WAGO e!DISPLAY 7300T XSS / File Upload / Code Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Remote code execution via multiple attack vectors product: WAGO e!DISPLAY 7300T - WP 4.3 480x272 PIO1 vulnerable version: FW 01 - 01.01.1001 fixed version: FW 02 CVE...

ThreatList: Virtualization-related Bug Reports Jump 275 Percent in 2018

Zero Day Initiative said Monday that so far in 2018, it has published 600 advisories – up 33 percent from the 451 published in 2017, which was previously its “busiest year ever.” “Interestingly, we had fewer advisories released as 0-day this year,” the company said in its mid-year report on...

Zero Day Initiative: A 1H2018 Recap

When the Zero Day Initiative ZDI was formed in 2005, the cyber threat landscape was a bit different from what we see today. Threats were a little less sophisticated, but there was one thing that we saw then that we still see now: the shortage of cybersecurity professionals and researchers. The te...

Zero-Day Coverage Update – Week of July 2, 2018

The General Data Protection Regulation GDPR has been up and running for a couple of months now and your organization is compliant. It’s time to take a little break – well, not so fast! Late last week, the State of California passed a new data privacy law called the California Consumer Privacy Act...

Information disclosure

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI...

Design/Logic Flaw

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

CVE-2018-12635

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

CVE-2018-12634

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI...

CVE-2018-12634

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI...

CVE-2018-12635

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

CVE-2018-12635

CirCarLife Scada v4.2.4 is affected by an unauthorized upgrade vulnerability, exploitable via requests to html/upgrade.html and services/system/firmware.upgrade URIs. The provided documents describe the issue as an ability to perform upgrades without authorization, but do not specify the underlyi...

CVE-2018-12634

CirCarLife Scada is affected prior to version 4.3. A remote attacker can disclosure sensitive information by issuing a direct HTTP request to html/log or services/system/info.html, exposing system logs and potentially other data. The issue is triggered by exposing log/system information via unaut...

CirCarLife Scada Information Disclosure Vulnerability

Circontrol CirCarLife Scada is a parking lot automation system from Circontrol, Spain. A security vulnerability exists in Circontrol CirCarLife Scada version 4.2.4. A remote attacker can exploit this vulnerability by sending a direct request to the html/log or services/system/info.html URIs to...

CVE-2018-12635

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

CVE-2018-12634

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI...

CirCarLife Scada Unauthorized Upgrade Vulnerability

Circontrol CirCarLife Scada is a parking lot automation system from Circontrol, Spain. A security vulnerability exists in Circontrol CirCarLife Scada version 4.2.4. The vulnerability can be exploited to disclose sensitive information by sending requests to the html/upgrade.html and...

CirCarLife Scada 未授权访问信息泄露

...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of June 11, 2018

As a native Texan, I’ve seen more than my fair share of bugs - actual physical bugs that love the hot, humid Texas climate and my curly hair for some reason. The Zero Day Initiative ZDI sees many bugs of the software variety, including those that affect SCADA control systems. Fritz Sands recently...

Router Vulnerability and the VPNFilter Botnet

On May 25, the FBI asked us all to reboot our routers. The story behind this request is one of sophisticated malware and unsophisticated home-network security, and it's a harbinger of the sorts of pervasive threats ­ from nation-states, criminals and hackers ­ that we should expect in coming year...

Honeywell Scada System - Information Disclosure Vulnerability

Exploit for linux platform in category web applications Exploit Title: Honeywell Scada System - Information Disclosure Exploit Author: t4rkd3vilz Vendor Homepage: https://www.honeywell.com Version: WebVersion : 3.2.1.294365 - DeviceType : IPC-HFW2320R-ZS Tested on: Linux To be written after the...