ICSA-17-355-01_Moxa NPort W2150A and W2250A

CVSS v3 6.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Moxa Equipment: NPort W2150A and W2250A Vulnerability: Credentials Management AFFECTED PRODUCTS The following versions of NPort, a serial network interface, are affected: NPort W2150A Versions prior to 1.11, and NPort...

The lazy_initialize function in lib/resolv.rb in Ruby

The lazyinitialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernelopen, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input ma...

Ecava IntegraXor

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Ecava Equipment: IntegraXor Vulnerabilities: SQL Injection AFFECTED PRODUCTS The following version of IntegraXor, a web SCADA/HMI solution, is affected: Ecava IntegraXor v 6.1.1030.1 and prior. IMPACT Successful...

WECON Technology Co., Ltd. LeviStudio HMI Editor

CVSS v3 7.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: WECON Technology Co., Ltd. WECON Equipment: LeviStudio HMI editor Vulnerability: Heap-based Buffer Overflow AFFECTED PRODUCTS All versions of LeviStudio HMI, an HMI editor, are affected. IMPACT Successful exploitation...

ABB Ellipse

CVSS v3 6.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: ABB Equipment: Ellipse Vulnerability: Unprotected Transport of Credentials AFFECTED PRODUCTS ABB reports that the vulnerability affects Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 including Ellipse...

abqtodo.com XSS vulnerability

Open Bug Bounty ID: OBB-454908 Description| Value ---|--- Affected Website:| abqtodo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

JBOSSAS 4.x Deserializer Vulnerability

Exploit for java platform in category web applications JBOSSAS 4.x Deserializer Vulnerability The MITRE CVE dictionary describes this issue as: https://access.redhat.com/security/cve/cve-2017-7504 HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is...

JBOSSAS 4.x 反序列化命令执行漏洞（CVE-2017-7504）

The MITRE CVE dictionary describes this issue as: HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server = Jboss 4.X does not restrict the classes for which it performs deserialization, which allows...

Siemens Industrial Products (Update S)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION : Remotely exploitable/low attack complexity Vendor : Siemens Equipment : Industrial Products Vulnerability : Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled ICSA-17-339-01 Siemens...

CVE-2017-8157

OceanStor 5800 V3 with software V300R002C00 and V300R002C10, OceanStor 6900 V3 V300R001C00 has an information leakage vulnerability. Products use TLS1.0 to encrypt. Attackers can exploit TLS1.0's vulnerabilities to decrypt data to obtain sensitive information...

JBOSSAS 5.x/6.x 反序列化命令执行漏洞（CVE-2017-12149）

CVE-2017-12149 It was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization. This allows an attacker to execute arbitrary code via crafted serialized data. Find out more about CVE-2017-12149 from the MITRE CV...

CVE-2017-8157: Use of a Broken or Risky Cryptographic Algorithm

OceanStor 5800 V3 with software V300R002C00 and V300R002C10, OceanStor 6900 V3 V300R001C00 has an information leakage vulnerability. Products use TLS1.0 to encrypt. Attackers can exploit TLS1.0's vulnerabilities to decrypt data to obtain sensitive information...

PT-2017-18165

Name of the Vulnerable Software and Affected Versions OceanStor 5800 V3 versions V300R002C00 through V300R002C10 OceanStor 6900 V3 version V300R001C00 Description The issue is related to an information leakage vulnerability. The products use TLS1.0 for encryption, which has known vulnerabilities...

Technicolor TG789vn v3 HTTP DoS Exploit

Exploit for hardware platform in category dos / poc !/usr/bin/python By Angel Paillalef Silva Vendor: Movistar Router: Technicolor TG789vn v3 Usage: python exploit.py import socket import sys import urllib2 host = "" port = "" iflensys.argv = 2: host = sys.argv1 port = sys.argv2 else: print "nume...

abudhabi.dubaiposter.com XSS vulnerability

Open Bug Bounty ID: OBB-410543 Description| Value ---|--- Affected Website:| abudhabi.dubaiposter.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventio...

ABB FOX515T

CVSS v3 6.2 ATTENTION: Low skill level to exploit. Vendor: ABB Equipment: FOX515T Vulnerability: Improper Input Validation AFFECTED PRODUCTS The following versions of FOX515T, a communication interface, are affected: FOX515T release 1.0 IMPACT Successful exploitation of this vulnerability could...

Rockwell Automation Stratix 5100 (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.9 ATTENTION: Exploitable remotely/public exploits are available Vendor: Rockwell Automation Equipment: Stratix 5100 Wireless Access Point/Workgroup Bridge Vulnerability: Reusing a Nonce 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...

UBUNTU-CVE-2015-1239

Double free vulnerability in the j2kreadppmv3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service process crash via a crafted PDF...

PT-2017-6480 · Google +2 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: OpenJPEG versions before r2997 PDFium in Google Chrome affected versions not specified Description: The issue is related to a double free vulnerability in the j2k read ppm v3 function. This vulnerability allows remote attackers to cause a...

ICSA-17-306-01 Siemens SIMATIC PCS 7 (Update A)

1. EXECUTIVE SUMMARY CVSS v3 4.9 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIMATIC PCS 7 Vulnerabilities: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-17-306-01 Siemens SIMATIC...