Network Time Protocol Vulnerabilities (Supplement Update A)

OVERVIEW --------- Begin Update A Part 1 of 2 -------- This advisory supplement is to accompany the NCCIC/ICS-CERT advisory titled ICSA-14-353-01C Network Time Protocol Vulnerabilities that was published February 5, 2015, on the ICS‑CERT web site. --------- End Update A Part 1 of 2 ----------...

Ecava IntegraXor DLL Vulnerabilities

OVERVIEW Security researcher Praveen Darshanam has identified two DLL loading vulnerabilities in Ecava’s IntegraXor SCADA Server. Ecava has produced a patch that mitigates these vulnerabilities. Praveen Darshanam has tested the patch to validate that it resolves the vulnerabilities. AFFECTED...

Ecava IntegraXor Guest Acccount Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ecava IntegraXor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the "guest" user. The issue lies in the ability the retrieve all...

Ecava IntegraXor < 4.2.4458 Multiple Vulnerabilities

Binary data scadaintegraxor424458.nbin...

Ecava IntegraXor < 3.6.4000.1 Directory Traversal

Binary data 8405.prm...

Ecava IntegraXor < 3.60.4081 Path Subversion Arbitrary DLL Injection Code Execution

Binary data 8403.prm...

Ecava IntegraXor < 3.5.3900.10 Buffer Overflow

Binary data 8404.prm...

Ecava IntegraXor < 3.60.4050 Unspecified SQL Injection

Binary data 8402.prm...

Ecava IntegraXor < 4.2.4458 Multiple Vulnerabilities

Binary data 8400.prm...

Ecava IntegraXor < 3.60.4080 Cross-Site Scripting

Binary data 8401.prm...

Ecava IntegraXor < 4.1.4390 Buffer Overflow

Binary data 8398.prm...

Ecava IntegraXor < 3.71.4200 Directory Traversal

Binary data 8399.prm...

Ecava IntegraXor < 4.1.4369 Project Directory Information Disclosure

Binary data 8397.prm...

CVE-2014-2377

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag...

CVE-2014-2376

SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-2375

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service disk consumption, via the CSV export feature...

Code injection

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag...

Sql injection

SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-2375

CVE-2014-2375 affects Ecava IntegraXor SCADA Server (Stable 4.1.4360 and earlier; Beta 4.1.4392 and earlier) via the CSV export feature, which allows an unauthenticated user to read or write arbitrary files and potentially cause a denial of service. The root cause is External Control of File Name...

CVE-2014-2377

The CVE-2014-2377 entry affects Ecava IntegraXor SCADA Server versions 4.1.4360 and earlier (stable) and 4.1.4392 and earlier (beta), where built-in application tags can disclose full pathnames via environmental variables, enabling information exposure. Affected component: IntegraXor SCADA Server...