CVE-2011-1566: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in dc.exe 9.00.00.11059 and earlier in 7-Technologies Interactive Graphical SCADA System IGSS allows remote attackers to execute arbitrary programs via ..\ dot dot backslash sequences in opcodes 1 0xa and 2 0x17 to TCP port 12397...

CVE-2011-1567: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in IGSSdataServer.exe 9.00.00.11063 and earlier in 7-Technologies Interactive Graphical SCADA System IGSS allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via crafted 1 ListAll, 2 Write File, 3 ReadFile, 4 Delete, ...

PT-2011-3224

Name of the Vulnerable Software and Affected Versions 7-Technologies Interactive Graphical SCADA System IGSS version 9.00.00.11063 and earlier Description The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted commands. The affected commands...

PT-2011-3225

Name of the Vulnerable Software and Affected Versions 7-Technologies Interactive Graphical SCADA System IGSS versions 9.00.00.11063 and earlier, 9.00.00.11074 Description The issue is related to a format string vulnerability in the logText function in shmemmgr9.dll, which is part of...

AR Web Content Manager (AWCM) Cross-Site scripting Vulnerability

AR Web Content Manager AWCM v2.2 Cross-Site scripting Vulnerability SecPod Technologies www.secpod.com Author: Antu Sanadi SecPod ID: 1012 21/03/2011 Issue Discovered 24/03/2011 Vendor Notified 24/03/2011 Vendor Responded 25/03/2011 Vendor Solution Class: Cross-Site Scripting Severity: Medium...

Webworx Technologies Lahore Pakistan PHP & ASP SQL Injection

Exploit for asp platform in category web applications Title : Webworx Technologies Lahore Pakistan PHP & ASP SQL Injection Vulnerability Author: eXeSoul Home : www.indishell.in or www.andhrahackers.com Email : email protected date : 1/04/2011 d0rk:- "Website Developed By Webworx Technologies Laho...

Webworx Technologies Lahore Pakistan PHP / ASP SQL Injection

Title : Webworx Technologies Lahore Pakistan PHP & ASP SQL Injection Vulnerability Author: eXeSoul Home : www.indishell.in or www.andhrahackers.com Email : [email protected] date : 1/04/2011 d0rk:- "Website Developed By Webworx Technologies Lahore Pakistan" category : Web Apps SQli PHP & ASP Go T...

AR Web Content Manager 2.2 Cross Site Scripting

AR Web Content Manager AWCM v2.2 Cross-Site scripting Vulnerability SecPod Technologies www.secpod.com Author: Antu Sanadi SecPod ID: 1012 21/03/2011 Issue Discovered 24/03/2011 Vendor Notified 24/03/2011 Vendor Responded 25/03/2011 Vendor Solution Class: Cross-Site Scripting Severity: Medium...

Microsoft Cites Progress in SDL Report, Advocates More Adoption of ASLR, DEP

In the more than nine years since Bill Gates’s Trustworthy Computing email kicked off Microsoft’s comprehensive, company-wide security initiative, the company has not only committed a tremendous amount of money and resources to the project but also has been quite open and public about the process...

RealFlex Technologies RealWin Detection

Binary data scadaapprealwindetect.nbin...

Fedora Update for galeon FEDORA-2011-3917

Check for the Version of galeon OpenVAS Vulnerability Test Fedora Update for galeon FEDORA-2011-3917 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Vulnerabilities in some SCADA server softwares

The following are almost all the vulnerabilities I found for a quick experiment some months ago in certain well known server-side SCADA softwares still vulnerable in this moment. In case someone doesn't know SCADA like me before the tests: it's just one or more softwares usually a core, a graphic...

CORE-2011-0208: VLC Vulnerabilities handling .AMV and .NSV files

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ VLC Vulnerabilities handling .AMV and .NSV files 1. Advisory Information Title: VLC Vulnerabilities handling .AMV and .NSV files Advisory ID: CORE-2011-0208 Advisory URL:...

7-Technologies IGSS 9 IGSSdataServer .RMS Rename Buffer Overflow

This module exploits a vulnerability found on 7-Technologies IGSS 9. By supplying a long string of data to the 'Rename' 0x02, 'Delete' 0x03, or 'Add' 0x04 command, a buffer overflow condition occurs in IGSSdataServer.exe while handing an RMS report, which results arbitrary code execution under th...

IGSS Data Server Directory Traversal Arbitrary File Access

Binary data scadaigssdirtraversal.nbin...

7-Technologies / Schneider-Electric IGSS Detection

Binary data scadaapp7tigssdetect.nbin...

7-Technologies IGSS IGSSdataServer.exe Stack Buffer Overflow

This module exploits a vulnerability in the igssdataserver.exe component of 7-Technologies IGSS up to version 9.00.00 b11063. While processing a ListAll command, the application fails to do proper bounds checking before copying data into a small buffer on the stack. This causes a buffer overflow...

VLC Vulnerabilities handling .AMV and .NSV files

Core Security Technologies - Corelabs Advisory VLC Vulnerabilities handling .AMV and .NSV files 1. Advisory Information Title: VLC Vulnerabilities handling .AMV and .NSV files Advisory ID: CORE-2011-0208 Advisory URL: http://www.coresecurity.com/content/vlc-vulnerabilities-amv-nsv-files Date...

[PRE-SA-2011-02] Information disclosure vulnerability in the OSF partition handling code of the Linux kernel

PRE-CERT Security Advisory ========================== Advisory: PRE-SA-2011-02 Released on: 16 Mar 2011 Last updated on: 16 Mar 2011 Affected product: Linux Kernel 2.4 and 2.6 Impact: disclosure of sensitive information Origin: storage devices Credit: Timo Warns PRESENSE Technologies GmbH CVE...

Dozens of SCADA Exploits, Proof-of-concept Code Published

Exploits for scores of vulnerabilities in supervisory control and data acquisition software SCADA were made public on Monday, according to a report by The Register. 34 holes were published on Seclists.org’s Bugtraq mailing list for programs by Siemens, Iconics, 7-Technologies, Datac and Control...