CVE-2012-6441 Rockwell Automation ControlLogix PLC Information Exposure

An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP. Successful exploitation of this vulnerability could cause loss of confidentiality. Rockwell Automation EtherNet/I...

CVE-2012-6437 Rockwell Automation ControlLogix PLC Improper Authentication

The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or legitimate firmware image. Successful exploitation of this vulnerability could cause loss of availability, integrity, and...

PT-2013-1950

Name of the Vulnerable Software and Affected Versions Rockwell Automation EtherNet/IP products versions 18 and earlier Rockwell Automation EtherNet/IP products versions 19 and earlier Rockwell Automation EtherNet/IP products versions 20 and earlier 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB...

PT-2013-1948

Name of the Vulnerable Software and Affected Versions Rockwell Automation EtherNet/IP products versions prior to the fixed version 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules versions prior to the fixed version CompactLogix L32E and L35E controllers versions prior to the...

PT-2013-1944

Name of the Vulnerable Software and Affected Versions Rockwell Automation EtherNet/IP products versions prior to the fixed version Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules versions prior to the fixed version Rockwell Automation CompactLogix L32E and...

Cisco Wireless LAN Controllers Wireless Intrusion Prevention System Denial of Service Vulnerability

Cisco Wireless LAN Controllers WLC Wireless Intrusion Prevention System wIPS contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper handling of crafted IP packets by the wIPS software component...

Multiple Vulnerabilities in Cisco Wireless LAN Controllers

The Cisco Wireless LAN Controller Cisco WLC product family is affected by the following four vulnerabilities: Cisco Wireless LAN Controllers Wireless Intrusion Prevention System wIPS Denial of Service Vulnerability Cisco Wireless LAN Controllers Session Initiation Protocol Denial of Service...

VSS Errors Related to the 'NTDS' VSS Writer

Challenge This article discusses an error that occurs due to VSS and Veeam's Guest Processing technique for Domain Controllers. It is relevant to all backup jobs for both virtual and physical Domain Controllers. A job processing a Domain Controller with Application-Aware Processing fails with one...

SIEMENS Sipass Integrated 2.6 Ethernet Bus - Arbitrary Pointer Dereference

SIEMENS Sipass Integrated 2.6 Ethernet Bus - Arbitrary Pointer Dereference IOActive Security Advisory Title: SIEMENS Sipass Integrated 2.6 Ethernet Bus Arbitrary Pointer Dereference Severity: Critical Discovered by: Lucas Apa Date Reported: 09/11/12 CVE: TBD Siemens Advisory: SSA-938777...

DHS Warns ICS, SCADA Owners About Increase in Malicious Activity

An alert from the Department of Homeland Security late last week urges private- and public-sector industrial control system ICS owners to be proactive in auditing the security, particularly, authentication controls of their systems. The alert is in response to a growing concern over the number of...

3S CoDeSys Vulnerabilities

Overview This advisory is a follow-up to the alert update, ICS-ALERT-11-336-01A 3S CoDeSys Vulnerabilities, which was released on the ICS-CERT Web page on December 02, 2011. Security researcher Celil Unuver SignalSec LLC and independent researcher Luigi Auriemma have identified vulnerabilities in...

CVE-2010-5278: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter. NOTE: some of these details are obtaine...

Sql injection

SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL commands via vectors involving the sortcol variable in the listitems function, a different vulnerability than CVE-2012-3477...

PT-2012-5540

Name of the Vulnerable Software and Affected Versions NeoInvoice affected versions not specified Description The issue is related to a SQL injection vulnerability in the application/controllers/invoice.php file. This vulnerability might allow remote attackers to execute arbitrary SQL commands via...

CVE-2012-4673: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL commands via vectors involving the sortcol variable in the listitems function, a different vulnerability than CVE-2012-3477...

CVE-2011-5097

chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to 1 upload cookbooks via a knife cookbook upload command or 2 delete...

CVE-2011-5098

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the...

CVE-2011-5098: Undefined Security Weakness

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the...

Scientific Linux Security Update : ipa on SL6.x i386/x86_64

This Identity Management Application is a centralized authentication, identity management and authorization solution for both traditional and cloud based enterprise environments. It integrates components of the Upstream Directory Server, MIT Kerberos, the Upstream Certificate System, NTP, and DNS...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64

The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : - Multiple buffer overflow flaws were found in the Linux kernel's Management Module Support for Message Passing Technology MPT based controllers. A local,...