CVE-2014-2376

SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-2375

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service disk consumption, via the CSV export feature...

Code injection

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag...

Sql injection

SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-2375 Ecava IntegraXor SCADA Server External Control of File Name or Path

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service disk consumption, via the CSV export feature...

CVE-2014-2377

The CVE-2014-2377 entry affects Ecava IntegraXor SCADA Server versions 4.1.4360 and earlier (stable) and 4.1.4392 and earlier (beta), where built-in application tags can disclose full pathnames via environmental variables, enabling information exposure. Affected component: IntegraXor SCADA Server...

CVE-2014-2375

CVE-2014-2375 affects Ecava IntegraXor SCADA Server (Stable 4.1.4360 and earlier; Beta 4.1.4392 and earlier) via the CSV export feature, which allows an unauthenticated user to read or write arbitrary files and potentially cause a denial of service. The root cause is External Control of File Name...

CVE-2014-2376 Ecava IntegraXor SCADA Server SQL Injection

SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-2376

CVE-2014-2376 refers to an SQL injection vulnerability in Ecava IntegraXor SCADA Server, affecting stable 4.1.4360 and earlier and beta 4.1.4392 and earlier. The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors, enabling potential reading/modifying of files ...

CVE-2014-2377 Ecava IntegraXor SCADA Server Information Exposure Through Environmental Variables

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag...

Four Vulnerabilities Patched in SCADA Server

Four different remotely exploitable vulnerabilities were recently discovered and patched in a popular SCADA server. The vulnerabilities exist in some versions of IntegraXor, a SCADA server manufactured by Ecava Sdn Bhd, a Malaysian-based software company. The Industrial Control Systems Cyber...

Trihedral Engineering Limited VTScada Integer Overflow Vulnerability

OVERVIEW An anonymous researcher working with HP’s Zero Day Initiative has identified an integer overflow vulnerability in Trihedral Engineering Ltd’s VTScada application. Trihedral Engineering Limited has produced a patch that mitigates this vulnerability. This vulnerability could be exploited...

Honeywell FALCON XL Web Controller Multiple Vulnerabilities

Binary data scadaxlweb2211.nbin...

CODESYS WAGO WebVisu Detection

Binary data scadacodesyswebvisudetect.nbin...

Advantech WebAccess Stack-based Buffer Overflow

OVERVIEW Ricardo Narvaja from Core Security Consulting Services discovered and disclosed information regarding a buffer overflow vulnerabilityCore Security Advantech WebAccess Stack-based Buffer Overflow, http://www.coresecurity.com/advisories/advantech-webaccess-stack-based-buffer-overflow web...

Yokogawa BKBCopyD.exe Client Exploit

This module allows an unauthenticated user to interact with the Yokogawa CENTUM CS3000 BKBCopyD.exe service through the PMODE, RETR and STOR operations. Usage Info Module Options To display the available options, load the module within the Metasploit console and run the commands 'show options' or...

MOXA Device Manager Tool SCADA Buffer Overflow (CVE-2010-4741)

A remote code execution vulnerability has been reported in MOXA Device Manager Tool. The vulnerability is due to a stack based buffer overflow when handling specially crafted packets...

Yokogawa CS3000 SCADA BKFSim_vhfd.exe Remote Code Execution (CVE-2014-3888)

A remote code execution vulnerability has been reported in Yokogawa CENTUM CS 3000. The vulnerability is due to a stack based buffer overflow when handling specially crafted packets...

Elipse SCADA DNP3 Denial of Service

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on October 30, 2014, and is being released to the NCCIC/ICS-CERT web site Independent researchers Adam Crain and Chris Sistrunk have identified a DNP3 denial‑of‑service vulnerability in the Elipse SCADA application...

Nordex NC2 XSS Vulnerability

OVERVIEW This advisory is a follow-up to the alert titled ICS-ALERT-13-304-01 Nordex NC2 – Cross-Site Scripting Vulnerability that was published October 31, 2013, on the NCCIC/ICS-CERT web site. Independent researcher Darius Freamon identified a cross-site scripting vulnerability in the Nordex...