icsottocorno.gov.it XSS vulnerability

Open Bug Bounty ID: OBB-581294 Description| Value ---|--- Affected Website:| icsottocorno.gov.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

FireEye’s Marina Krotofil On Triton and ICS Threats

At the Security Analyst Summit this year in Cancun, FireEye’s Marina Krotofil talks about the Triton malware, first disclosed in December 2017, that targets industrial control systems. Krotofil discusses with Threatpost’s Lindsey O’Donnell about the implications of this malware for the...

ICSA-18-067-02_Siemens SIPROTEC 4, SIPROTEC Compact, and Reyrolle Devices using the EN100 Ethernet Communication Module Extension (Update B)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIPROTEC 4, SIPROTEC Compact, and Reyrolle devices using the EN100 Ethernet communication module extension Vulnerability: Missing Authentication for Critical Function 2. UPDATE...

ICSJWG Call for Abstracts

The Industrial Control Systems Joint Working Group ICSJWG—a collaborative and coordinating body operating under the Critical Infrastructure Partnership Advisory Council CIPAC framework—has issued a call for abstracts to be presented at the ICSJWG Spring Meeting in Albuquerque, New Mexico, April...

ics-web.sns.ornl.gov XSS vulnerability

Open Bug Bounty ID: OBB-557142 Description| Value ---|--- Affected Website:| ics-web.sns.ornl.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Mail.ru: CSRF на calendar.mail.ru

CSRF on ICS URI import in calendar.mail.ru Cцрф с обходом защиты через ORIGIN посредством размещения пока на одном из субдоменов...

Remote Code Execution on the Smiths Medical Medfusion 4000

Remote Code Execution on the Smiths Medical Medfusion 4000 In which we detail the process of vulnerability research on a life critical embedded system: a medical infusion pump. Table of Contents Remote Code Execution on the Smiths Medical Medfusion 4000 Table of Contents Summary Introduction Why ...

Siemens Desigo PXC (Update A)

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: Desigo PXC Vulnerability: Improper Authentication UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-18-025-02 Siemens Desigo PXC that was published January...

Advantech WebAccess/SCADA

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Advantech Equipment: WebAccess/SCADA Vulnerabilities: Path Traversal, SQL Injection AFFECTED PRODUCTS The following versions of WebAccess/SCADA, a SCADA software platform, are affected: WebAccess/SCADA versions prior ...

SUSE-SU-2018:0119-1 Recommended update for libical

This update for libical fixes the following issues: Security issues fixed: - CVE-2016-5823: The icalpropertynewclone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service use-after-free via a crafted ics file. bnc986632 - CVE-2016-5824: libical 1.0 allows remote...

Moxa MXview

CVSS v3 7.8 ATTENTION: Low skill level to exploit. Vendor: Moxa Equipment: MXview Vulnerability: Unquoted Search Path or Element. AFFECTED PRODUCTS The following versions of MXview, network management software, are affected: MXview v2.8 and prior. IMPACT Successful exploitation of this...

Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers

CVSS v3 8.6 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Rockwell Automation Equipment: Allen-Bradley MicroLogix 1400 Controllers Vulnerability: Buffer Overflow AFFECTED PRODUCTS The following versions of MicroLogix 1400 Controllers, a PLC, are affected: MicroLogix 1400...

ics-cleaners.be XSS vulnerability

Open Bug Bounty ID: OBB-459338 Description| Value ---|--- Affected Website:| ics-cleaners.be Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

ICSA-17-355-01_Moxa NPort W2150A and W2250A

CVSS v3 6.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Moxa Equipment: NPort W2150A and W2250A Vulnerability: Credentials Management AFFECTED PRODUCTS The following versions of NPort, a serial network interface, are affected: NPort W2150A Versions prior to 1.11, and NPort...

Siemens LOGO! Soft Comfort

CVSS v3 5.9 ATTENTION: Remotely exploitable. Vendor: Siemens Equipment: LOGO! Soft Comfort Vulnerability: Download of Code without Integrity Check AFFECTED PRODUCTS Siemens reports that the vulnerability affects the following LOGO! Soft Comfort engineering software products: LOGO! Soft Comfort: A...

PEPPERL+FUCHS/ecom instruments WLAN Capable Devices using the WPA2 Protocol

CVSS v3 8.1 ATTENTION: Low skill level is needed to exploit. Public exploits are available. Vendor: PEPPERL+FUCHS/ecom instruments Equipment: WLAN capable devices using the WPA2 Protocol Vulnerabilities: Reusing a Nonce AFFECTED PRODUCTS PEPPERL+FUCHS/ecom instruments reports that these...

WECON Technology Co., Ltd. LeviStudio HMI Editor

CVSS v3 7.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: WECON Technology Co., Ltd. WECON Equipment: LeviStudio HMI editor Vulnerability: Heap-based Buffer Overflow AFFECTED PRODUCTS All versions of LeviStudio HMI, an HMI editor, are affected. IMPACT Successful exploitation...

Ecava IntegraXor

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Ecava Equipment: IntegraXor Vulnerabilities: SQL Injection AFFECTED PRODUCTS The following version of IntegraXor, a web SCADA/HMI solution, is affected: Ecava IntegraXor v 6.1.1030.1 and prior. IMPACT Successful...

ABB Ellipse

CVSS v3 6.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: ABB Equipment: Ellipse Vulnerability: Unprotected Transport of Credentials AFFECTED PRODUCTS ABB reports that the vulnerability affects Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 including Ellipse...

TRITON Malware Targeting Critical Infrastructure Could Cause Physical Damage

Security researchers have uncovered another nasty piece of malware designed specifically to target industrial control systems ICS with a potential to cause health and life-threatening accidents. Dubbed Triton, also known as Trisis, the ICS malware has been designed to target Triconex Safety...