CVE-2014-1698

Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999...

CVE-2014-1698: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to read arbitrary files via crafted packets to TCP port 4999...

CVE-2014-1697: Undefined Security Weakness

The integrated web server in Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to execute arbitrary code via crafted packets to TCP port 4999...

CVE-2014-1699: Undefined Security Weakness

Siemens SIMATIC WinCC OA before 3.12 P002 January allows remote attackers to cause a denial of service monitoring-service outage via malformed HTTP requests to port 4999...

CVE-2014-1696: Undefined Security Weakness

Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack...

PT-2014-1219

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC OA versions prior to 3.12 P002 January Description The issue allows remote attackers to bypass the file system of the server in the context of the current user without authentication by sending specially crafted TCP...

PT-2014-1218

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC OA versions prior to 3.12 P002 January Description The issue is related to the integrated web server in Siemens SIMATIC WinCC OA, which allows remote attackers to execute arbitrary code via crafted packets sent to TCP por...

PT-2014-1217

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC OA versions prior to 3.12 P002 January Description The issue is related to the use of a weak hash algorithm for passwords, making it easier for remote attackers to obtain access via a brute-force attack. This weakness...

PT-2014-1220

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC WinCC OA versions prior to 3.12 P002 January Description The issue allows remote attackers to cause a denial of service, specifically a monitoring-service outage, via malformed HTTP requests to port 4999. This can be exploited ...

通达OA存在SQL注入风险

简要描述： 通达OA存在SQL注入风险 详细说明： 吐槽一句：上次提交了一个通达最新版本存在存储型XSS的问题，厂商居然以【用户以实名制登录】为理由而基本忽视了这个问题，我想问：用户账户就不会被盗？登录账户的一定是其本人？ 这次涉及版本包括其官方网站能下到的所有版本的试用版。 1、通过OA的知道系统提交一个问题，在问题的的“标签”里加个单引号，没有过滤写到数据库： 2、访问这个问题，系统会从该问题的“标签”中去除内容，做LIKE查询，以找到相关联的内容，系统对POST、GET、COOKIES等方式的过滤非常完美，但是从自身数据库取出的数据并未过滤： 漏洞证明：...

Mastery OA to the latest version of the override to delete the others notice, notice reply, a few at a stored XSS-vulnerability warning-the black bar safety net

Test version: mastery OA 2 0 1 3 enhanced Edition 125MB Download: http://www.tongda2000.com/download/2013adv.php Updated on 2013-12-26 1 3:3 0 In the news, announcements, notifications, etc. reply, you can override delete someone else's reply, just need someone to reply to the content of the id c...

Siemens Industrial Products OpenSSL Heartbleed Vulnerability (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-14-105-03A Siemens Industrial Products OpenSSL Heartbleed Vulnerability that was published April 29, 2014, on the NCCIC/ICS-CERT web site. Siemens reported to ICS-CERT a list of products affected by the OpenSSL...

华天动力OA系统服务端默认配置后门

简要描述： 可上传/执行/删除 任意文件 详细说明： 通过下载OA试用版 tomcat管理配置文件 默认配置如图所示:tomcat-users.xml 于是尝试G搜索 然后访问tomcat /index.jsp Tomcat Manager 输入上方tomcat配置文件中 账户名/密码 成功登入 然后部署war 然后 img src="https://images...

通达OA测试门户SQL注入风险

简要描述： 通达OA测试门户网站，因过滤不慎暴露库名，导致SQL注入风险 详细说明： 通达OA测试门户网站，因过滤不慎暴露库名，导致SQL注入风险 不会吧，这个属于防SQL注入的最初级要求。 漏洞证明：...

通达OA一个SQL注射漏洞（需登录）

简要描述： 通达OA SQL注射漏洞，需登录。 详细说明： 程序是集成化安装，在php.ini中registerglobals设置为on，允许注册全局变量。 在/general/crm/apps/crm/include/deleteView.php文件中$id变量未初始化： includeonce "general/crm/studio/header.php" ; includeonce "inc/utility.php" ; $flag = 0; $query = "delete from crmsyslistview where id=".$id; $cursor = exequer...

Pan micro E-office OA management system vulnerability-vulnerability warning-the black bar safety net

Or OA system, the user more. Theresql injection, to any download file, code execution and other vulnerabilities 0×0 1 sql injection Test official site, first by using a test account xj log in, then visit the address below...

泛微E-office OA管理系统# 验证其通用性:SQL注入、任意文件下载、文件上传等漏洞

简要描述： 验证篇来啦 详细说明： 之前发布的两个漏洞 Coody --- WooYun: 泛微E-office OA管理系统存在任意文件下载及文件上传导致任意代码执行（已getshell） applychen ---- WooYun: 泛微E-office OA管理系统存在SQL注射漏洞可查库 cncert国家互联网应急中心 的回应是：对于通用性还需要进一步确认 今天这篇文章证明一下其通用性（存在SQL注入、任意文件下载、文件上传导致任意代码执行）。 这里需要说明一下： 找到的该案例是通过百度搜索 【泛微oa系统】搜索出来的 地址是...

TDXK OA /general/workflow/plugin/turn/test.php SQL注入漏洞

No description provided by source...

TDXK OA /general/workflow/list/roll_config.php SQL注入漏洞

No description provided by source...

泛微E-office OA管理系统存在SQL注射漏洞可查库

简要描述： 还是OA系统，用户较多。 详细说明： 测试官方站点，首先用使用测试账户xj登录，然后访问下面的地址。 http://eoffice8.weaver.cn:8028/general/filefolder/filenew/neworedit/index.php?FILESORT=&CONTENTID=123&SORTID=166&funcid=&operationType=editFromRead&docStr= 其中的CONTENTID参数能够注射SQL语句。...