Siemens RUGGEDCOM ROX-based Devices NTP Vulnerabilities

OVERVIEW Siemens has reported to NCCIC/ICS-CERT that NTP daemon vulnerabilities exist in the Siemens RUGGEDCOM ROX-based devices. Siemens has produced firmware updates to mitigate these vulnerabilities. These vulnerabilities could be exploited remotely. AFFECTED PRODUCTS The following Siemens...

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise Remote Code Execution Vulnerability

GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise are both products of General Electric Company GE, U.S.A. GE Digital Energy MDS PulseNET is a suite of software applications for monitoring and controlling industrial communication network devices. Enterprise is an enterprise version of MD...

Schneider Electric Modicon M340 Buffer Overflow Vulnerability

OVERVIEW David Atch of CyberX has identified a buffer overflow vulnerability in Schneider Electric’s Modicon M340 PLC product line. Schneider Electric has produced a new firmware patch to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS Schneider...

CVE-2015-3962

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...

Code injection

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...

CVE-2015-3962

Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remote attackers to discover credentials by sniffing the network...

CVE-2015-3962

Schneider Electric StruxureWare Building Expert MPM before version 2.15 is affected by a cleartext transmission vulnerability (CWE-319) where the client–server data stream is not encrypted, enabling remote attackers to discover user credentials by sniffing traffic. The issue affects StruxureWare ...

Schneider Electric StruxureWare Building Expert Security Patch

Industrial control manufacturer Schneider Electric has published new firmware for its StruxureWare Building Expert building automation system that patches a remotely exploitable vulnerability. Researcher Artyom Kurbatov discovered that the system transmits user credentials in plaintext between th...

Schneider Electric Modicon PLC File Containment Vulnerability

Modicon PLCs are programmable controller products used in industries such as dams, energy, food and agriculture, and more. Modicon PLCs are implemented with a file inclusion vulnerability that can be exploited by an attacker to construct a specific URL that can be used to load Java script through...

Schneider Electric ProClima ActiveX Control Vulnerabilities

OVERVIEW Ariele Caltabiano, working with HP’s Zero Day Initiative, has identified 11 remote code execution vulnerabilities in Schneider Electric’s ProClima F1 Bookview ActiveX control application. Schneider Electric has produced an update to mitigate these vulnerabilities. These vulnerabilities...

Schneider Electric Modicon M340 PLC Station P34模块Web Servers安全漏洞

漏洞详情：Schneider Electric Modicon M340 PLC Station P34 module是法国施耐德电气（Schneider Electric）公司的一款可编程控制器。Schneider Electric Modicon M340 PLC Station P34模块中存在安全漏洞。远程攻击者可利用该漏洞获取敏感信息，在Web服务器进程上下文中执行任意代码，绕过身份验证机制，获取受影响设备的访问权限。漏洞类型远程利用影响硬编码身份认证是远程代码执行本地文件包含否目录遍历/文件篡改远程代码包含是远程代码执行/拒绝服务攻击跨站脚本攻击是获取敏感信息影响设备版本：...

Multiple Vulnerabilities in Schneider Electric Modicon M340 PLC Station P34 Module Modicon

The Schneider Electric Modicon M340 PLC is a mid-sized PLC platform for industrial processes and architectures. Multiple security vulnerabilities exist in the Modicon M340 PLC Station P34 module. Exploitation of these vulnerabilities could allow a remote attacker to obtain sensitive information o...

Electric Sheep Fencing pfsense cross-site scripting vulnerability (CNVD-2015-05672)

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A cross-site scripting vulnerability exists in Electric Sheep Fencing pfsense, which can be exploited by remote attackers to inject arbitrary Web script or HTML...

Electric Sheep Fencing pfsense cross-site scripting vulnerability (CNVD-2015-05673)

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A cross-site scripting vulnerability exists in Electric Sheep Fencing pfsense, which can be exploited by remote attackers to inject arbitrary Web script or HTML...

Electric Sheep Fencing pfsense cross-site scripting vulnerability

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A cross-site scripting vulnerability exists in Electric Sheep Fencing pfsense versions prior to 2.2.3, which stems from the systemauthservers.php script failing to...

InduSoft Web Studio Information Disclosure Vulnerability (Aug 2015) - Windows

InduSoft Web Studio is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Schneider Electric Modicon M340 PLC Station P34 Module HMI Vulnerabilities

Update Vulnerabilities in Schneider Electric SCADA gear remain unpatched close to two weeks after they were disclosed during DEF CON. The Industrial Control System Cyber Emergency Response Team ICS-CERT released an alert late last week and patches are currently being validated according to ICS-CE...

Schneider Electric InduSoft Web Studio < 7.1.3.5 Local Plaintext Password Information Disclosure (SEVD-2015-100-01)

Binary data scadaindusoftwebstudioSEVD2015-100-01.nbin...

Electric Sheep Fencing Pfsense 'zone' Parameter Cross-Site Scripting Vulnerability

Electric Sheep Fencing pfsense is a free and open source FreeBSD-based firewall and router software from Electric Sheep Fencing. A cross-site scripting vulnerability exists in Electric Sheep Fencing Pfsense that stems from the program's failure to adequately filter user-submitted input. When a us...

Trust Management Vulnerabilities in Multiple GE Products (CNVD-2015-05132)

GE Healthcare Millennium MG, NC and MyoSIGHT are General Electric GE scanning camera products for the healthcare industry. A security vulnerability exists in multiple GE products that stems from the use of 'insite.genieacq' which cannot be changed unless the program disables remote InSite-support...