GSX Analyzer 10.1211 - main.swf Hard-Coded Superadmin Credentials

GSX Analyzer 10.1211 - main.swf Hard-Coded Superadmin Credentials Exploit Title: GSX Analyzer hardcoded superadmin credentials in Main.swf Google Dork: inurl:"/Main.swf?cachebuster=" need to manually look for stringtitle "Loading GSX Analyzer ... 0%" Date: 12-07-16 Exploit Author: ndevnull Vendor...

GSX Analyzer 10.12/11 - 'main.swf' Hard-Coded Superadmin Credentials

Exploit Title: GSX Analyzer hardcoded superadmin credentials in Main.swf Google Dork: inurl:"/Main.swf?cachebuster=" need to manually look for stringtitle "Loading GSX Analyzer ... 0%" Date: 12-07-16 Exploit Author: ndevnull Vendor Homepage: http://www.gsx.com/products/gsx-analyzer Software Link:...

Microsoft Releases Security Updates

Microsoft has released 11 updates to address vulnerabilities in Microsoft software. Exploitation of one of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Microsoft Security Bulletins MS16-084 through...

91 Percent of Public-Facing ICS Components Are Remotely Exploitable

We live in an increasingly connected world, but even in an age when DDoS attacks can take entire airlines offline, many critically sensitive industrial control systems ICS are still connected to the internet. A pair of reports released today by Kaspersky Lab reveal how dire the situation really i...

INDAS Web SCADA Path Traversal Vulnerability

OVERVIEW Independent researcher Ehab Hussein of IOActive has identified a path traversal vulnerability in the INDAS Web SCADA application. INDAS has produced new software to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The following INDAS Web SCAD...

The Siemens power monitoring system there are two information disclosure security vulnerability-vulnerability warning-the black bar safety net

Positive Technologies security experts to review Siemens SICAM PASpower automation systemafter the solution is found, Siemens SICAM PAS, the presence of two information disclosure VulnerabilityCVE-2 0 1 6-5 ! Security experts to the West door company to report a safety issue, Siemens immediately...

Siemens Patches Password Reconstruction Vulnerability in SICAM PAS

The Industrial Control Systems Cyber Emergency Response Team ICS-CERT cautioned users who work in electrical substations to update certain builds of energy automation software this week. ICS-CERT claims two vulnerabilities exist in the Siemens SICAM Power Automation System, or PAS, that could...

Siemens SCALANCE M-800/S615 Web Vulnerability

OVERVIEW Siemens has identified a web security vulnerability in Siemen’s SCALANCE M-800 and S615 modules. This vulnerability was reported directly to Siemens by Alexander Van Maele and Tijl Deneut from HOWEST. Siemens has produced a new firmware version to mitigate this vulnerability. AFFECTED...

Moxa Active OPC Server Unquoted Service Path Escalation Vulnerability

OVERVIEW Independent researcher Zhou Yu has identified an unquoted service path escalation vulnerability in Moxa’s Active OPC Server application. Moxa has produced a new version to mitigate this vulnerability. Zhou Yu has tested the new version to validate that it resolves the vulnerability...

IRS Announces Safeguards to Protect Taxpayer Information

The Internal Revenue Service IRS has issued two news releases addressing new safeguards to protect taxpayers and strengthen authentication requirements. The electronic filing e-File PIN, an alternative signature verification tool used to assist with electronic tax filing, will no longer be...

Advantech Patches WebAccess Remote Code Execution Flaws

Advantech has published a new version of its WebAccess product to address vulnerabilities that put installations at risk to remote code execution attacks. Exploiting the vulnerabilities would be a challenge, however, according to an advisory published Tuesday by the Industrial Control Systems Cyb...

Advantech WebAccess ActiveX Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-173-01 Advantech WebAccess ActiveX Vulnerabilities that was published June 21, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 2 -------- Zhou Yu of Acorn Network Security and ZDI Zero...

Yokogawa STARDOM Authentication Bypass Vulnerability

OVERVIEW NCCIC/ICS-CERT received a report from Yokogawa and JPCERT/CChttp://jvn.jp/vu/JVNVU98542287/index.html about an authentication bypass vulnerability in the Yokogawa STARDOM controller. Yokogawa has produced a new release to mitigate this vulnerability. This vulnerability could be exploited...

Siemens ICS present in the device security validation vulnerability-vulnerability warning-the black bar safety net

! Recently,the German company Siemens to inform the user,due to ICSindustrial control systemdevice there is a security vulnerability,don't be networked use. The U.S. industrial control system computer Emergency Response TeamICS-CERTrecently said,in Siemens SIMATIC WinCCWindows Control...

Google Releases Security Update for Chrome

Google has released Chrome version 51.0.2704.103 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of one of these vulnerabilities may allow a remote attacker to obtain sensitive information from an affected system. US-CERT encourages users and administrators to review...

Bomgar Remote Support Unauthenticated Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Bomgar Remote Support Unauthenticated Code Execution', 'Description' = %q This module exploits a vulnerability in the Bomgar Remote...

Microsoft Releases June 2016 Security Bulletin

Microsoft has released 16 updates to address vulnerabilities in Microsoft software. Exploitation of some of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the following Microsoft Security Bulletins...

Siemens Firmware Updates Patch SIMATIC Vulnerabilities

Siemens has provided firmware updates addressing vulnerabilities in two popular products lines, the SIMATIC WinCC flexible, and the SIMATIC S7-300 CPU family. The SIMATIC S7-300 flaw is a denial-of-service issue that could be remotely exploited to cause the device to go into defect mode, an...

Netgear Router Update Removes Hardcoded Crypto Keys

Netgear has released firmware updates for two of its router products lines, patching vulnerabilities that were reported in January. Users should update to firmware version 1.0.0.59, which includes fixes for an authentication bypass vulnerability and also addresses a hard-coded cryptographic key...

VMware Releases Security Updates

VMware has released security updates to address vulnerabilities in NSX, vCNS and vRealize Log Insight. Exploitation of one of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review VMware Security Advisories...