PT-2014-19: Multiple Cross-Site Scripting (XSS) vulnerabilities in Wonderware Information Server

The specialists of the Positive Research center have detected multiple Cross-Site Scripting vulnerabilities in Wonderware Information Server. WIS fails to validate, filter, or encode user input before returning it to a user’s web client, which allows remote attackers to inject arbitrary web scrip...

PT-2014-17: Weak encryption of account data in Wonderware Information Server

The specialists of the Positive Research center have detected a Weak encryption of account data vulnerability in Wonderware Information Server. Encryption of WIS is insufficient. This vulnerability could allow elevation of privileges if an attacker decrypts the credentials. The system would need ...

Important: Red Hat Security Advisory: rhev-hypervisor6 security update

An updated rhev-hypervisor6 package that fixes multiple security issues is now available. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for eac...

Office Assistant Pro v2.2.2 iOS - File Include Vulnerability

Document Title: =============== Office Assistant Pro v2.2.2 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1197 Release Date: ============= 2014-02-13 Vulnerability Laboratory ID VL-ID: ==================================...

Ubuntu 12.04 LTS / 12.10 / 13.10 : clamav update (USN-2157-1)

This updates ClamAV to a new major version in order to gain new detection technologies and maintain proper compatibility with the virus signature database. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has...

USN-2157-1: ClamAV update

This updates ClamAV to a new major version in order to gain new detection technologies and maintain proper compatibility with the virus signature database...

Allied Telesis AT-RG634A ADSL Broadband Router - Web Shell

Allied Telesis AT-RG634A ADSL Broadband Router - Web Shell Title: Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell. Vulnerability Information: - CVE: CVE-2014-1982 - Type of Vulnerability: - CWE-78 : OS Command Injection - CWE-306 : Missing...

Allied Telesis AT-RG634A Unauthenticated Webshell

Title: Allied Telesis AT-RG634A ADSL Broadband router hidden administrative unauthenticated webshell. Vulnerability Information: - CVE: CVE-2014-1982 - Type of Vulnerability: - CWE-78 : OS Command Injection - CWE-306 : Missing Authentication for Critical Function Affected products: - Allied Teles...

PT-2014-15: Privilege Gaining in Siemens SIMATIC WinCC

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in SIMATIC WinCC. Access permissions on system objects could allow a local user to obtain limited escalated privileges within the operating system. How to fix Update your software up to the latest...

CentOS Update for gnutls CESA-2014:0246 centos6

Check for the Version of gnutls OpenVAS Vulnerability Test CentOS Update for gnutls CESA-2014:0246 centos6 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under th...

CentOS Update for gnutls CESA-2014:0247 centos5

Check for the Version of gnutls OpenVAS Vulnerability Test CentOS Update for gnutls CESA-2014:0247 centos5 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under th...

Huawei Technologies eSpace Meeting Service 1.0.0.23 - Local Privilege Escalation

Huawei Technologies eSpace Meeting Service 1.0.0.23 - Local Privilege Escalation Huawei Technologies eSpace Meeting Service 1.0.0.23 Local Privilege Escalation Vendor: Huawei Technologies Co., Ltd. Product web page: http://www.huawei.com Affected version: 1.0.0.23 V100R001C03SPC201B050 Summary:...

CentOS Update for gnutls CESA-2014:0247 centos5

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei eSpace Meeting Service 1.0.0.23 Privilege Escalation

Huawei Technologies eSpace Meeting Service 1.0.0.23 Local Privilege Escalation Vendor: Huawei Technologies Co., Ltd. Product web page: http://www.huawei.com Affected version: 1.0.0.23 V100R001C03SPC201B050 Summary: Huawei's eSpace Meeting solution fully meets the needs of enterprise customers for...

Huawei Technologies eSpace Meeting Service 1.0.0.23 Local Privilege Escalation

Summary Huawei's eSpace Meeting solution fully meets the needs of enterprise customers for an integrated daily collaboration system by integrating the conference server, conference video terminal, conference user authorization, and teleconference. Description The application is vulnerable to an...

PT-2014-47: Arbitrary memory write in Honeywell EPKS

The specialists of the Positive Research center have detected an Arbitrary memory write vulnerability in Honeywell EPKS. Arbitratry memory write was discovered in function readexactsilentmaster from dualonsrv.exe module which could lead to possible remote code execution or denial of service. How ...

PT-2014-44: Heap-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Heap-based buffer overflow vulnerability in Honeywell EPKS. Heap-based buffer overflow was discovered in function svcdataio from dualonsrv.exe module which could lead to possible remote code execution or denial of service How to fix...

PT-2014-36: Stack-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Stack-based buffer overflow vulnerability in Honeywell EPKS. Stack-based buffer overflow was discovered in function hscsconf which could lead possible remote code execution or denial of service. How to fix Update your sofware up to t...

PT-2014-39: Directory traversal in Honeywell EPKS

The specialists of the Positive Research center have detected a Directory traversal vulnerability in Honeywell EPKS. Function hscsconfpnt from module confd.exe doesn’t check input and output filename parameters for command which leads to file inclusion as stated in previous vulnerability and also...

PT-2014-35: Stack-based buffer overflow in Honeywell EPKS

The specialists of the Positive Research center have detected a Stack-based buffer overflow vulnerability in Honeywell EPKS. Stack-based buffer overflow was discovered in function hscsconf which could lead possible remote code execution or denial of service. How to fix Update your sofware up to t...