jsict /MockLogin.aspx后门漏洞

jsict公司开发的OA系统文件 /MockLogin.aspx访问后可以获取所有用户的数据库数据，导致后门漏洞。 0 jsict /MockLogin.aspx 删除/MockLogin.aspx文件...

SIEMENS SIMATIC WinCC Open Architecture不安全密码哈希漏洞

BUGTRAQ ID: 65339 CVECAN ID: CVE-2014-1696 Siemens SIMATIC WinCC 是监测控制和数据采集SCADA及人机界面HMI系统。 SIEMENS SIMATIC WinCC OA 3.12 P002之前版本使用了弱密码哈希算法，存在安全漏洞，远程攻击者通过暴力攻击，即可获取访问权限。 0 Siemens SIMATIC WinCC Open Architecture 3.12 P002 January 厂商补丁： Siemens ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2014-1699

Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service monitoring-service outage via malformed HTTP requests to port 4999...

CVE-2014-1697

The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999...

CVE-2014-1696

Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2014-1698

Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999...

Code injection

Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service monitoring-service outage via malformed HTTP requests to port 4999...

Directory traversal

Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999...

Code injection

The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999...

CVE-2014-1697

The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999...

CVE-2014-1698

CVE-2014-1698 is a directory traversal vulnerability in Siemens SIMATIC WinCC OA, affecting versions before 3.12 P002 January. The affected component is the integrated Web server at Port 4999/TCP, allowing remote attackers to read arbitrary files via crafted packets. The ICS advisory confirms mul...

CVE-2014-1696

Siemens SIMATIC WinCC OA before 3.12 P002 uses a weak password hash in the server application, enabling remote brute-force access. Affected: SIMATIC WinCC OA server (prior to 3.12 P002 January). Impact: potential privilege escalation or unauthorized access as described in the ICS advisory. Remedi...

CVE-2014-1699

CVE-2014-1699 affects Siemens SIMATIC WinCC OA before version 3.12 P002 January. The vulnerability resides in the integrated Web server on port 4999/TCP and stems from improper input validation, allowing remote attackers to trigger a denial of service (monitoring-service outage) by sending malfor...

CVE-2014-1698

Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999...

CVE-2014-1697

The CVE-2014-1697 entry concerns Siemens SIMATIC WinCC OA prior to version 3.12 P002. The vulnerability lies in the integrated Web server on port 4999, where specially crafted, unauthenticated packets can remotely trigger arbitrary code execution due to improper handling of inputs (code injection...

CVE-2014-1696

Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2014-1699

Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service monitoring-service outage via malformed HTTP requests to port 4999...

通达OA存在SQL注入风险

简要描述： 通达OA存在SQL注入风险 详细说明： 吐槽一句：上次提交了一个通达最新版本存在存储型XSS的问题，厂商居然以【用户以实名制登录】为理由而基本忽视了这个问题，我想问：用户账户就不会被盗？登录账户的一定是其本人？ 这次涉及版本包括其官方网站能下到的所有版本的试用版。 1、通过OA的知道系统提交一个问题，在问题的的“标签”里加个单引号，没有过滤写到数据库： 2、访问这个问题，系统会从该问题的“标签”中去除内容，做LIKE查询，以找到相关联的内容，系统对POST、GET、COOKIES等方式的过滤非常完美，但是从自身数据库取出的数据并未过滤： 漏洞证明：...

Mastery OA to the latest version of the override to delete the others notice, notice reply, a few at a stored XSS-vulnerability warning-the black bar safety net

Test version: mastery OA 2 0 1 3 enhanced Edition 125MB Download: http://www.tongda2000.com/download/2013adv.php Updated on 2013-12-26 1 3:3 0 In the news, announcements, notifications, etc. reply, you can override delete someone else's reply, just need someone to reply to the content of the id c...

Siemens Industrial Products OpenSSL Heartbleed Vulnerability (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-14-105-03A Siemens Industrial Products OpenSSL Heartbleed Vulnerability that was published April 29, 2014, on the NCCIC/ICS-CERT web site. Siemens reported to ICS-CERT a list of products affected by the OpenSSL...