CVE-2016-2278

Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh aka Minimal Shell protection mechanism...

The vulnerability of the web server for visualizing BACnet/IP network controllers, SAUTER moduWeb Vision, allows a intruder to obtain confidential information.

The vulnerability of the BACnet/IP network controller visualization web server, SAUTER moduWeb Vision, is related to the transmission of data in an open manner. Exploiting this vulnerability could allow a malicious actor to obtain confidential information by listening to network traffic...

The vulnerability of the Web server for visualizing BACnet/IP network controllers, SAUTER moduWeb Vision, allows a intruder to inject arbitrary Web or HTML code.

The vulnerability of the BACnet/IP network controller visualization web server from SAUTER moduWeb Vision exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code using a specially craft...

KMC Controls Conquest BACnet Router Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on May 5, 2016, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified authentication and cross-site request forgery CSRF vulnerabilities in KMC Controls’ Conquest...

Siemens OZW672 and OZW772 Cross-Site Scripting Vulnerabilities

Siemens OZW672 and OZW772 are both building controller products from Siemens, Germany. A cross-site scripting vulnerability exists in the Siemens OZW672 and OZW772 devices. A remote attacker could exploit the vulnerability to alter data and settings...

SQL Injection Vulnerability in Website Building System of Shenyang Woodman Culture Communication Co.

Shenyang Woodman Culture Communication Co., Ltd. is a high-tech company dedicated to website construction, mobile client app, customized system application software, e-commerce development and operation. The website building system developed by Shenyang Woodman suffers from SQL injection...

antwerpmedicalbuilding.be XSS vulnerability

Vulnerable URL: http://www.antwerpmedicalbuilding.be/index.php?mid=1%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

[SECURITY] Fedora 23 Update: python-cryptography-vectors-1.0.2-2.fc23

Test vectors for the cryptography package. The only purpose of this package is to be a building requirement for python-cryptography, otherwise it has no use. Don=E2=80=99t install it unle ss you really know what you are doing...

Email Reconnaissance Tool: SimplyEmail

This tool was based off the work of theHarvester and kind of a port of the functionality. This was just an expansion of what was used to build theHarvester and will incorporate his work but allow users to easily build Modules for the Framework. Current Platforms Supported: Kali Linux 2.0 A few...

CVE-2015-1807

Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts...

Directory traversal

Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts...

CVE-2015-1807

Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts...

CVE-2015-3962

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...

Code injection

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...

CVE-2015-3962

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...

CVE-2015-3962

Schneider Electric StruxureWare Building Expert MPM before version 2.15 is affected by a cleartext transmission vulnerability (CWE-319) where the client–server data stream is not encrypted, enabling remote attackers to discover user credentials by sniffing traffic. The issue affects StruxureWare ...

Schneider Electric StruxureWare Building Expert Plain Text Credentials Vulnerability

StruxureWare Building Expert is the building automation system. A plain text transmission vulnerability exists in Schneider Electric StruxureWare Building Expert products prior to version 2.15, which can be exploited by an attacker to obtain user login credentials...

Schneider Electric StruxureWare Building Expert Security Patch

Industrial control manufacturer Schneider Electric has published new firmware for its StruxureWare Building Expert building automation system that patches a remotely exploitable vulnerability. Researcher Artyom Kurbatov discovered that the system transmits user credentials in plaintext between th...

SQL Injection Vulnerability in Chengdu Shihang Software Development Co.

Chengdu Shihang Software Development Co., Ltd. is mainly dedicated to information technology, including basic Internet business, website construction, website optimization and promotion, management system, custom software development, e-commerce operation and value-added telecommunication busines...

SQL Injection Vulnerability in Government Website System of Bazhong Wanshan Software Co.

Bazhong Wanshan Software Co., Ltd. is a software company specializing in serving Bazhong city government departments. A SQL injection vulnerability exists in the Bazhong Wanshan Software Government Website Building System, which allows attackers to exploit this vulnerability to obtain sensitive...