Invensys Wonderware InTouch 10 DLL Hijack

Overview ICS-CERT originally released Advisory ICSA-12-177-01P on the US-CERT Portal on July 05, 2012. This web page release was delayed to provide the vendor time to contact customers concerning this information. Independent researcher Carlos Mario Penagos Hollmann has identified an uncontrolled...

CVE-2008-2005

The SuiteLink Service aka slssvc.exe in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service NULL pointer dereference and service shutdown and possibly execute arbitrary code via a large length value in a Registration...

CVE-2008-2005: Undefined Security Weakness

The SuiteLink Service aka slssvc.exe in WonderWare SuiteLink before 2.0 Patch 01, as used in WonderWare InTouch 8.0, allows remote attackers to cause a denial of service NULL pointer dereference and service shutdown and possibly execute arbitrary code via a large length value in a Registration...

Wonderware SuiteLink Denial of Service vulnerability

Advisory ID Internal CORE-2008-0129 1. Advisory Information Title: Wonderware SuiteLink Denial of Service vulnerability Advisory ID: CORE-2008-0129 Advisory URL:https://www.coresecurity.com/content/wonderware Date published: 2008-05-05 Date of last update: 2008-05-05 Vendors contacted: Wonderware...

Code injection

Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions Everyone/Full Control, which allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs...

CVE-2007-6033

Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions Everyone/Full Control, which allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs...

CVE-2007-6033

Invensys Wonderware InTouch 8.0 is affected by an insecure NetDDE share that grants Everyone/Full Control, enabling remote authenticated (and possibly anonymous) attackers to execute arbitrary programs. The root cause is the NetDDE share permissions misconfiguration, allowing remote code executio...

PT-2007-6950 · Invensys · Invensys Wonderware Intouch

Name of the Vulnerable Software and Affected Versions: Invensys Wonderware InTouch version 8.0 Description: The issue allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs due to insecure permissions set on a NetDDE share. Recommendations: For Invensys...

Invensys Wonderware InTouch默认统一NetDDE共享特权提升漏洞

Vulnerability Note VU138633 Invensys Wonderware InTouch creates insecure NetDDE share Invensys Wonderware InTouch是一款生产过程中自动化监控系统中的应用。 Invensys Wonderware InTouch对NetDDE共享的默认权限设置存在问题，本地攻击者可以利用漏洞提升特权。 动态数据交换DDE设计允许Microsoft windows应用程序共享数据。NetDDE是Wonderware开发的DDE扩展。InTouch...

CVE-2007-6033: Incorrect Permission Assignment for Critical Resource

Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions Everyone/Full Control, which allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs...

Invensys Wonderware InTouch creates insecure NetDDE share

Overview Invensys Wonderware InTouch 8.0 creates a NetDDE share that could allow an attacker to run arbitrary programs. Description Invensys Wonderware InTouch HMI Software is used in Supervisory Control And Data Acquisition SCADA systems.Dynamic Data Exchange DDE was designed to allow Microsoft...

CVE-2006-0088

SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter...

CVE-2006-0088

The CVE-2006-0088 entry concerns InTouch 0.5.1 Alpha, where an SQL injection vulnerability in intouch.lib.php allows remote attackers to execute arbitrary SQL commands via the user parameter. The connected advisories corroborate this by describing an SQL injection in InTouch (Ver2) and noting the...

CVE-2006-0088

SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter...

CVE-2006-0088: Undefined Security Weakness

SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter...

EV0008.txt

New eVuln Advisory: inTouch Authentication Bypass --------------------Summary---------------- Software: inTouch http://intouch.sourceforge.net/ Versions: 0.5.1 Alpha Critical Level: Moderate Type: SQL Injection Class: Remote Status: Unpatched Exploit: Available Solution: Not Available Discovered...

[eVuln] inTouch Authentication Bypass

New eVuln Advisory: inTouch Authentication Bypass --------------------Summary---------------- Software: inTouch http://intouch.sourceforge.net/ Versions: 0.5.1 Alpha Critical Level: Moderate Type: SQL Injection Class: Remote Status: Unpatched Exploit: Available Solution: Not Available Discovered...