Medical Device Security in Need of Major Upgrade

Security researchers and hackers have spent the last 20 years or so tearing apart all manner of software and hardware, looking for vulnerabilities, attack vectors and bugs, and the advent of embedded and implantable devices has now drawn their attention to this new class of targets. Medical...

CVE-2012-0742

IBM Tivoli Event Pump 4.2.2, when the LOGREQUESTS and VALIDATESOAPUSERS options are enabled, places credentials into the AOPSCLOG aka AOPLOG data set, which allows local users to obtain sensitive information by reading the data...

Information disclosure

IBM Tivoli Event Pump 4.2.2, when the LOGREQUESTS and VALIDATESOAPUSERS options are enabled, places credentials into the AOPSCLOG aka AOPLOG data set, which allows local users to obtain sensitive information by reading the data...

CVE-2012-0742

IBM Tivoli Event Pump 4.2.2, when the LOGREQUESTS and VALIDATESOAPUSERS options are enabled, places credentials into the AOPSCLOG aka AOPLOG data set, which allows local users to obtain sensitive information by reading the data...

CVE-2012-0742

CVE-2012-0742 affects IBM Tivoli Event Pump 4.2.2. When LOG_REQUESTS and VALIDATE_SOAP_USERS are enabled, credentials are written to the AOPSCLOG (aka AOPLOG) data set, allowing local users to read sensitive information. The vulnerability is a local information disclosure with CVSSv2 base score 1...

Hackers destroyed a pump used by a US water utility

Hackers destroyed a pump used by a US water utility Hackers destroyed a pump used by a US water utility after gaining unauthorized access to the industrial control system it used to operate its machinery. Five computer screenshots posted early Friday purport to show the user interface used to...

Hacker Claims He Breached Texas Water Plant

A hacker claims to have breached a water utility in Texas and has posted reputed screenshots online to prove it. The water plant targeted by the hacker, who uses the alias “Pr0f”, is in the Harris County city of South Houston. In a post on Pastebin, Pr0f said his actions were in response to what ...

Oracle Database Multiple Vulnerabilities (October 2005 CPU)

The remote Oracle database server is missing the October 2005 Critical Patch Update CPU and therefore is potentially affected by security issues in the following components : - Change Data Capture - Data Guard Logical Standby - Data Pump Export - Database Scheduler - Export - Locale - Materialize...

Oracle Database Multiple Vulnerabilities (October 2009 CPU)

The remote Oracle database server is missing the October 2009 Critical Patch Update CPU and therefore is potentially affected by security issues in the following components : - Advanced Queuing - Application Express - Auditing - Authentication - Core RDBMS - Data Mining - Data Pump - Network...

Oracle Database Multiple Vulnerabilities (April 2008 CPU)

The remote Oracle database server is missing the April 2008 Critical Patch Update CPU and therefore is potentially affected by security issues in the following components : - Advanced Queuing - Audit - Authentication - Change Data Capture - Core RDBMS - Data Pump - Export - Oracle Enterprise...

Oracle Database Multiple Vulnerabilities (July 2006 CPU)

The remote Oracle database server is missing the July 2006 Critical Patch Update CPU and therefore is potentially affected by security issues in the following components : - Change Data Capture CDC - Core RDBMS - Data Pump Metadata API - Dictionary - Export - InterMedia - OCI - Oracle ODBC Driver...

Oracle Database Multiple Vulnerabilities (July 2008 CPU)

The remote Oracle database server is missing the July 2008 Critical Patch Update CPU and therefore is potentially affected by security issues in the following components : - Advanced Queuing - Advanced Replication - Authentication - Core RDBMS - Data Pump - Database Scheduler - Instance Managemen...

Oracle Database Multiple Vulnerabilities (January 2006 CPU)

The remote Oracle database server is missing the January 2006 Critical Patch Update CPU and therefore is potentially affected by security issues in the following components : - Advanced Queuing - Change Data Capture - Connection Manager - Data Pump - Data Pump Metadata API - Dictionary - Java Net...

Code injection

Unspecified vulnerability in Medtronic Paradigm wireless insulin pump 512, 522, 712, and 722 allows remote attackers to modify the delivery of an insulin bolus dose and cause a denial of service adverse human health effects via unspecified vectors involving wireless communications and knowledge o...

CVE-2011-3386

CVE-2011-3386 involves Medtronic Paradigm wireless insulin pumps (models 512, 522, 712, 722). The vulnerability allows remote modification of insulin bolus delivery via wireless communications using knowledge of the device serial number, potentially causing adverse health effects and a denial of ...

CVE-2011-3386

Unspecified vulnerability in Medtronic Paradigm wireless insulin pump 512, 522, 712, and 722 allows remote attackers to modify the delivery of an insulin bolus dose and cause a denial of service adverse human health effects via unspecified vectors involving wireless communications and knowledge o...

Insulin Pump Hack Garners Federal Attention

The hack of a commercially available insulin pump earlier this month at the DEFCON hacker conference has attracted the attention of members of the House Energy & Commerce Committee, which is now calling for a formal review of wireless medical devices like the pump. Senior Committee members Anna G...

NIBE heat pump LFI Exploit

Exploit for hardware platform in category remote exploits ========================== NIBE heat pump LFI Exploit ========================== !/usr/bin/python import socket,sys,os,base64 NIBE heat pump LFI exploit Written by Jelmer de Hen Published at http://h.ackack.net/?p=302 Special thanks to...

NIBE heat pump - Remote Code Execution

NIBE heat pump - Remote Code Execution !/usr/bin/python import socket,sys,os,base64 NIBE heat pump RCE exploit Written by Jelmer de Hen Published at http://h.ackack.net/?p=302 Web interface is running with root rights def fingerheatpumpip, port: s = socket.socketsocket.AFINET, socket.SOCKSTREAM...

NIBE heat pump - Local File Inclusion

!/usr/bin/python import socket,sys,os,base64 NIBE heat pump LFI exploit Written by Jelmer de Hen Published at http://h.ackack.net/?p=302 Special thanks to Fredrik Nordberg Almroth and Mathias Karlsson for obtaining this information http://h.ackack.net/?p=274 which made me test the heat pumps and...