CVE-2015-2918

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2015-2918

The CVE concerns the OrientDB Studio web management interface in the OrientDB Server Community Edition. Affected versions are before 2.0.15 and before 2.1.1 (2.1.x line). The root cause is that Studio does not properly restrict use of FRAME elements, allowing remote attackers to perform clickjack...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-085-01 Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities, that was published March 26, 2015, to the NCCIC/ICS-CERT web site. Gleb Gritsai, Ilya Karpov, and Kirill Nesterov o...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities

OVERVIEW Gleb Gritsai, Ilya Karpov, and Kirill Nesterov of Positive Technologies Security Lab and independent researcher Alisa Esage Shevchenko have identified vulnerabilities in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014. Schneider Electric has released new patch...

InduSoft Web Studio 'NTWebServer' Directory Traversal Vulnerability - Windows

InduSoft Web Studio is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

InduSoft Web Studio 'Remote Agent' Code Execution Vulnerability - Windows

InduSoft Web Studio is prone to a code execution vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WinAsm Studio 5.1.8.8 - Buffer Overflow Crash (PoC)

Exploit: WinAsm Studio 5.1.8.8 BOF. Date: 12/6/2015 Exploit Author: UnN0n Vendor: WinAsm Software Link: http://www.winasm.net/winasm-studio-updates.html Version: 5.1.8.8 Tested on: Windows 7 x6464bit Info Code: rc.right = 0; rc.bottom = 0; DrawTextExA hdc, L"I...

WinAsm Studio 5.1.8.8 - Buffer Overflow Crash (PoC)

WinAsm Studio 5.1.8.8 - Buffer Overflow Crash PoC Exploit: WinAsm Studio 5.1.8.8 BOF. Date: 12/6/2015 Exploit Author: UnN0n Vendor: WinAsm Software Link: http://www.winasm.net/winasm-studio-updates.html Version: 5.1.8.8 Tested on: Windows 7 x6464bit Info Code: rc.right = 0; rc.bottom = 0;...

Apple iTunes < 12.3 Multiple Vulnerabilities (uncredentialed check)

The version of Apple iTunes running on the remote host is prior to 12.3. It is, therefore, affected by multiple vulnerabilities in the WebKit, CoreText, and ICU components, and in the bundled version of the Microsoft Visual Studio C++ Redistributable Package. An attacker can exploit these...

SAND STUDIO AirDroid application information disclosure vulnerability

SAND STUDIO AirDroid for Android is a suite of Android-based device housekeeping applications from SAND STUDIO USA. An information disclosure vulnerability exists in the SAND STUDIO AirDroid application for Android. It allows an attacker to obtain sensitive information through a crafted applicati...

Microsoft .NET Core, ASP.NET Beta Bug Bounty

Microsoft today opened a bounty for the .NET Core and ASP.NET Beta, both of which are part of the Visual Studio development suite. The bounty will remain open through Jan. 20 and payouts will fall between $500 and $15,000 USD. Microsoft said only bugs in the .NET core runtime CoreCLR and beta...

Design/Logic Flaw

The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application...

CVE-2015-5661

The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application...

CVE-2015-5661

The CVE-2015-5661 entry concerns AirDroid for Android (SAND STUDIO) and its mishandling of implicit intents. Affected software: AirDroid for Android, version 1.1.0 and earlier. Root cause: improper handling of implicit intents that enables an attacker to obtain sensitive information through a cra...

CVE-2015-5661

The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application...

Schneider Electric InduSoft Web Studio Remote Agent Remote Code Execution (CVE-2015-7374)

The vulnerability is due to lack of authentication to the Remote Agent Service which allows attackers to execute API calls on the service remotely. By sending crafted requests to the service, a remote unauthenticated attacker can exploit this vulnerability to execute code under the context of the...

Schneider Electric InduSoft Web Studio Arbitrary Code Execution Vulnerability

Schneider Electric InduSoft Web Studio is an embedded HMI software package.Remote Agent is one of the remote agent components. A security vulnerability in Schneider Electric InduSoft Web Studio's handling of Indusoft Project files allows an attacker to construct a malicious file and trick an...

Schneider Electric InduSoft Web Studio Remote Agent Component Code Execution Vulnerability

Schneider Electric InduSoft Web Studio is an embedded HMI software package.Remote Agent is one of the remote agent components. A security vulnerability exists in the Remote Agent component of Schneider Electric InduSoft Web Studio that could be exploited by a remote attacker to submit a special...

InduSoft Web Studio Remote Agent Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of InduSoft WebStudio. User interaction is not required to exploit this vulnerability. The specific flaw exists within the Remote Agent service listening on TCP port 1234. The issue lies in the lack o...

CVE-2015-7375

Schneider Electric InduSoft Web Studio before 8.0 allows remote attackers to execute arbitrary code or cause a denial of service unhandled runtime exception and application crash via a crafted Indusoft Project file...