CVE-2017-6016

The CVE-2017-6016 issue affects LCDS – Leão Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA (LAquis SCADA), specifically versions 4.1 and earlier released before 20 Jan 2017. Root cause: Improper Access Control (CWE-284) that may allow an authenticated user to modify application fi...

CVE-2017-6016

An Improper Access Control issue was discovered in LCDS - Leao Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA. The following versions are affected: Versions 4.1 and prior versions released before January 20, 2017. An Improper Access Control vulnerability has been identified, which...

GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian Vulnerability (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-16-336-05A GE Proficy HMI/SCADA IFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian Vulnerability that was published January 24, 2017, on the NCCIC/ICS-CERT web site. GE has reported an insufficiently protecte...

Cross site scripting

A Cross-Site Scripting issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. This may allow remote code execution...

CVE-2017-6031

A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution...

CVE-2017-6029

A Cross-Site Scripting issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. This may allow remote code execution...

CVE-2017-6031

A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution...

CVE-2017-6029

A Cross-Site Scripting issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. This may allow remote code execution...

Design/Logic Flaw

A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution...

CVE-2017-6029

CVE-2017-6029 affects Certec EDV GmbH atvise SCADA prior to version 3.0, describing two related issues: a Cross-Site Scripting vulnerability (CWE-79) and a header injection bug (CWE-644) that together may enable remote code execution. The NVD entry confirms the XSS as the primary CVE-2017-6029 it...

CVE-2017-6031

A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An "improper neutralization of HTTP headers for scripting syntax" issue has been identified, which may allow remote code execution...

CVE-2017-6031

CVE-2017-6031 affects Certec EDV GmbH atvise scada pre-3.0. The issue is improper neutralization of HTTP headers for scripting syntax (header injection) that may enable remote code execution. Affected: atvise scada prior to version 3.0; exploitability is remotely possible. Mitigation: upgrade to ...

CVE-2017-6029

A Cross-Site Scripting issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. This may allow remote code execution...

LAquis SCADA dll Hijacking Vulnerability

LAquis SCADA is the tool and language for data collection, process supervision, industrial automation, storage and report generation for quality management and application development. LAquis SCADA suffers from a dll hijacking vulnerability. The vulnerability is caused due to the LAquis SCADA...

LAquis SCADA Software Web Server Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of LAquis SCADA Software. Authentication is not required to exploit this vulnerability. The specific flaw exists within global processing of requests inside the web server. The issue results...

Schneider Electric Interactive Graphical SCADA DLL Load Remote Code Execution Vulnerability

Schneider Electric Interactive Graphical SCADA System Software is a suite of automation software for process control and supervision of SCADA systems from the French company Schneider Electric SchneiderElectric. A DLL loading remote code execution vulnerability exists in Schneider Electric...

CVE-2017-6033

Schneider Electric IGSS (Interactive Graphical SCADA System) Software Versions 12 and earlier are affected by a DLL Hijacking vulnerability (CVE-2017-6033) due to Uncontrolled Search Path Element (CWE-427). The issue arises when a malicious DLL with the same name as a legitimate file is placed in...

CVE-2017-6033

A DLL Hijacking issue was discovered in Schneider Electric Interactive Graphical SCADA System IGSS Software, Version 12 and previous versions. The software will execute a malicious file if it is named the same as a legitimate file and placed in a location that is earlier in the search path...

Certec EDV GmbH atvise scada

CVSS v3 6.1 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Certec EDV GmbH Equipment: atvise scada Vulnerabilities: Cross-Site Scripting, Header Injection AFFECTED PRODUCTS The following versions of atvise scada, a HMI configuration platform, are affected: Atvise scada 3.0 an...

Sistemi Winlog SCADA Software DLL Hijacking

Sielco Sistemi Winlog SCADA Software Insecure Library Loading Allows Code Execution Vendor: Sielco Sistemi Equipment: Winlog SCADA Software Vulnerability: Uncontrolled Search Path Element ICS-CERT Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-038-01 AFFECTED PRODUCTS The following Siel...