CVE-2014-5136

Cross-site scripting XSS vulnerability in Innovative Interfaces Sierra Library Services Platform 1.23 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2014-5136

Sierra Library Services Platform (Product: Sierra LSP) v1.2_3 is affected by CVE-2014-5136, a reflected cross-site scripting (XSS) vulnerability. The issue arises from unsanitized data in application query parameters, allowing an attacker to inject arbitrary JavaScript in the victim’s browser via...

CVE-2014-5137

The Sierra Library Services Platform (Product: Sierra Library Services Platform; Vendor: Innovative Interfaces Inc) 1.2_3 is affected by CVE-2014-5137 due to a login response discrepancy that differs based on whether a user account exists. This behavior enables remote attackers to enumerate valid...

CVE-2014-5137

Innovative Interfaces Sierra Library Services Platform 1.23 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule...

PT-2014-6300

Name of the Vulnerable Software and Affected Versions Innovative Interfaces Sierra Library Services Platform version 1.2 3 Description The issue allows remote attackers to enumerate account names via a series of login requests. This is possibly related to the Webpac Pro submodule, where different...

CVE-2014-5137: Exposure of Sensitive Information to an Unauthorized Actor

Innovative Interfaces Sierra Library Services Platform 1.23 provides different responses for login request depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of login requests, possibly related to the Webpac Pro submodule...

CVE-2014-5136: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Innovative Interfaces Sierra Library Services Platform 1.23 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters...

PT-2014-6299

Name of the Vulnerable Software and Affected Versions Innovative Interfaces Sierra Library Services Platform version 1.2 3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. This could potentially lead to...

CVE-2012-4713

Integer signedness error in RNADiagnostics.dll in Rockwell Automation FactoryTalk Services Platform FTSP CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 allows remote attackers to cause a denial of service service outage or RNADiagReceiver.exe daemon crash via UDP...

Integer overflow

Integer overflow in RNADiagnostics.dll in Rockwell Automation FactoryTalk Services Platform FTSP CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 allows remote attackers to cause a denial of service service outage or RNADiagReceiver.exe daemon crash via UDP data th...

Integer overflow

Integer signedness error in RNADiagnostics.dll in Rockwell Automation FactoryTalk Services Platform FTSP CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 allows remote attackers to cause a denial of service service outage or RNADiagReceiver.exe daemon crash via UDP...

CVE-2012-4713

The CVE-2012-4713 entry concerns Rockwell Automation FactoryTalk Services Platform (RNADiagnostics.dll) with affected CPR9 through CPR9-SR6. The root cause is an integer signedness/input validation issue that allows remote attackers to trigger a DoS by sending UDP datagrams containing a negative ...

CVE-2012-4714

Integer overflow in RNADiagnostics.dll in Rockwell Automation FactoryTalk Services Platform FTSP CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 allows remote attackers to cause a denial of service service outage or RNADiagReceiver.exe daemon crash via UDP data th...

CVE-2012-4714

Rockwell Automation FactoryTalk Services Platform (FTSP) CPR9 through CPR9-SR6 contains an integer overflow in RNADiagnostics.dll that allows remote attackers to cause a DoS by sending UDP datagrams with large integers, potentially crashing RNADiagReceiver.exe. All affected versions should upgrad...

PT-2013-1712

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk Services Platform FTSP versions CPR9 through CPR9-SR6 Description The issue is related to an integer signedness error in the RNADiagnostics.dll component. This error allows remote attackers to cause a denial of...

CVE-2012-4713: Undefined Security Weakness

Integer signedness error in RNADiagnostics.dll in Rockwell Automation FactoryTalk Services Platform FTSP CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 allows remote attackers to cause a denial of service service outage or RNADiagReceiver.exe daemon crash via UDP...

CVE-2012-4714: Undefined Security Weakness

Integer overflow in RNADiagnostics.dll in Rockwell Automation FactoryTalk Services Platform FTSP CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 allows remote attackers to cause a denial of service service outage or RNADiagReceiver.exe daemon crash via UDP data th...

PT-2013-1713

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk Services Platform FTSP versions CPR9 through CPR9-SR6 Description The issue is related to an integer overflow in the RNADiagnostics.dll component. This allows remote attackers to cause a denial of service,...

Default configuration

The Teiid Java Database Connectivity JDBC socket, as used in JBoss Enterprise Data Services Platform before 5.3.0, does not encrypt login messages by default contrary to documentation and specification, which allows remote attackers to obtain login credentials via a man-in-the-middle MITM attack...

CVE-2012-3431

The vulnerability CVE-2012-3431 affects the Teiid JDBC socket used by JBoss Enterprise Data Services Platform before 5.3.0, where login messages were not encrypted by default as documented. This enables a man-in-the-middle attacker to obtain login credentials and related JDBC traffic. Remediation...