CVE-2019-13528

CVE-2019-13528 is an Improper Authorization vulnerability affecting Tridium Niagara: Niagara AX 3.8u4 (JACE 3e/6e/7/JACE-8000), Niagara 4.4u3 (JACE 3e/6e/7/JACE-8000), and Niagara 4.7u1 (JACE-8000, Edge 10). A specific utility may allow a local attacker to read privileged files due to insufficien...

CVE-2019-13527

In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user may result in the use of a pointer that has not been initialized...

CVE-2019-13527

CVE-2019-13527 affects Rockwell Automation Arena Simulation Software Cat. 9502-Ax (versions 16.00.00 and earlier). The issue is a parsing flaw where a pointer is used without initialization when processing Arena DOE files, potentially enabling remote code execution. Exploitation typically require...

CVE-2019-14338

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

CVE-2019-14336

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request...

CVE-2019-14338

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

Input validation

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape to a shell in the restricted command line interface, as demonstrated by the /bin/sh -c wget sequence...

Cross site request forgery (csrf)

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request...

Design/Logic Flaw

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

CVE-2019-14338

CVE-2019-14338 affects D-Link 6600-AP and DWL-3600AP with firmware 4.2.0.14 Ax. A post-authentication XSS vulnerability exists in the management interface via admin.cgi?action= parameter. Public references (NVD, Red Hat entry, CNVD, packetstorm) corroborate an XSS issue, with CVSSv3.1 base score ...

CVE-2019-14336

CVE-2019-14336 affects D-Link 6600-AP and DWL-3600AP with firmware 4.2.0.14 Ax. The vulnerability enables post-authenticated dump of all configuration files via an insecure HTTP request to admin.cgi, leading to information disclosure. Multiple connected sources corroborate an authenticated access...

CVE-2019-14336

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request...

CVE-2019-14332

CVE-2019-14332 affects D-Link 6600-AP and DWL-3600AP (Ax 4.2.0.14). The issue is the use of weak SSH ciphers (e.g., diffie-hellman-group1-sha1) in affected firmware. Evidence in multiple sources confirms the vulnerability details and affected devices; some sources also reference related SSH brute...

Starbucks: SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll Database

As described in the Hacker Summary, @spaceraccoon discovered a SQL Injection vulnerability in a web service backed by Microsoft Dynamics AX. @spaceraccoon demonstrated that the flaw was exploitable via XML-formatted HTTP payload requests to the server. We appreciate @spaceraccoon's clear and...

TRIDIUM Niagara Enterprise Security, Niagara AX and Niagara Cross-Site Scripting Vulnerabilities

TRIDIUM Niagara Enterprise Security, Niagara AX, and Niagara are all products of Tridium, Inc.TRIDIUM Niagara Enterprise Security is a set of access control and security systems for the construction industry.Niagara AX is a Niagara is a platform for supporting device and application connectivity....

ICSA-18-333-02_Tridium Niagara Enterprise Security, Niagara AX, and Niagara 4

1. EXECUTIVE SUMMARY CVSS v3 5.7 ATTENTION : Exploitable remotely/low skill level Vendor : Tridium Equipment : Niagara Enterprise Security, Niagara AX, and Niagara 4 Vulnerability : Cross-site Scripting 2. REPOSTED INFORMATION This advisory was originally posted to the HSIN ICS-CERT library on...

Tridium Niagara AX Framework and Niagara 4 Framework Path Traversal Vulnerability

Tridium Niagara AX Framework and Niagara 4 Framework are both IoT business application frameworks from Tridium USA. A path traversal vulnerability exists in Tridium Niagara AX Framework 3.8 and earlier and Niagara 4 Framework 4.4 and earlier, where the program fails to adequately filter...

Path traversal

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform administrator credentials...

CVE-2017-16744

A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform administrator credentials...

CVE-2017-16748

An attacker can log into the local Niagara platform Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system...