LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA

CVSS v3 7.3 ATTENTION: Low skill level to exploit. Vendor: LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME Equipment: LAquis SCADA Vulnerability: Improper Access Control AFFECTED PRODUCTS The following versions of LAquis SCADA, an industrial automation software, are affected: LAquis...

Cisco Prime Infrastructure API Credentials Management Vulnerability

A vulnerability in the APIs for Cisco Prime Infrastructure could allow an authenticated, remote attacker to access an API that should be restricted to a privileged user. The attacker needs to have valid credentials. The vulnerability is due to a lack of proper role-based access control RBAC for...

FATEK Automation PLC Ethernet Module

CVSS v3 7.3 ATTENTION: Remotely exploitable. Low skill level to exploit. Vendor: FATEK Automation Equipment: PLC Ethernet Module Vulnerability: Stack-based buffer overflow AFFECTED PRODUCTS The affected Ethercfg software configuration tool runs on the following Fatek PLCs: CBEH versions prior to...

Schneider Electric ClearSCADA

CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Schneider Electric Equipment: ClearSCADA Vulnerability: Improper Input Validation AFFECTED PRODUCTS The following versions of ClearSCADA, server and communications driver processes, are affected: All supported version...

CVE-2016-9164

Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management formerly CA Nimsoft Monitor 8.4 SP1 and earlier and CA Unified Infrastructure Management Snap formerly CA Nimsoft Monitor Snap allows remote attackers to read arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management formerly CA Nimsoft Monitor 8.4 SP1 and earlier and CA Unified Infrastructure Management Snap formerly CA Nimsoft Monitor Snap allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2016-9164

Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management formerly CA Nimsoft Monitor 8.4 SP1 and earlier and CA Unified Infrastructure Management Snap formerly CA Nimsoft Monitor Snap allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2016-9164

CA Unified Infrastructure Management (UIM) diag.jsp contains a directory traversal vulnerability (CVE-2016-9164) that allows remote, unauthenticated attackers to read arbitrary files. Affected products include UIM 8.4 SP1 and earlier (and CA UIM Snap), with disclosures indicating the issue exists...

CVE-2016-9164

Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management formerly CA Nimsoft Monitor 8.4 SP1 and earlier and CA Unified Infrastructure Management Snap formerly CA Nimsoft Monitor Snap allows remote attackers to read arbitrary files via unspecified vectors...

Scientific Linux Security Update : ipa on SL7.x x86_64 (20170302)

Security Fixes : - It was found that IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service proble...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability (cisco-sa-20170301-cpi)

A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. SPDX-FileCopyrightText: 2017 Greenbone AG Some text...

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability

A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web interface of the affected system. The vulnerability is due to insufficient input validati...

Researchers Uncover New Leads Behind Shamoon2

In a fresh analysis of the Shamoon2 malware, researchers from Arbor Networks’ Security Engineering and Response Team ASERT say they have unearthed new leads on the tools and techniques used in the most recent wave of attacks. Shamoon2 surfaced in November, approximately four years after the...

SPARTA - Network Infrastructure Penetration Testing Tool

SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenien...

First Practical SHA-1 Collision Attack Arrives

Researchers unveiled on Thursday the first practical collision attack for the 22-year old cryptographic hash function SHA-1. While long expected, news of the attack, dubbed ‘SHAttered,’ should further accelerate the urgency of sunsetting of the maligned algorithm. Researchers from Google, Elie...

Red Lion Controls Sixnet-Managed Industrial Switches, AutomationDirect STRIDE-Managed Ethernet Switches Vulnerability

CVSS v3 10 ATTENTION: Remotely exploitable. Low skill level is needed to exploit. Vendor: Red Lion Controls, AutomationDirect Equipment: Sixnet-Managed Industrial Switches and STRIDE-Managed Ethernet Switches Vulnerability: Use of Hard-coded Cryptographic Keys AFFECTED PRODUCTS The following Red...

VIPA Controls WinPLC7

CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: VIPA Controls Equipment: WinPLC7 Vulnerability: Stack Buffer Overflow AFFECTED PRODUCTS The following versions of WinPLC7, a PLC programming software, are affected: WinPLC Versions 5.0.45.5921 and prior. IMPACT...

Windows Botnet Spreading Mirai Variant

A Chinese-speaking attacker is spreading a Mirai variant from a repurposed Windows-based botnet. Researchers at Kaspersky Lab published a report today, and said the code was written by an experienced developer who also built in the capability to spread the IoT malware to Linux machines under...

Centrally Manage SSH Administrative Access: KeyBox

Centrally Manage SSH Administrative Access KeyBox is a web-based SSH console that centrally manages administrative access to systems. Web-based administration is combined with management and distribution of user’s public SSH keys. Key management and administration is based on profiles assigned to...

Squirrels, Not Hackers, Pose Biggest Threat to Electric Grid

SAN FRANCISCO–The crown jewel of North America’s critical infrastructure is its electric grid. A successful cyberattack on it would be devastating. But according to Marcus Sachs, CSO with the North American Electric Reliability Corporation NERC, fears of a cyberattack are overblown. Sachs told RS...