CICMS V2.1 suffers from sql injection vulnerability

CICMS system is developed by php+mysql, based on CodeIgniter, and is mainly used for enterprise building. CICMS V2.1 suffers from a sql injection vulnerability. An attacker can exploit this vulnerability to obtain the server's password...

XSS Vulnerability in Chengdu Firefox Technology Website Building System

Chengdu Firefox Technology Website Building System is a website building system. An XSS vulnerability exists in Chengdu Firefox Technology Website Builder. An attacker can use this vulnerability to inject arbitrary Web script or HTML to obtain sensitive information such as administrator cookies...

Alerton Webtalk 2.5/3.3 - Multiple Vulnerabilities

''' Security Issues in Alerton Webtalk ================================== Introduction ------------ Vulnerabilities were identified in the Alerton Webtalk Software supplied by Alerton. This software is used for the management of building automation systems. These were discovered during a black bo...

Alerton Webtalk 2.5 / 3.3 Hash Disclosure / CSRF / Command Injection Vulnerabilities

Exploit for multiple platform in category web applications Security Issues in Alerton Webtalk ================================== Introduction ------------ Vulnerabilities were identified in the Alerton Webtalk Software supplied by Alerton. This software is used for the management of building...

Backend Authentication Bypass Vulnerability in S-CMS

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. S-CMS has a background authentication bypass vulnerability, due to the failure to accurately verify cookie information, an attacker can bypass login authentication by importing arbitrary cookie values...

firstdial.in XSS vulnerability

Open Bug Bounty ID: OBB-222004 Description| Value ---|--- Affected Website:| firstdial.in Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Code injection

Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives,...

CVE-2017-5682

Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives,...

Intel PSET Application Install wrapper contains an escalation of privilege vulnerability.

Summary: Intel PSET Application Install wrapper contains an escalation of privilege vulnerability. Description: Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer a...

ICS, SCADA Security Woes Linger On

A handful of worrisome vulnerabilities in Honeywell building automation system software disclosed last week are case in point of how far the industry continues to lag in securing SCADA and industrial control systems. Honeywell published in September new firmware that patches vulnerabilities...

[SECURITY] Fedora 25 Update: flatpak-0.8.2-1.fc25

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information...

Cross-site scripting vulnerability in the 'adminfrom.php' page of the DM website builder system

DM enterprise building system is developed by php + mysql for small and medium-sized enterprise website construction of a set of open source cms. A cross-site scripting vulnerability exists in the 'adminfrom.php' page of the DM website builder system. The program fails to filter user-supplied...

Schneider Electric Building Operation Automation Server Vulnerability

OVERVIEW Independent researcher Karn Ganeshen has identified a vulnerability in servers programmed with Schneider Electric’s StruxureWare Building Operation software. Schneider Electric has produced a new version to mitigate this vulnerability. This vulnerability could be exploited remotely...

[SECURITY] Fedora 25 Update: python-cryptography-vectors-1.5.3-1.fc25

Test vectors for the cryptography package. The only purpose of this package is to be a building requirement for python-cryptography, otherwise it has no use. Don=EF=BF=BD=EF=BF=BD=EF=BF =BDt install it unless you really know what you are doing...

[SECURITY] Fedora 23 Update: python-cryptography-vectors-1.5.3-1.fc23

Test vectors for the cryptography package. The only purpose of this package is to be a building requirement for python-cryptography, otherwise it has no use. Don=EF=BF=BD=EF=BF=BD=EF=BF =BDt install it unless you really know what you are doing...

Lynxspring JENEsys BAS Bridge Authentication Bypass Vulnerability

Lynxspring is a US based company.BAS Bridge is a web based SCADA system.BAS servers are deployed in areas such as commercial facilities, manufacturing, energy, water and wastewater systems and many more. An authentication bypass vulnerability exists in Lynxspring JENEsys BAS Bridge. Due to the la...

Gary McGraw on BSIMM7 and Secure Software Development

Mike Mimoso talks to Cigital CTO and software security pioneer Gary McGraw about the latest results pulled from the Building Security In Maturity Model BSIMM. The framework measures the secure development activities of some of the world’s largest software companies and enterprises and can be used...

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions File Containment Vulnerability

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions are Auto-Matrix USA's building automation front-end solutions for infrastructure, which are primarily deployed stateside in commercial facilities, critical manufacturing and energy and wastewater systems I&C. A...

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions Information Disclosure Vulnerabilities

Auto-Matrix Aspect-Nexus and Aspect-Matrix Building Automation Front-End Solutions are Auto-Matrix USA's building automation front-end solutions for infrastructure, which are primarily deployed stateside in commercial facilities, critical manufacturing and energy and wastewater systems I&C. A...

CVE-2016-2308

American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application store passwords in cleartext, which allows remote attackers to obtain sensitive information by reading a file...