MAC1100 PLC 信息泄露漏洞

The MAC1100 PLC is an industrial control product PLC. An information disclosure vulnerability exists in the EPA protocol of the MAC1100 PLC, which could allow an attacker to read a specific storage area and collect relevant device information in the PLC via an unauthorized EPA read operation, whi...

EPA scan getting failed through Safari Full Screen Mode on MacOS

When Safari browser is opened in Full Screen mode on MAC OS, The EPA Scan is getting failed. No issues with Safari in Window mode...

22-Year-Old Charged With Hacking Water System and Endangering Lives

A 22-year-old man from the U.S. state of Kansas has been indicted on charges that he unauthorizedly accessed a public water facility's computer system, jeopardizing the residents' safety and health in the local community. Wyatt A. Travnichek, 22, of Ellsworth County, Kansas, has been charged with...

EPA scan results are not getting displayed in ns.log when EPA policies are configured through N-Factor Authentication.

When EPA policies are configured through N-Factor Authentication, then EPA Scan results will not be displayed in the ns.log despite Debug log level is enabled...

How to collect data for ADC Authentication issues

To provide a comprehensive guide on how to properly collect data for issues with ADC when these issues are related to Authentication. Note that additional data may be needed for SAML, OAuth, client cert, device cert, and EPA...

gispub.epa.gov Improper Access Control vulnerability OBB-1372379

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

enviro.epa.gov Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1171337 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2019-17446

An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations scanning, can be used to start external programs with elevated permissions because of an Untrusted Search Path...

CVE-2019-17446

An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations scanning, can be used to start external programs with elevated permissions because of an Untrusted Search Path...

Path traversal

An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations scanning, can be used to start external programs with elevated permissions because of an Untrusted Search Path...

CVE-2019-17446

An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations scanning, can be used to start external programs with elevated permissions because of an Untrusted Search Path...

CVE-2019-17446

The CVE-2019-17446 issue affects Eracent EPA Agent up to version 10.2.26. The agent executable, when installed for non-root operations (scanning), can start external programs with elevated permissions due to an Untrusted Search Path. This is supported by multiple sources in connected documents (R...

CVE-2019-17445

An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26. The agent executable, when installed for non-root operations scanning, can be forced to copy files from the filesystem to other locations via Symbolic Link Following...

PostAuth EPA scan is not initiated with Advance session policies, however works with Classic policies

If the session profile is bound to the session profile with classic expression the EPA scan is initiated the client machine is checked for the EPA checks. If you use advance expression to bind session profile to the session policy, the EPA check will not be initiated and the users will be...

nepis.epa.gov Improper Access Control vulnerability

Open Bug Bounty ID: OBB-636721 Description| Value ---|--- Affected Website:| nepis.epa.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

Information Disclosure Vulnerability in DCCE MAC1100 PLCs

MAC1100 PLC programmable logic controller PLC is a product in the programmable logic controller PLC series of Dalian Computer Control DCCE. The product is widely used in intelligent buildings, power data monitoring, heat control system, enterprise management system and other important industrial...

nlquery.epa.gov XSS vulnerability

Open Bug Bounty ID: OBB-527304 Description| Value ---|--- Affected Website:| nlquery.epa.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

yosemite.epa.gov XSS vulnerability

Open Bug Bounty ID: OBB-489597 Description| Value ---|--- Affected Website:| yosemite.epa.gov Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure...

EPA for device certificate check fails on NetScaler

Users get the error "access denied" after EPA scan even with valid certificates available in the store...

search.epa.gov XSS vulnerability

Open Bug Bounty ID: OBB-407788 Description| Value ---|--- Affected Website:| search.epa.gov Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...