PHOENIX CONTACT mGuard

CVSS V3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: PHOENIX CONTACT Equipment: mGuard Vulnerability: Software update changes password to default AFFECTED PRODUCTS PHOENIX CONTACT reports that the vulnerability affects the following mGuard products: Only devices that hav...

V3 CONNECT - Dangerous filesystem permissions, External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application V3 CONNECT published at the 'play' market has multiple vulnerabilities...

Rockwell Automation MicroLogix 1100 PLC Overflow Vulnerability

OVERVIEW David Atch of CyberX has identified a stack-based buffer overflow vulnerability in Rockwell Automation’s Allen-Bradley MicroLogix 1100 programmable logic controller PLC systems. Rockwell Automation has produced a new firmware version to mitigate this vulnerability. This vulnerability cou...

CVE-2016-6900

The Intelligent Baseboard Management Controller iBMC in Huawei RH1288 V3 servers with software before V100R003C00SPC613; RH2288 V3 servers with software before V100R003C00SPC617; RH2288H V3 servers with software before V100R003C00SPC515; RH5885 V3 servers with software before V100R003C10SPC102; a...

CVE-2016-6899

The CVE-2016-6899 issue affects Huawei iBMC in RH1288 V3, RH2288 V3, RH2288H V3, RH5885 V3, and XH620/XH622/XH628 V3 servers running software before the specified V100R00xC00SPx levels. The root cause is the ability to select an insecure SSL encryption algorithm in the iBMC, which could permit re...

CVE-2016-6900

CVE-2016-6900 affects Huawei iBMC in RH1288 V3, RH2288 V3, RH2288H V3, RH5885 V3, and XH620/622/628 V3 servers with software before the specified SPC updates. Local users can cause iBMC resource exhaustion and DoS via unspecified vectors. Huawei’s advisory HWPSIRT-2016-05251 notes these resource-...

CVE-2016-6825

The CVE covers Huawei server families (XH620/V3, XH622/V3, XH628/V3 before specific SPC builds; RH1288V3 before SPC613; RH2288V3 before SPC617; RH2288H V3 before SPC515) where lack of authentication protection enables brute-force password retrieval via remote access. This reflects a remote-authen...

CVE-2016-6899

The Intelligent Baseboard Management Controller iBMC in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, RH2288H V3 servers with software before V100R003C00SPC515, RH5885 V3 servers with software before V100R003C10SPC102, a...

Vanderbilt Industries Siemens IP CCTV Cameras Vulnerability

OVERVIEW Siemens reports that there is a vulnerability in Siemens-branded IP cameras from Vanderbilt Industries. Vanderbilt has released updates to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS Siemens reports that the vulnerability affects the...

Siemens SINEMA Server Privilege Escalation Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-215-02 Siemens SINEMA Server Privilege Escalation Vulnerability that was published August 2, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 2 -------- Security researcher rgod working...

Honeywell Experion PKS Improper Input Validation Vulnerability

OVERVIEW Honeywell reported a denial-of-service condition caused by an improper input validation vulnerability in Honeywell’s Experion Process Knowledge System PKS platform. Honeywell has produced patches to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED...

CVE-2016-5722

CVE-2016-5722 affects Huawei OceanStor storage series (5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, 18500 V3) prior to version V300R003C10 . Root cause: the session token is transmitted in plaintext within the HTTP header, enabling remote attackers to sniff traffic and perform replay at...

CVE-2016-5722

Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, which allows remote attackers to conduct replay attacks and obtain sensitive information by sniffing the network...

[SECURITY] Fedora 23 Update: php-htmLawed-1.1.21-1.fc23

PHP code to purify and filter HTML make HTML markup in text secure and standard-compliant process text for use in HTML, XHTML or XML documents restrict HTML elements, attributes or URL protocols using black or white-lists balance tags, check element nesting, transform deprecated attributes and...

GE MultiLink Series Hard-coded Credential Vulnerability

OVERVIEW GE has identified a hard-coded credential vulnerability in GE’s MultiLink series managed switches. GE has produced new firmware versions to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following MultiLink products are affected: GE ML8...

ThinkSNS v3 /apps/page/Lib/Action/DiyAction.class.php 任意用户登陆+后台管理绕过

No description provided by source...

CVE-2015-7706

Multiple cross-site scripting XSS vulnerabilities in Secure Data Space SDS-API before 3.5.7 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO to api/v3/public/shares/downloads/, the 2 authType parameter to api/v3/auth/login, or the 3 login parameter to...

Moderate: Red Hat Security Advisory: openssl security update

Updated openssl packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fro...

Huawei FusionServer Product Security Bypass Vulnerability

Huawei FusionServer RH2288 V3 is a server product from Huawei, China. The Huawei FusionServer product failed to properly limit the number of query attempts, allowing remote attackers to obtain sensitive information via brute force attack...

Huawei FusionServer Product Command Injection Vulnerability

Huawei FusionServer RH2288 V3 is a server product from Huawei, China. A security vulnerability exists in the Huawei FusionServer product that allows remote attackers to submit a special request to change parameters in the login page and inject commands...