CVE-2011-4513

Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 aka TIA portal; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allow user-assisted remote attackers to execute arbitrary code via a crafted project file,...

KLA10394 Multiple vulnerabilities in Siemens

Multiple critical vulnerabilities have been found in Siemens products. Malicious users can exploit these vulnerabilities to read & modify arbitrary files, cause denial of service, execute arbitrary code, bypass authentication, obtain access and inject arbitrary HTTP headers. Below is a complete...

Multiple Siemens SIMATIC Products Authentication Bypass Vulnerabilities

Multiple Siemens SIMATIC products are affected by vulnerabilities that allow attackers to bypass authentication. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Arc Informatique产品多个ActiveX控件漏洞

CVE ID: CVE-2011-4042,CVE-2011-4043,CVE-2011-4044,CVE-2011-4045 ARC Informatique是开发人机接口、监控和数据捕获HMI/SCADA软件的法国公司。 多个Arc Informatique产品在实现上存在多个安全漏洞，可被恶意用户利用操作某些数据并控制用户系统。 1）处理"SaveObject"和"LoadObject"方法SVUIGrd.ocx时存在的错误可被利用通过特制的"aStream"参数执行虚拟函数调用任意内存位置； 2）"GetExtendedColor"方法SVUIGrd.ocx中的错误可被利用破坏内...

Smart Software Solutions CoDeSys Webserver URI Copying Stack Buffer Overflow

Added: 12/16/2011 CVE: CVE-2011-5007 BID: 50849 OSVDB: 77387 Background Smart Software Solutions GmbH 3S manufactures CoDeSys Web Server, a Supervisory Control and Data Acquisition/Human-Machine Interface SCADA/HMI product. The SCADA Web Server listens on TCP port 8080. Problem The CmpWebServer.d...

Was The Three Character Password Used To Hack South Houston's Water Treatment Plant A Siemens Default?

Siemens said on Tuesday that it is working with the U.S. Department of Homeland Security to investigate a cyber intrusion into a water treatment plant in South Houston, Texas, but couldn’t confirm that a default, three digit password hard coded into an application used to control the company’s...

optima apiftp server 1.5.2.13 - Multiple Vulnerabilities

Luigi Auriemma Application: Optima APIFTP Server http://www.optimalog.com/home.html Versions: = 1.5.2.13 Platforms: Windows Bugs: A NULL pointer B endless loop Exploitation: remote Date: 13 Nov 2011 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bugs 3 The Co...

BroadWin Webaccess SCADA/HMI Client - Remote Code Execution

BroadWin WebAccess SCADA/HMI Remote Code Execution Vulnerability 0day WebAccess is the first fully web browser-based software package for human-machine interfaces HMI, and supervisory control and data acquisition SCADA. bwocxrun.ocx ActiveX component is prone to a remote code execution...

BroadWin Webaccess SCADAHMI Client - Remote Code Execution

BroadWin Webaccess SCADAHMI Client - Remote Code Execution BroadWin WebAccess SCADA/HMI Remote Code Execution Vulnerability 0day WebAccess is the first fully web browser-based software package for human-machine interfaces HMI, and supervisory control and data acquisition SCADA. bwocxrun.ocx Activ...

BroadWin WebAccess SCADA/HMI Client Remote Code Execution

Exploit for windows platform in category remote exploits BroadWin WebAccess SCADA/HMI Remote Code Execution Vulnerability 0day WebAccess is the first fully web browser-based software package for human-machine interfaces HMI, and supervisory control and data acquisition SCADA. bwocxrun.ocx ActiveX...

BroadWin WebAccess SCADA / HMI Code Execution

BroadWin WebAccess SCADA/HMI Client Remote Code Execution Vulnerability 0day WebAccess is the first fully web browser-based software package for human-machine interfaces HMI, and supervisory control and data acquisition SCADA. bwocxrun.ocx ActiveX component is prone to a remote code execution...

Sielco Sistemi WinLog Stack Overflow

Overview Independent researcher Luigi Auriemma reported a stack overflow vulnerability in Version 2.07.00 of the Sielco Sistemi WinLog Lite and Winlog Pro HMI software. Sielco Sistemi has developed an update Version 2.07.01 to address this vulnerability. The researcher has verified that the updat...

PROMOTIC SCADA/HMI Webserver Directory Traversal Vulnerability

The host is running PROMOTIC SCADA/HMI Webserver and is prone to directory traversal vulnerability. OpenVAS Vulnerability Test $Id: gbpromoticscadahmiserverdirtravvuln.nasl 7052 2017-09-04 11:50:51Z teissa $ PROMOTIC SCADA/HMI Webserver Directory Traversal Vulnerability Authors: Veerendra G.G...

PROMOTIC SCADA/HMI Webserver Directory Traversal Vulnerability

PROMOTIC SCADA/HMI Webserver is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sunway ForceControl SNMP NetDBServer Signed Integer Buffer Overflow

Added: 09/29/2011 BID: 49747 OSVDB: 75798 Background Sunway ForceControl is a Chinese SCADA/HMI software application widely used in China to help run weapons systems, utilities and chemical plants. It is also used to a lesser extent in other countries, including the US. SNMP NetDBServer is one of...

Siemens Simatic HMI Authentication Vulnerabilities

Overview ICS-CERT is aware of a public report by independent security researchers Billy Rios and Terry McCorkle concerning authentication bypass vulnerabilities affecting Siemens SIMATIC HMI products which are supervisory control and data acquisition/human-machine interface SCADA/HMI products...

sunway ForceControl 6.1 sp3 - Multiple Vulnerabilities

sunway ForceControl 6.1 sp3 - Multiple Vulnerabilities Luigi Auriemma Application: Sunway ForceControl http://www.sunwayland.com.cn/pro.asp Versions: B9 19000000 MOV ECX,19 004022E6 . 33C0 XOR EAX,EAX 004022E8 . 8D7C24 24 LEA EDI,DWORD PTR SS:ESP+24 004022EC . 83FE 64 CMP ESI,64 ; our value...

sunway ForceControl 6.1 sp3 - Multiple Vulnerabilities

Luigi Auriemma Application: Sunway ForceControl http://www.sunwayland.com.cn/pro.asp Versions: B9 19000000 MOV ECX,19 004022E6 . 33C0 XOR EAX,EAX 004022E8 . 8D7C24 24 LEA EDI,DWORD PTR SS:ESP+24 004022EC . 83FE 64 CMP ESI,64 ; our value 004022EF . F3:AB REP STOS DWORD PTR ES:EDI 004022F1 . 0F8D...

DaqFactory HMI NETB Request Overflow

$Id: daqfactorybof.rb 13756 2011-09-19 11:38:49Z swtornio $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

0-Day SCADA Exploits Publicly Exposed by Italian researchers

0-Day SCADA Exploits Publicly Exposed by Italian researchers An Italian researcher has uncovered at least a dozen security flaws in software used in utilities and other critical infrastructure systems, prompting security advisories from the U.S. government. Security researcher Luigi Auriemma...