January 12, 2017 – Morning Cyber Coffee Headlines – “Martin Luther King Jr.” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 12, 2018 - Headlines Carbon Black in the News: Intel CEO releases...

Information Disclosure Vulnerability in Taiwan Tibbo Group AggreGate SCADA-HMI Industrial Software

AggreGate SCADA/HMI is a system for visualizing and operating processes, production flows, machines and equipment. It is a multi-user distributed solution that provides monitoring and surveillance for many industries. An information disclosure vulnerability exists in Taiwan Tibbo Group's AggreGat...

Ecava IntegraXor SQL Injection Vulnerability (CNVD-2017-37693)

Ecava IntegraXor is a toolset for creating and running human-machine interfaces for Web-based SCADA systems. Ecava IntegraXor suffers from a SQL injection vulnerability that can be exploited by an attacker to compromise an application, access or modify data, or exploit a potential vulnerability i...

Ecava IntegraXor

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Ecava Equipment: IntegraXor Vulnerabilities: SQL Injection AFFECTED PRODUCTS The following version of IntegraXor, a web SCADA/HMI solution, is affected: Ecava IntegraXor v 6.1.1030.1 and prior. IMPACT Successful...

Distributed Network Protocol (DNP3) Detection

A Distributed Network Protocol DNP3 Service is running at this host. DNP3 Distributed Network Protocol is a set of communications protocols used between components in process automation systems. DNP3 has become widely utilized in adjacent industries such as water/waste water, transportation and t...

Geovap Reliance SCADA XSS Vulnerability

Geovap Reliance SCADA is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Geovap Reliance SCADA Detection (HTTP)

This scripts sends an HTTP GET request to figure out whether a Geovap Reliance SCADA system is installed on the target host, and, if so, which version. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CVE-2017-16721

A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. This vulnerability could allow an unauthenticated attacker to inject arbitrary code...

CVE-2017-16721

A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. This vulnerability could allow an unauthenticated attacker to inject arbitrary code...

Cross site scripting

A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. This vulnerability could allow an unauthenticated attacker to inject arbitrary code...

CVE-2017-16721

Geovap Reliance SCADA is affected by CVE-2017-16721, an XSS vulnerability in versions 4.7.3 Update 2 and prior. An unauthenticated attacker could inject arbitrary code via a crafted URL, potentially enabling read/write access in the affected system. ICS-CERT reports a fixed version 4.7.3 Update 3...

CVE-2017-16721

A Cross-site Scripting issue was discovered in Geovap Reliance SCADA Version 4.7.3 Update 2 and prior. This vulnerability could allow an unauthenticated attacker to inject arbitrary code...

Geovap Reliance SCADA Cross-Site Scripting Vulnerability

Reliance is a professional SCADA/HMI system designed for the visualization and control of industrial processes as well as building and home automation. A cross-site scripting vulnerability exists in Geovap Reliance SCADA that allows an unauthenticated attacker to inject arbitrary code...

GEOVAP Reliance SCADA

CVSS v3 6.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: GEOVAP Equipment: Reliance SCADA Vulnerability: Cross-site Scripting AFFECTED PRODUCTS The following versions of Reliance SCADA, a software management platform, are affected: Reliance SCADA Version 4.7.3 Update 2 and...

Siemens Update Patches SIMATIC PCS 7 Bug in Some Versions

Siemens has made an update available for some of its SIMATIC PCS 7 distributed control systems that are impacted by a remotely exploitable input validation vulnerability. Siemens said version 8.2 and V8.1 prior to 8.1 SP1 with WinCC v7.3 Update 13 are affected. “Successful exploitation of this...

Trihedral Engineering Limited VTScada DLL Hijacking Vulnerability

VTScada is a SCADA system from Trihedral Engineering, Canada, based on a Windows platform with a Web interface option. Trihedral Engineering Limited VTScada suffers from a DLL hijacking vulnerability that could allow an attacker to cause the program to execute a specially crafted malicious dll fi...

Progea Movicon 11.5.1181 Search Path Issues Vulnerability

Progea Movicon versions 11.5.1181 and below suffer from search path related vulnerabilities. Vendor: Progea Equipment: Movicon SCADA/HMI Vulnerability: Uncontrolled Search Path Element, Unquoted Search Path or Element Advisory URL...

SpiderControl SCADA Web Server 2.02.0007 Improper Privilege Management Vulnerability

SpiderControl SCADA Web Server versions 2.02.0007 and below suffer from an improper privilege management vulnerability. Vendor: SpiderControl Equipment: SCADA Web Server Vulnerability: Improper Privilege Management Advisory URL...

SpiderControl SCADA Web Server 2.02.0007 Improper Privilege Management

Vendor: SpiderControl Equipment: SCADA Web Server Vulnerability: Improper Privilege Management Advisory URL https://ipositivesecurity.com/2017/10/28/ics-spidercontrol-scada-web-server-improper-privilege-management-vulnerability/ ICS-CERT Advisory...

Progea Movicon 11.5.1181 Search Path Issues

Vendor: Progea Equipment: Movicon SCADA/HMI Vulnerability: Uncontrolled Search Path Element, Unquoted Search Path or Element Advisory URL https://ipositivesecurity.com/2017/10/28/ics-progea-movicon-scadahmi-vulnerabilities/ ICS-CERT Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-290-01...