PT-2017-3766

Name of the Vulnerable Software and Affected Versions: SIMATIC Automation Tool versions prior to V3.0 SIMATIC NET PC-Software versions prior to V14 SP1 SIMATIC PCS 7 V8.1 all versions SIMATIC PCS 7 V8.2 versions prior to V8.2 SP1 SIMATIC STEP 7 TIA Portal V13 versions prior to V13 SP2 SIMATIC STE...

Patched Flaw in Bosch Diagnostic Dongle Allowed Researchers to Shut Off Engine

Two vulnerabilities were identified in Bosch’s Drivelog Connect OBD-II dongle and smartphone app that allowed researchers to shut off the engine of a vehicle. One of the issues was patched via server-side fix, Bosch said in an April 13 statement, while the other in the dongle itself will be handl...

PT-2017-7405

Name of the Vulnerable Software and Affected Versions Bitrix versions 6.5.2 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via several parameters in two API endpoints: "admin/mcart xls import.php" and "admin/mcart xls...

Cross site scripting

paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php step parameter...

CVE-2017-6478

paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php step parameter...

PT-2017-17095

Name of the Vulnerable Software and Affected Versions MaNGOSWebV4 versions prior to 4.0.8 Description The issue is related to a reflected XSS in the install/index.php file, specifically affecting the step parameter. Recommendations For versions prior to 4.0.8, update to version 4.0.8 or later to...

CVE-2017-6478: Improper Neutralization of Input During Web Page Generation

paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php step parameter...

Google Adds Security Key Enforcement to G Suite Apps

Google on Wednesday pumped more life into the use of physical keys as a second form of authentication when it added Security Key enforcement support to G Suite. Admins inside enterprises managing deployments of the suite of cloud-based productivity apps, formerly known as Google Apps, can now...

Code injection

IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could be read by a local user...

SIMATIC Manager Step7 5.5 SP1 DLL Hijacking

Exploit Title: SIMATIC Manager Step7 DLL Hijacking Cve : 2012-3015 Author: Ashiyane Digital Security Team Vendor Homepage: siemens.com Version: =5.5 SP1 Tested on:Windows 7 Exploit by : Amir.ght Description: Company Name: SIEMENS AG Product Name: SIEMENS STEP 7/S7TM Programmable Controller...

Malware exploit: Filestealer 1.3

FileStealer v1.3 Type: Upload vulnerability Author: Xylitol !-- FileStealer v1.3 panel upload vulnerability -- !-- Panel hash: be19e93878130b2f57d42d4dcf5ffcf0 -- form method="POST" action="http://localhost/panel/up.php" enctype="multipart/form-data" File: input type="file" name="file" / br / HWI...

Siemens SIMATIC STEP 7 (TIA Portal) < 14 Unquoted Service Path Local Privilege Escalation (SSA-701708)

Binary data scadasiemenstiastep7SSA-701708.nbin...

TomatoCart 'step_5.php' Cross-Site Scripting Vulnerability

TomatoCart is a set of open source e-commerce software developed using PHP. A cross-site scripting vulnerability exists in TomatoCart 'step5.php'. An attacker can exploit the vulnerability to execute arbitrary script code in an unsuspecting user's browser within the context of the affected site...

CVE-2016-7165: Improper Access Control

A vulnerability has been identified in Primary Setup Tool PST All versions V4.2 HF1, SIMATIC IT Production Suite All versions V7.0 SP1 HFX 2, SIMATIC NET PC-Software All versions V14, SIMATIC PCS 7 V7.1 All versions, SIMATIC PCS 7 V8.0 All versions, SIMATIC PCS 7 V8.1 All versions, SIMATIC PCS 7...

WhatsApp Adds​ ​2-Step Verification Passcode — Enable this Security Feature

WhatsApp has introduced a new security feature that fixes a loophole in the popular messaging platform, which if exploited, could allow an attacker to hijack victim's account with just knowing the victim's phone number and some hacking skills. The attack does not exploit any vulnerability in...

CVE-2016-7960

Siemens SIMATIC STEP 7 TIA Portal before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors...

CVE-2016-7959

Siemens SIMATIC STEP 7 TIA Portal before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack...

Format string

Siemens SIMATIC STEP 7 TIA Portal before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors...

Information disclosure

Siemens SIMATIC STEP 7 TIA Portal before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack...

CVE-2016-7959

Siemens SIMATIC STEP 7 TIA Portal before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack...