEnergy 1.4 - SCADA Login SQL Injection Authentication Bypass Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Exploit Vendor: Soitec Product web page: http://www.soitec.com Affected version: 1.4 and 1.3 Summary: Soitec power plants are a profitable and ecological...

Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass

Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Exploit Vendor: Soitec Product web page: http://www.soitec.com Affected version: 1.4 and 1.3 Summary: Soitec power plants are a profitable and ecological investment at the same time. Using Concentrix technology, Soitec offers...

Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Exploit

Soitec SmartEnergy web application suffers from an authentication bypass vulnerability using SQL Injection attack in the login script. The script fails to sanitize the 'login' POST parameter allowing the attacker to bypass the security mechanism and view sensitive information that can be further...

Schneider Electric StruxureWare SCADA Expert ClearSCADA Parsing Vulnerability

OVERVIEW Andrew Brooks identified and reported to The Zero Day Initiative ZDI a File Parsing Vulnerability: Schneider Electric StruxureWare SCADA Expert ClearSCADA ServerMain.exe OPF File Parsing Vulnerability. Schneider Electric has prepared workarounds and helped develop security upgrades for a...

CVE-2014-5429

DNP Master Driver 3.02 and earlier in Elipse SCADA 2.29 build 141 and earlier, E3 1.0 through 4.6, and Elipse Power 1.0 through 4.6 allows remote attackers to cause a denial of service CPU consumption via malformed packets...

Code injection

DNP Master Driver 3.02 and earlier in Elipse SCADA 2.29 build 141 and earlier, E3 1.0 through 4.6, and Elipse Power 1.0 through 4.6 allows remote attackers to cause a denial of service CPU consumption via malformed packets...

CVE-2014-5429

CVE-2014-5429 affects the DNP Master Driver (V3.02 and earlier) used by Elipse SCADA, Elipse E3 (V1.0–V4.6), and Elipse Power (V1.0–V4.6). The root cause is handling of malformed DNP packets, leading to resource exhaustion and a denial of service (CPU consumption). Affected products can become un...

CVE-2014-5429

DNP Master Driver 3.02 and earlier in Elipse SCADA 2.29 build 141 and earlier, E3 1.0 through 4.6, and Elipse Power 1.0 through 4.6 allows remote attackers to cause a denial of service CPU consumption via malformed packets...

PT-2014-6469

Name of the Vulnerable Software and Affected Versions Elipse SCADA versions 2.29 and earlier E3 versions 1.0 through 4.6 Elipse Power versions 1.0 through 4.6 DNP Master Driver version 3.02 and earlier Description The issue allows remote attackers to cause a denial of service, specifically CPU...

CVE-2014-5429: Undefined Security Weakness

DNP Master Driver 3.02 and earlier in Elipse SCADA 2.29 build 141 and earlier, E3 1.0 through 4.6, and Elipse Power 1.0 through 4.6 allows remote attackers to cause a denial of service CPU consumption via malformed packets...

Elipse SCADA Denial of Service Patch

Brazilian process management software developer Elipse has patched a serious denial-of-service vulnerability in its web-based Elipse SCADA application. The software is used in a number of critical industries worldwide, including manufacturing, energy, water and wastewater plants. The vulnerabilit...

Researcher Releases Database of Known-Good ICS and SCADA Files

A prominent security researcher has put together a new database of hundreds of thousands of known-good files from ICS and SCADA software vendors in an effort to help users and other researchers identify legitimate files and home in on potentially malicious ones. The database, known as WhiteScope,...

PT-2014-1960

Name of the Vulnerable Software and Affected Versions Rockwell Automation RSView32 versions 7.60.00 and earlier Description The issue is related to errors in the password encryption algorithm of the RSView32 SCADA system, which can be exploited by a local attacker to gain access to the system and...

Advantech WebAccess SCADA webeye.ocx ip_address Parameter Buffer Overflow (CVE-2014-8388)

A stack buffer overflow exists in Advantech's WebAccess SCADA software. The vulnerability is due to insufficient input validation of the ipaddress parameter contained in the webeye.ocx ActiveX control, a part of the WebAccess Client. A remote, unauthenticated attacker could exploit this...

Siemens Patches WinCC Vulnerabilities Likely Being Exploited

Global industrial supplier Siemens has patched two critical vulnerabilities that it believes are likely being exploited. Organizations running products using the Siemens WinCC application are urged to apply available patches immediately; the company said it is working on updates for any remaining...