CVE-2017-2687

Siemens RUGGEDCOM ROX I all versions contain a vulnerability in the integrated web server at port 10000/TCP which is prone to reflected Cross-Site Scripting attacks if an unsuspecting user is induced to click on a malicious link...

CVE-2017-6864

CVE-2017-6864 affects Siemens RUGGEDCOM ROX I devices (all versions) via the integrated web server on port 10000/TCP. An authenticated user can perform stored Cross-Site Scripting attacks against the web interface. The CVE is documented in multiple sources (NVD entry and related advisories). The ...

CVE-2017-2686

Siemens RUGGEDCOM ROX I all versions contain a vulnerability that could allow an authenticated user to read arbitrary files through the web interface at port 10000/TCP and access sensitive information...

CVE-2017-2689

CVE-2017-2689 affects Siemens RUGGEDCOM ROX I (all versions). An authenticated user can bypass access restrictions in the web interface on port 10000/TCP to obtain privileged file-system access or change configuration settings. Root cause: Improper Authorization (CWE-285) with CVSS v3 base score ...

CVE-2017-2688

The CVE-2017-2688 entry affects Siemens RUGGEDCOM ROX I (all versions) via the integrated web server on port 10000/TCP. The issue is a Cross-Site Request Forgery (CSRF) where an authenticated user who has an active session can be induced to click a malicious link or visit a malicious site, allowi...

Siemens RUGGEDCOM ROX I Arbitrary File Read Vulnerability

Siemens RuggedCom ROX-based firewall devices are used for device connectivity in harsh environments, such as substations, traffic management chassis, and more. An arbitrary file read vulnerability exists in Siemens RUGGEDCOM ROX I, which can be exploited by an attacker to read arbitrary files for...

Siemens RUGGEDCOM ROX I Cross-Site Scripting Vulnerability

Siemens RuggedCom ROX-based firewall devices are used for device connectivity in harsh environments, such as substations, traffic management chassis, and more. A cross-site scripting vulnerability exists in Siemens RUGGEDCOM ROX I, which can be exploited by an attacker to conduct a cross-site...

Siemens RUGGEDCOM ROX I Cross-Site Scripting Vulnerability (CNVD-2017-03649)

Siemens RuggedCom ROX-based firewall devices are used for device connectivity in harsh environments, such as substations, traffic management chassis, and more. A cross-site scripting vulnerability exists in Siemens RUGGEDCOM ROX I, which can be exploited by an attacker to conduct cross-site...

Siemens RUGGEDCOM ROX I Elevation of Privilege Vulnerability

Siemens RuggedCom ROX-based firewall devices are used for device connectivity in harsh environments, such as substations, traffic management chassis, and more. An elevation of privilege vulnerability exists in Siemens RUGGEDCOM ROX I, which can be exploited by an attacker to perform arbitrary...

Siemens RUGGEDCOM ROX I

CVSS v3 8.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: RUGGEDCOM ROX I Vulnerabilities: Improper Authorization, Cross-Site Scripting, and Cross-Site Request Forgery AFFECTED PRODUCTS Siemens reports that the vulnerability affects the following RUGGEDCOM...

FalconGate - A smart gateway to stop hackers and Malware attacks

A smart gateway to stop hackers, Malware and more... Motivation Cyber attacks are on the raise. Hacker and cyber criminals are continuously improving their methods and building new tools and Malware with the purpose of hacking your network, spying on you and stealing valuable data. Recently a new...

CVE-2016-9245

In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "Normalize URI" configuration options used in...

ACTi cameras models from the D, B, I, and E series contain multiple security vulnerabilities

Overview According to the reporter, ACTi devices including D, B, I, and E series models using firmware version A1D-500-V6.11.31-AC are vulnerable to several issues. Description According to the reporter, multiple ACTi devices, including the D, B, I, and E series models, that use firmware version...

I-FTP 2.20 Schedule Buffer Overflow

A stack buffer overflow vulnerability has been reported in i-FTP 2.20. The vulnerability is due to a lack of boundary check when handling Schedule.xml file. Successful exploitation could allow arbitrary code execution in the context of the target user...

Multiple I-O DATA network camera products vulnerable to OS command injection

Overview Multiple network camera products provided by I-O DATA DEVICE, INC. contain an OS command injection vulnerability. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported respective vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Earl...

Multiple I-O DATA network camera products vulnerable to HTTP header injection

Overview Multiple network camera products provided by I-O DATA DEVICE, INC. contain a HTTP header injection vulnerability. Takayoshi Isayama of Mitsui Bussan Secure Directions, Inc. reported respective vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Ear...

openSUSE Security Update : the Linux Kernel (openSUSE-2017-287)

The openSUSE Leap 42.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-6074: The dccprcvstateprocess function in net/dccp/input.c in the Linux kernel mishandled DCCPPKTREQUEST packet data structures in the LISTEN state, which allowe...

i-appoint.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-215063 Description| Value ---|--- Affected Website:| i-appoint.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Security update for the Linux Kernel (important)

The openSUSE Leap 42.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-6074: The dccprcvstateprocess function in net/dccp/input.c in the Linux kernel mishandled DCCPPKTREQUEST packet data structures in the LISTEN state, which allowed...

i-learner.com.hk XSS vulnerability

Vulnerable URL: http://www.i-learner.com.hk/newindex.php?msgerror=OPENBUGBOUNTY&type=wrong1 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 86656 VIP website status:| No Check i-learner.com.hk SSL connection:|...