CVE-2020-13504

Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. An attacker can send unauthenticated HTTP requests to trigger this vulnerability...

CVE-2020-13499: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter InstancePath in CHaD.asmx is vulnerable to unauthenticate...

PT-2020-13577

Name of the Vulnerable Software and Affected Versions eDNA Enterprise Data Historian version 3.0.1.2/7.5.4989.33053 Description A SQL injection issue exists in the CHaD.asmx web service functionality. Specially crafted SOAP web requests can cause SQL injections, resulting in data compromise. The...

PT-2020-13581

Name of the Vulnerable Software and Affected Versions ednareporting.asmx affected versions not specified Description The issue concerns an unauthenticated SQL injection vulnerability. Specifically, the AttFilterValue parameter in the ednareporting.asmx service is vulnerable to SQL injection...

PT-2020-13576

Name of the Vulnerable Software and Affected Versions eDNA Enterprise Data Historian version 3.0.1.2/7.5.4989.33053 Description An SQL injection issue exists in the CHaD.asmx web service functionality. Specially crafted SOAP web requests can cause SQL injections, resulting in data compromise. The...

PT-2020-13578

Name of the Vulnerable Software and Affected Versions eDNA Enterprise Data Historian version 3.0.1.2/7.5.4989.33053 Description An SQL injection issue exists in the CHaD.asmx web service functionality. Specially crafted SOAP web requests can cause SQL injections, resulting in data compromise. The...

CVE-2020-13500: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter ClassName in CHaD.asmx is vulnerable to unauthenticated SQL...

CVE-2020-13504: Improper Neutralization of Special Elements used in an SQL Command

Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. An attacker can send unauthenticated HTTP requests to trigger this vulnerability...

CVE-2020-13505: Improper Neutralization of Special Elements used in an SQL Command

Parameter psClass in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. An attacker can send unauthenticated HTTP requests to trigger this vulnerability...

PT-2020-13582

Name of the Vulnerable Software and Affected Versions ednareporting.asmx affected versions not specified Description The issue allows for unauthenticated SQL injection attacks through the psClass parameter in the ednareporting.asmx service. An attacker can send specially crafted SOAP web requests...

CVE-2020-13501: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter InstanceName in CHaD.asmx is vulnerable to unauthenticate...

CISA: LokiBot Stealer Storms Into a Resurgence

The U.S. Cybersecurity and Infrastructure Security Agency CISA is warning that the LokiBot info-stealing trojan is seeing a surge across the enterprise landscape. The uptick started in July, according to the agency, and activity has remained “persistent” ever since. LokiBot targets Windows and...

Aveva eDNA Enterprise data historian DNAPoints.asmx SQL injection vulnerability

Talos Vulnerability Report TALOS-2020-1107 Aveva eDNA Enterprise data historian DNAPoints.asmx SQL injection vulnerability September 23, 2020 CVE Number CVE-2020-13502 Summary An exploitable SQL injection vulnerability exists in the DNAPoints.asmx web Service functionality of eDNA Enterprise Data...

Aveva eDNA Enterprise Data Historian FavoritesService.asmx SQL injection Vulnerability

Talos Vulnerability Report TALOS-2020-1097 Aveva eDNA Enterprise Data Historian FavoritesService.asmx SQL injection Vulnerability September 23, 2020 CVE Number CVE-2020-6153 Summary An exploitable SQL injection vulnerability exists in the FavoritesService.asmx Web Service functionality of eDNA...

Consumer advice: Giggle vulnerability

Another week passes and another organisation chooses to deny a critical vulnerability in their site rather than fix it. I’m talking of course about Giggle, the social network site designed as a safe space for women to, “give girls choice, control, consent and connection”. If you are not aware, ov...

Malicious Package in radic-util

Version 1.0.2 of radic-util contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate you...

Malicious Package in react-datepicker-plus

Versions 2.4.3 and 2.4.2 of react-datepicker-plus contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your...

GHSA-4WCX-C9C4-89P2 Malicious Package in react-datepicker-plus

Versions 2.4.3 and 2.4.2 of react-datepicker-plus contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your...

GHSA-5W4R-WWC3-6QCP Malicious Package in precode.js

Version 1.1.1 of precode.js contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate you...

Malicious Package in scroool

Version 0.1.7 of scroool contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate your...