4133 matches found
CVE-2014-0751 GE Proficy HMI/SCADA Path Traversal
The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system. By modifying the source location, an attacker could send shell code to the CimWebServer which would deploy the nefarious files as part of any SCADA project. This could...
CVE-2014-0751
The GE Proficy HMI/SCADA - CIMPLICITY application (versions 4.01 to 8.2 ) and Proficy Process Systems with CIMPLICITY are vulnerable to a path traversal vulnerability (CWE-22) in the CimWebServer component (specifically CimWebServer.exe or the WebView component). Due to insufficient checks on the...
Certec atvise scada OpenSSL Heartbleed Vulnerability
OVERVIEW Researcher Bob Radvanovsky of Infracritical has notified NCCIC/ICS-CERT that Certec has released new libraries that mitigate the OpenSSL Heartbleed vulnerability in atvise scada. This vulnerability could be exploited remotely. Exploits that target the OpenSSL Heartbleed vulnerability are...
CVE-2014-0750: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-16...
CVE-2014-0751: Improper Limitation of a Pathname to a Restricted Directory
The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system. By modifying the source location, an attacker could send shell code to the CimWebServer which would deploy the nefarious files as part of any SCADA project. This could...
PT-2014-3814
Name of the Vulnerable Software and Affected Versions GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY versions prior to 8.2 SIM 24 Proficy Process Systems with CIMPLICITY versions prior to 8.2 SIM 24 Description The issue allows remote attackers to execute arbitrary code via a crafted...
Dennis Fisher and Mike Mimoso Discuss the Target Breach, SCADA Security and the NSA
Dennis Fisher and Mike Mimoso talk about the big security stories of the last couple of weeks, including the developments in the Target data breach, the president’s speech on NSA surveillance reforms and SCADA security woes...
Electric Cybersecurity Regulations Have Serial Problem
A class of SCADA vulnerabilities discussed at a recent conference is getting attention not only for the risks they pose to master control systems at electric utilities, but also for illuminating a dangerous gap in important critical infrastructure regulations. Researchers Adam Crain and Chris...
CVE-2014-0753
Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service system crash by triggering access to DLL code located in the IntegraXor directory...
Stack overflow
Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service system crash by triggering access to DLL code located in the IntegraXor directory...
CVE-2014-0753
Ecava IntegraXor SCADA server (Ecava IntegraXor) is affected by CVE-2014-0753. The stack-based buffer overflow affects versions prior to 4.1.4390 and can be exploited remotely by triggering access to DLL code in the IntegraXor directory, potentially causing a denial of service (system crash). The...
PT-2014-3816 · Ecava · Integraxor
Name of the Vulnerable Software and Affected Versions: Ecava IntegraXor versions prior to 4.1.4390 Description: The issue is related to a stack-based buffer overflow in the SCADA server, which can be triggered by remote attackers to cause a denial of service, resulting in a system crash. This...
CVE-2014-0753: Stack-based Buffer Overflow
Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service system crash by triggering access to DLL code located in the IntegraXor directory...
Siemens SINEMA Vulnerabilities
OVERVIEW Siemens has identified vulnerabilities in SINEMA server. Siemens has produced a software update that mitigates these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS The following Siemens product is affected: SINEMA server: all versions prior to V12 S...
Zero Day Vulnerability Patched in SCADA HMI Software
Malaysian SCADA software company Ecava released a patch yesterday for a zero-day vulnerability in its flagship human machine interface HMI that was publicly disclosed at a conference this week. The patch repairs a buffer overflow vulnerability in the company’s IntegraXor Web-based HMI software. H...
DHS Warns of Schneider Electric ClearSCADA Vulnerability
The Department of Homeland Security is warning the maintainers of industrial control systems ICS about a remotely exploitable uncontrolled resource consumption vulnerability in Schneider Electric’s ClearSCADA software. Schneider Electric says that it has developed a new version of ClearSCADA that...
Progea Movicon SCADA Information Disclosure Vulnerability
OVERVIEW Celil Ünüver of SignalSEC Ltd. has identified an information disclosure vulnerability in the Progea Movicon application. Progea has produced a new version that mitigates this vulnerability. The researcher has tested the new version to validate that it resolves the vulnerability. This...
CVE-2013-6142
DNP3Driver.exe in the DNP3 driver in Schneider Electric ClearSCADA 2010 R2 through 2010 R3.1 and SCADA Expert ClearSCADA 2013 R1 through 2013 R1.2 allows remote attackers to cause a denial of service resource consumption via IP packets containing errors that trigger event-journal messages...