盈世信息科技OA系统SQL注入

简要描述： 盈世信息科技OA系统SQL注入 详细说明： http://218.107.63.241:82是OA系统 /interface/go.php没有过滤APPUNIT参数，导致了SQL注入漏洞 $APPUNIT = urldecode $APPUNIT ; $query = "select MEMBERID from CONNECTCONFIG where MEMBERNAME='".$APPUNIT."'"; 虽然开启了magicquotesgpc，单引号会被转义，但是因为他会先解码一遍，就可以用%2527来绕过GPC 漏洞证明： 用SQLMAP注入出数据信息 web...

Siemens Update on Heartbleed Patches in ICS, SCADA

Industrial control equipment manufacturer Siemens has produced a security update that mitigates the OpenSSL Heartbleed vulnerability in its eLAN systems and now its WinCC OA supervisory control and data acquisition SCADA software as well. The company is continuing to work on patches to resolve th...

ICS-CERT Warns of Heartbleed Vulnerabilities in Siemens Gear

A number of ICS products from Siemens and Innominate are vulnerable to the OpenSSL heartbleed flaw, some of which do not have updates available yet. The list of products affected by the heartbleed vulnerability continues to grow by the day, with OpenVPN being one of the latest. A researcher on...

泛微E-office OA管理系统通过sql注入可以任意真实用户名免密码登陆

简要描述： 泛微E-office OA管理系统通过sql注入可以任意真实用户名免密码登陆 详细说明： 以泛微官方测试站点为例 登陆页面为 http://eoffice8.weaver.cn:8028/login.php 则可注入的网址为 http://eoffice8.weaver.cn:8028/building/urlurl.php 直接访问显示access denied， 使用hackbar。post内容中,url为general/index.php，smsid为注入sql，内容为1 union select...

jsict /MockLogin.aspx后门漏洞

jsict公司开发的OA系统文件 /MockLogin.aspx访问后可以获取所有用户的数据库数据，导致后门漏洞。 0 jsict /MockLogin.aspx 删除/MockLogin.aspx文件...

SIEMENS SIMATIC WinCC Open Architecture不安全密码哈希漏洞

BUGTRAQ ID: 65339 CVECAN ID: CVE-2014-1696 Siemens SIMATIC WinCC 是监测控制和数据采集SCADA及人机界面HMI系统。 SIEMENS SIMATIC WinCC OA 3.12 P002之前版本使用了弱密码哈希算法，存在安全漏洞，远程攻击者通过暴力攻击，即可获取访问权限。 0 Siemens SIMATIC WinCC Open Architecture 3.12 P002 January 厂商补丁： Siemens ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2014-1697

The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999...

CVE-2014-1699

Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service monitoring-service outage via malformed HTTP requests to port 4999...

CVE-2014-1696

Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2014-1698

Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999...

Directory traversal

Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999...

Code injection

The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999...

Code injection

Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service monitoring-service outage via malformed HTTP requests to port 4999...

CVE-2014-1697

The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999...

CVE-2014-1699

CVE-2014-1699 affects Siemens SIMATIC WinCC OA before version 3.12 P002 January. The vulnerability resides in the integrated Web server on port 4999/TCP and stems from improper input validation, allowing remote attackers to trigger a denial of service (monitoring-service outage) by sending malfor...

CVE-2014-1696

Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack...

CVE-2014-1698

CVE-2014-1698 is a directory traversal vulnerability in Siemens SIMATIC WinCC OA, affecting versions before 3.12 P002 January. The affected component is the integrated Web server at Port 4999/TCP, allowing remote attackers to read arbitrary files via crafted packets. The ICS advisory confirms mul...

CVE-2014-1696

Siemens SIMATIC WinCC OA before 3.12 P002 uses a weak password hash in the server application, enabling remote brute-force access. Affected: SIMATIC WinCC OA server (prior to 3.12 P002 January). Impact: potential privilege escalation or unauthorized access as described in the ICS advisory. Remedi...

CVE-2014-1698

Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999...

CVE-2014-1699

Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service monitoring-service outage via malformed HTTP requests to port 4999...