Security feature bypass

A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Security configuration settings such as Address Space Layout Randomization ASLR and Data Execution prevention DEP were not properly configured resulting in weak security...

CVE-2017-9967

A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Security configuration settings such as Address Space Layout Randomization ASLR and Data Execution prevention DEP were not properly configured resulting in weak security...

CVE-2017-9967

A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Security configuration settings such as Address Space Layout Randomization ASLR and Data Execution prevention DEP were not properly configured resulting in weak security...

CVE-2017-9968

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack...

Security feature bypass

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack...

CVE-2017-9967

A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Security configuration settings such as Address Space Layout Randomization ASLR and Data Execution prevention DEP were not properly configured resulting in weak security...

CVE-2017-9967

Affected product: Schneider Electric IGSS SCADA Software (version 12 and earlier). Root cause: security misconfiguration of memory protection (ASLR and DEP) leading to weak security. Impact: vulnerability described as a local, likely code-execution risk when exploiting improper security configura...

CVE-2017-9968

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack...

CVE-2017-9968

IGSS Mobile (Schneider Electric) affected: Android and iOS apps version 3.01 and earlier. Root cause: missing certificate pinning during TLS/SSL handshake, enabling potential MITM risks. Public-facing impact: credential exposure risk and MITM possibility as described in ICSA-18-046-03; CVSS v3 ba...

What you didn’t know about OWASP Top-10 2017? Part 2/3

In my previous post I covered first 3 of the OWASP Top-10 2017 risks. Today I’d like to continue this and explain the next 3 risks: A4. XML External Entities XXE A5. Broken Access Control A6. Security Misconfiguration Let’s begin then! A4. XXE. This is my favorite one. I made some money because o...

The vulnerability of the OPC Classic protocol implementation in the Tofino Xenon Security Appliance allows a intruder to connect to an arbitrary TCP port of the protected object.

The vulnerability of the OPC Classic protocol implementation in the Tofino Xenon Security Appliance lies in security configuration errors. Exploiting this vulnerability allows a malicious actor to connect to an arbitrary TCP port of the protected object, using the dynamic port offset of OPC...

Semrush: Security misconfiguration "weak passwords".

The site has a security misconfiguration issue. The site accept weak passwords like "123" or "12345" or "abc12345" which can be guessed easily with the help of some auto attacks...

GSA Bounty: Server Side Misconfiguration (EMAIL SPOOFING)

Hi team, Bug Type: Server Security Misconfiguration Mail Server Misconfiguration Missing SPF on Email Domain Weakness: Improper Authentication Description: i observe this when i send a email from [email protected] through http://emkei.cz/ to email [email protected] and afte...

The vulnerability of the lockscreen component of the Android operating system allows a hacker to bypass the PIN code lock.

The vulnerability of the Android operating system’s lock screen is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the PIN code lock by pressing the backspace key after each entry when entering the PIN...

Weblate: Weblate |Security Misconfiguration| Method Enumeration Possible on domain

Hi Team, I have found an instance in application where application is alllowing OPTIONS method to be processed in HTTP request from weblate.org and in response to my request i got the information that these methods are allowed by application server "GET, HEAD, OPTIONS" Ideally server should not...

The vulnerability of the iOS operating system, which allows a perpetrator to make phone calls to arbitrary numbers

The vulnerability of the Quick Look component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to make phone calls to arbitrary numbers remotely...

The vulnerability of the iOS operating system allows a perpetrator to make phone calls to arbitrary numbers.

The vulnerability of the iOS operating system’s Phone component is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to make telephone calls to arbitrary numbers using a third-party application...

The vulnerability of the iOS operating system and the Safari browser allows a hacker to replace the user interface of the FaceTime application.

The vulnerability of the Safari component of the iOS operating system and the Safari browser is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to replace the FaceTime application’s user interface using a specially crafted web page...

Trend Micro Control Manager download.php Information Disclosure

An information disclosure vulnerability exists in Trend Micro Control Manager. The vulnerability is due to security misconfiguration which allows access to the unreferenced download.php file, which in turn allow reading of the arbitrary files...

The vulnerability of the iOS operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the SpringBoard component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability can allow an attacker, operating locally, to compromise the confidentiality, integrity, and accessibility of protected information through...