CVE-2015-3962

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...

Schneider Electric StruxureWare Building Expert Plain Text Credentials Vulnerability

StruxureWare Building Expert is the building automation system. A plain text transmission vulnerability exists in Schneider Electric StruxureWare Building Expert products prior to version 2.15, which can be exploited by an attacker to obtain user login credentials...

PT-2015-6361

Name of the Vulnerable Software and Affected Versions Schneider Electric StruxureWare Building Expert MPM versions prior to 2.15 Description The issue concerns the lack of encryption for the client-server data stream, allowing remote attackers to discover credentials by sniffing the network...

CVE-2015-3962: Insufficiently Protected Credentials

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...

Schneider Electric StruxureWare Building Expert Security Patch

Industrial control manufacturer Schneider Electric has published new firmware for its StruxureWare Building Expert building automation system that patches a remotely exploitable vulnerability. Researcher Artyom Kurbatov discovered that the system transmits user credentials in plaintext between th...

SQL Injection Vulnerability in Chengdu Shihang Software Development Co.

Chengdu Shihang Software Development Co., Ltd. is mainly dedicated to information technology, including basic Internet business, website construction, website optimization and promotion, management system, custom software development, e-commerce operation and value-added telecommunication busines...

SQL Injection Vulnerability in Government Website System of Bazhong Wanshan Software Co.

Bazhong Wanshan Software Co., Ltd. is a software company specializing in serving Bazhong city government departments. A SQL injection vulnerability exists in the Bazhong Wanshan Software Government Website Building System, which allows attackers to exploit this vulnerability to obtain sensitive...

Hangzhou Boce Network Technology Co., Ltd. station-building system / bocadmin/j/uploadify.php there are arbitrary file upload vulnerability

BOC is a system of Hangzhou Bocai Network Technology Co., Ltd. that provides professional website construction services. The website building system /bocadmin/j/uploadify.php of Hangzhou Bocai Network Technology Co., Ltd. has an arbitrary file upload vulnerability, which allows an attacker to...

Schneider Electric StruxureWare Building Expert Plaintext Credentials Vulnerability

OVERVIEW Independent researcher Artyom Kurbatov has identified a cleartext transmission vulnerability in Schneider Electric’s StruxureWare Building Expert product. Schneider Electric has produced a new firmware version that mitigates this vulnerability. Artyom Kurbatov has tested the new firmware...

focused Web Crawler: ACHE

ACHE is a focused Web crawler that can be customized to search for pages the belong to a given topic or have a given property. To configure ACHE, you need to: define a topic of interest e.g., Ebola, terrorism, cooking recipes; create a model to detect Web pages that belong to this topic; and...

[SECURITY] Fedora 22 Update: glpi-0.85.2-2.fc22

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

某通用型建站系统SQL注射之八

简要描述： 之八 详细说明： 某通用型建站系统SQL注射之八。 源码：XYCMS管理咨询公司建站系统 v4.2 地址：http://down.chinaz.com/soft/29472.htm 注入点：Showdxal.asp?id= 可搜索到实例： 实例如下： http://www.laco-hr.com/showdxal.asp?id=66 http://www.pundun.cn/showdxal.asp?id=66 http://www.szcxl.com/showdxal.asp?id=63 http://www.jshbls.com/showdxal.asp?id=19...

某校园建站系统同一文件多处sql注入漏洞

简要描述： sql 详细说明： 使用量非常多 http://www.dlwsxx.com/ws2004/model/login1.asp http://www.fzjcxx.cn/ws2004/model/login1.asp http://www.nxyancgjzx.com/ws2004/model/login1.asp http://www.sgtjb.com/ws2004/model/login1.asp http://www.sdwhys.com/ws2004/model/login1.asp...

yodo建站系统设计不当可刷钱（本地演示）

简要描述： 你可以看不惯我装逼，但不可以阻止我装逼 by:helen 详细说明： DOYO通用建站系统采用PHP与MYSQL开发,是免费开源的CMS建站、企业建站系统,可广泛用于个人、企业、政府、机构等众多网站建设 官网地址：wdoyo.com 官方提供demo但数据不可以入库：http://demo.wdoyo.com/ 所以只能本地演示了 本地搭建以后注册个会员，点击在线充值查看一下当前的余额（我这里之前刷的成了29.8） 接下来开始刷钱先来到首页随便选一个商品 选好最后点击立刻购买 然后burp抓包，把数量改成-1（-10，-100甚至-1000都可以） 之后查看价格已经变成了-5...

Microsoft Publishes Information Sharing Framework

Microsoft earlier this week published a 25-page framework offering guidance on how to effectively share information and what kinds of information need to be shared in order to reduce overall risk. Information sharing has been an oft-repeated refrain in security and policy-making circles for the...

Dex to Java Decompiler: jadx

Command line and GUI tools for produce Java source code from Android Dex and Apk files Building from source git clone https://github.com/skylot/jadx.git cd jadx ./gradlew dist on Windows, use gradlew.bat instead of ./gradlew Scripts for run jadx will be placed in build/jadx/bin and also packed to...

DHS Not Addressing Cyber Threats to Building Access Systems

Civil watchdogs at the Government Accountability Office are warning the Department of Homeland Security and the Government Services Agency about unaddressed risks posed to building access control systems at federal facilities. The systems in question are those that prevent unauthorized access to...

Next Generation Snort IPS: Snort3

The Snort++ project has been hard at work for a while now and we have released the third alpha of the next generation Snort IPS Intrusion Prevention System. This file will show you what Snort++ has to offer and guide you through the steps from download to demo. If you are unfamiliar with Snort yo...

bananadance wiki b2.2 - Multiple Vulnerabilities

No description provided by source. Title: ====== BananaDance Wiki b2.2 - Multiple Web Vulnerabilities Date: ===== 2012-11-10 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=745 VL-ID: ===== 745 Common Vulnerability Scoring System: ==================================== 7....

Vixie Cron crontab 3.0 Privilege Lowering Failure Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/2687/info Vixie cron is an implementation of the popular UNIX program that runs user-specified programs at periodic scheduled times. When a parsing error occurs after a modification operation, crontab will fail to drop...