SCADA Engine BACnet OPC Server < 2.1.371.24 Multiple Vulnerabilities

Binary data scadabacnetopcserver2137124.nbin...

CVE-2015-0990

Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory...

Design/Logic Flaw

Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory...

CVE-2015-0990

Affected product: Ecava IntegraXor SCADA Server prior to version 4.2.4488. Issue: Untrusted search path (CWE-427) allows a local attacker to escalate privileges by placing a renamed DLL in the default install directory; the DLL is loaded by the application, executing code with the application’s p...

CVE-2015-0990

Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory...

Inductive Automation Ignition Invalid Session Expires Vulnerability

Ignition is an updated version of FactoryPMI, the HMI/SCADA product offered by Inductive Automation. Ignition does not delete the session after the user logs out, which can allow an attacker to reuse the current session...

Cimon CmnView DLL Hijacking Vulnerability

CmnView is a WEB-based SCADA application. The CmnView application contains a DLL that fails to specify an absolute path, allowing an attacker to exploit the vulnerability to build a malicious application and place it in a specific path, which could allow the application to maliciously load the DL...

CVE-2015-0981

The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors...

CVE-2015-0980

Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request...

CVE-2015-0979

Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet...

Authentication flaw

The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors...

Format string

Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request...

Heap overflow

Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet...

CVE-2015-0980

Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request...

CVE-2015-0979

Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet...

CVE-2015-0981

The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors...

CVE-2015-0979

Summary (CVE-2015-0979) : A heap-based buffer overflow in the SOAP web interface of the SCADA Engine BACnet OPC Server prior to version 2.1.371.24 allows remote arbitrary code execution via a crafted packet. The affected component is the Windows Service SOAP interface; exploitation is remote and ...

CVE-2015-0981

SCADA Engine BACnet OPC Server prior to version 2.1.371.24 is affected by three vulnerabilities tied to the SOAP web interface: (1) CVE-2015-0981 Authentication bypass allowing remote read/write of database fields, (2) CWE-122 Heap-based Buffer Overflow, and (3) CWE-20 Improper Input Validation. ...

CVE-2015-0980

SCADA Engine BACnet OPC Server (BACnet OPC Server) before version 2.1.371.24 is affected by CVE-2015-0980 via a format-string vulnerability in the SOAP web interface (BACnOPCServer.exe). Exploitation could allow remote attackers to execute arbitrary code. The ICS-CERT advisory notes a fixed versi...

This 'Killer USB' can make your Computer explode

Can Hackers turn a remote computer into a bomb and explode it to kill someone, just like they do in hacker movies? Wait, wait! Before answering that, Let me tell you an interesting story about Killer USB drive: A man walking in the subway stole a USB flash drive from the outer pocket of someone...