PT-2014-48: Stack-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Stack-based buffer overflow vulnerability in Honeywell EPKS. Stack-based buffer overflow was discovered in hscodbcn.exe module when using function unmarshallString for copying data from packet in stack buffer of static size without...

PT-2014-53: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in ripsd.exe module in function secGetContext which could lead to possible remote code execution or denial of service. How to fix...

PT-2014-40: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in function svcexecute from dualonsrv.exe module which could lead to possible remote code execution or denial of service How to fix...

PT-2014-52: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in ripsd.exe module in function sectcprecievepassword which could lead to possible remote code execution or denial of service. How ...

PT-2014-33: Stack-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Stack-based buffer overflow vulnerability in Honeywell EPKS. Stack-based buffer overflow was discovered in function hscsconf which could lead possible remote code execution or denial of service. How to fix Update your sofware up to t...

PT-2014-45: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in function svcdbseq from dualonsrv.exe module which could lead to possible remote code execution or denial of service How to fix...

PT-2014-41: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in function svccrgtsk from dualonsrv.exe module which could lead to possible remote code execution or denial of service How to fix...

PT-2014-54: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in ripsd.exe module in function secGetContext which could lead to possible remote code execution or denial of service. How to fix...

PT-2014-55: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in ripsd.exe module in function secGetContext which could lead to possible remote code execution or denial of service. How to fix...

PT-2014-50: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered inhscodbcn.exe module when using function ISAMGetTableList for copying data from packet in dynamic memory buffer of static size...

PT-2014-30: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in Honeywell EPKS confd.exe module in readexactsilenttimeout function which could lead to possible remote code execution or denial ...

PT-2014-46: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in function svchistory from dualonsrv.exe module which could lead to possible remote code execution or denial of service How to fix...

PT-2014-04: Single Sign-On Vulnerability in Nixu Namesurfer

The specialists of the Positive Research center have detected a Single Sign-On vulnerability in Nixu Namesurfer. All services used by the Nixu Namesurfer software PostgreSQL, Apache use the same user account to operate. Therefore, a weakness in one of the services will affect all of them. For...

PT-2014-01: Cross-Site Scripting in Nixu Namesurfer

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in Nixu Namesurfer. The vulnerability allows an attacker to inject a malicious code into a page generated by the web-based system. This code will be executed on the victim’s computer when he/she ope...

PT-2014-03: Arbitrary Files Reading in Nixu Namesurfer

The specialists of the Positive Research center have detected an Arbitrary Files Reading vulnerability in Nixu Namesurfer. An attacker can read any file on the server with the rights of the namesurf user. How to fix Update your sofware up to the latest version Advisory status 16.01.2014 - Vendor...

PHPYUN逻辑错误无限刷积分

简要描述： PHPYUN逻辑错误无限积分所以标题党了一下！ 详细说明： 逻辑错误 未对用户输入严格过滤！ 问题发生在 member/model/com.class.php 1158行 $integral=$this-config"integralcomcomments"$POST'time'; ..... if$statis"integral"obj-ACTmsg"index.php?C=pay","你的".$this-config"integralpricename"."不足，请先充值";...

PT-2014-05: Privilege Gaining in Nixu Namesurfer

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in Nixu Namesurfer. An attacker could assign the $PATH variable with the path to his/her malicious file. An application with the suid bit will execute it. Thus the attacker will receive the highest...

PT-2014-02: XML External Entities Resolution vulnerability in Nixu Namesurfer

The specialists of the Positive Research center have detected an XML External Entities Resolution vulnerability in Nixu Namesurfer. The vulnerability allows an attacker to inject a malicious code into a page generated by the web-based system. This code will be executed on the victim’s computer wh...

PT-2014-14: Privilege Gaining in Siemens SIMATIC WinCC

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in SIMATIC WinCC. The database server of SIMATIC WinCC could allow authenticated users to escalate their privileges in the database if a specially crafted command is sent to the database server at port...

PT-2014-80: Cross-Site Scripting in ShopOS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in ShopOS. Cross-site scripting in the currencies.php script allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to fi...