PT-2013-44: Forced browsing in Siemens WinCC and SIMATIC PCS 7

The specialists of the Positive Research center have detected a vulnerability, which can be used to gain access to usernames in Siemens WinCC and SIMATIC PCS 7. The WinCC Web Navigator 7.2 allows a user with authenticated access to probe for valid NetBIOS user names by manipulating URL parameters...

Oracle Java Runtime Environment CVE-2013-0422 Multiple Remote Code Execution Vulnerabilities

Description Oracle Java Runtime Environment is prone to multiple remote code execution vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the application. Versions prior to Oracle JRE 1.7.0 Update 11 are vulnerable. Technologies Affected CentOS CentO...

Advantech Webaccess HMISCADA Software - Persistence Cross-Site Scripting

Advantech Webaccess HMISCADA Software - Persistence Cross-Site Scripting Title : Advantech WebAccess HMI/SCADA Software Persistence Cross-Site Scripting Vulnerability Author : Antu Sanadi SecPod Technologies www.secpod.com Vendor : http://webaccess.advantech.com/ Advisory :...

Advantech WebAccess HMI/SCADA Cross Site Scripting

Title : Advantech WebAccess HMI/SCADA Software Persistence Cross-Site Scripting Vulnerability Author : Antu Sanadi SecPod Technologies www.secpod.com Vendor : http://webaccess.advantech.com/ Advisory : http://secpod.org/blog/?p=569...

Advantech WebAccess HMI/SCADA Software Persistence XSS Vulnerability

Advantech WebAccess HMI/SCADA software version 7.0-2012.12.05 suffers from a persistent cross site scripting vulnerability. Title : Advantech WebAccess HMI/SCADA Software Persistence Cross-Site Scripting Vulnerability Author : Antu Sanadi SecPod Technologies www.secpod.com Vendor :...

Open-Realty CMS 3.x | Cross Site Request Forgery (CSRF) Vulnerability

OVERVIEW Open-Realty CMS 3.x versions are vulnerable to Cross Site Request Forgery. 2. BACKGROUND Open-Realty is the world's leading real estate listing marketing and management CMS application, and has enjoyed being the real estate web site software of choice for professional web site...

CA20121220-01: Security Notice for CA IdentityMinder

CA20121220-01: Security Notice for CA IdentityMinder Issued: December 20, 2012 CA Technologies Support is alerting customers to two potential risks in CA IdentityMinder formerly known as CA Identity Manager. Two vulnerabilities exist that can allow a remote attacker to execute arbitrary commands,...

Open-Realty CMS 3.x | Persistent Cross Site Scripting (XSS) Vulnerability

OVERVIEW Open-Realty CMS 3.x versions are vulnerable to Persistent Cross Site Scripting XSS. 2. BACKGROUND Open-Realty is the world's leading real estate listing marketing and management CMS application, and has enjoyed being the real estate web site software of choice for professional web site...

Open-Realty CMS 3.x Cross Site Scripting

OVERVIEW Open-Realty CMS 3.x versions are vulnerable to Persistent Cross Site Scripting XSS. 2. BACKGROUND Open-Realty is the world's leading real estate listing marketing and management CMS application, and has enjoyed being the real estate web site software of choice for professional web site...

Open-Realty CMS 3.x Cross Site Request Forgery

OVERVIEW Open-Realty CMS 3.x versions are vulnerable to Cross Site Request Forgery. 2. BACKGROUND Open-Realty is the world's leading real estate listing marketing and management CMS application, and has enjoyed being the real estate web site software of choice for professional web site...

PT-2014-12: Information Disclosure in Siemens SIMATIC WinCC

The specialists of the Positive Research center have detected an Information disclosure vulnerability in SIMATIC WinCC. The SIMATIC WinCC WebNavigator server at port 80/tcp and port 443/tcp could allow unauthenticated access to sensitive data if an attacker sends specially crafted HTTP requests t...

Tristar / Studio Umbrella / Intelligent Soft Solutions SQL Injection

Exploit Title : tristar Sql Injection Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://www.tristar.co.za/ Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server - win7 Dork : intext:"Website by Tristar...

PT-2013-37: Multiple Cross Site Scripting (XSS) in Wonderware Information Server

Positive Research Center experts have discovered multiple "Cross Site Scripting" vulnerabilities in Wonderware Information Server. This vulnerability enables an attacker to inject client-side script into Web pages viewed by other users or bypass client-side security mechanisms imposed by modern W...

PT-2013-39: Improper Input Validation in Wonderware Information Server

Positive Research Center experts have discovered "Improper Input Validation" vulnerability in Wonderware Information Server. WIS allows access to local resources files and internal resources via unsafe parsing of XML external entities. By using specially crafted XML files, an attacker can cause W...

CA20121205-01: Security Notice for CA XCOM Data Transport on Unix and Linux

-----BEGIN PGP SIGNED MESSAGE----- CA20121205-01: Security Notice for CA XCOM Data Transport on Unix and Linux Issued: December 5, 2012 CA Technologies Support is alerting customers to a potential risk with CA XCOM Data Transport. A vulnerability exists that can allow a remote attacker to execute...

PT-2013-73: XML External Entities Resolution vulnerability in Microsoft Office Word

The specialists of the Positive Research center have detected an XML External Entities Resolution vulnerability in Microsoft Office Word and Word Viewer. The vulnerability is possible due to unsafe parsing of XML external entities. If an attacker makes a victim open a specially crafted XML...

Fedora Update for xulrunner FEDORA-2012-18683

Check for the Version of xulrunner OpenVAS Vulnerability Test Fedora Update for xulrunner FEDORA-2012-18683 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

PT-2013-36: XML External Entity Injection in Wonderware Win-XML Exporter

Positive Research Center experts have discovered "XML External Entity Injection" vulnerability in Wonderware Win-XML Exporter. If an attacker manages to make a victim open a project that contains specially crafted XML, Wonderware Win-XML Exporter will automatically send the contents of local or...

Autonomy Keyview IDOL contains multiple vulnerabilities in file parsers

Overview Autonomy Keyview IDOL contains multiple vulnerabilities in file parsers. These vulnerabilities could allow a remote attacker to execute arbitrary code on an affected system. Description Autonomy Keyview IDOL is a set of libraries that can decode over 1,000 different file formats. The...

Open-Realty 2.5.8 Cross Site Request Forgery Vulnerability

Open-Realty versions 2.5.8 and below suffer from a cross site request forgery vulnerability. Open-Realty 2.5.8 Cross Site Request Forgery Vulnerability 1. OVERVIEW Open-Realty 2.5.8 and lower versions are vulnerable to Cross Site Request Forgery. 2. BACKGROUND Open-Realty is the world's leading...