VARIoT IoT vulnerabilities database

The TP-LINK TD-8810 is a wireless router. The device does not correctly verify the HTTP request submitted by the user, which may cause the attacker to perform management operations with the target user authority. When the logged in user clicks on the attacker's specially crafted URI, the device can be restarted. Exploiting this issue may allow a remote attacker to change a device's configuration and perform other unauthorized actions. ---------------------------------------------------------------------- The Secunia CSI 5.0 Beta - now available for testing Find out more, take a free test drive, and share your opinion with us: http://secunia.com/blog/242 ---------------------------------------------------------------------- TITLE: TP-LINK TD-8810 Cross-Site Request Forgery Vulnerability SECUNIA ADVISORY ID: SA45904 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/45904/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=45904 RELEASE DATE: 2011-09-08 DISCUSS ADVISORY: http://secunia.com/advisories/45904/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/45904/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=45904 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in TP-LINK TD-8810, which can be exploited by malicious people to conduct cross-site request forgery attacks. This can be exploited to e.g. SOLUTION: Do not browse untrusted websites or follow untrusted links while logged in to the device. PROVIDED AND/OR DISCOVERED BY: C4SS!0 G0M3S ORIGINAL ADVISORY: http://packetstormsecurity.org/files/view/104735/tplink-xsrf.txt OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The D-Link DIR-300 is a wireless router device. The D-Link DIR-300 has a security vulnerability that allows remote attackers to execute arbitrary code

Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related to Output.pm. LibLime Koha has a local file containing vulnerability. An attacker can exploit a vulnerability to gain sensitive information and execute arbitrary code in the context of a web server process, jeopardizing applications and computers. This may allow the attacker to compromise the application and computer; other attacks are also possible. Koha 3.4.x prior to 3.4.7 and 3.6.x prior to 3.6.1 are vulnerable. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: Koha "KohaOpacLanguage" Local File Inclusion Vulnerability SECUNIA ADVISORY ID: SA46980 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/46980/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=46980 RELEASE DATE: 2011-11-25 DISCUSS ADVISORY: http://secunia.com/advisories/46980/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/46980/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=46980 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Akin Tosunlar has discovered a vulnerability in Koha, which can be exploited by malicious people to disclose sensitive information. Input passed to the "KohaOpacLanguage" cookie value in cgi-bin/koha/mainpage.pl is not properly verified in cgi-bin/opac/opac-main.pl before being used to include files. The vulnerability is confirmed in version 4.02.06. Other versions may also be affected. SOLUTION: Fixed in the GIT repository. Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ PROVIDED AND/OR DISCOVERED BY: Akin Tosunlar, Vigasis Labs ORIGINAL ADVISORY: Vigasis Labs: http://www.vigasis.com/en/?guncel_guvenlik=LibLime%20Koha%20%3C=%204.2%20Local%20File%20Inclusion%20Vulnerability&lnk=exploits/18153 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Unspecified vulnerability in Hitachi COBOL2002 Net Developer, Net Server Suite, and Net Client Suite 01-00, 01-01 through 01-01-/D, 01-02 through 01-02-/F, 01-03 through 01-03-/F, 02-00 through 02-00-/D, 02-01 through 02-01-/C, and possibly other versions before 02-01-/D allows remote attackers to execute arbitrary code via unknown attack vectors. Multiple Hitachi COBOL2002 products have security vulnerabilities that allow attackers to take control of target user systems. No detailed vulnerability details are provided at this time. Hitachi COBOL2002 is prone to an unspecified remote code-execution vulnerability. Successful exploits will compromise the application and possibly the underlying system. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: Hitachi COBOL2002 Products Unspecified Vulnerability SECUNIA ADVISORY ID: SA47612 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47612/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47612 RELEASE DATE: 2012-01-20 DISCUSS ADVISORY: http://secunia.com/advisories/47612/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47612/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47612 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Hitachi has reported a vulnerability in some COBOL2002 products, which can be exploited by malicious users to compromise a vulnerable system. No further information is currently available. The vulnerability is reported in versions 02-00 through 02-00-/D and 02-01 through 02-01-/C. SOLUTION: Update to version 02-01-/D. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-002/index.html OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

The Barracuda Control Center is a control center application for Barracuda products. The Barracudas Control Center 620 has multiple persistent input validation vulnerabilities, and local non-privileged user accounts can implement/inject malicious persistent script code. When the user is authenticated, it can lead to information leakage, access to internal servers, and content. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible

Koha, the first open source library automation system, was born in 1999. Koha was originally designed to target the smallest hardware resources. Koha's 'help.pl' file is prone to injection vulnerabilities. An attacker could exploit this vulnerability to view local files and execute scripts under the web server process. There may be further danger of attack. A remote attacker successfully exploited this vulnerability to execute arbitrary code, which could cause a denial of service if the exploit failed. Koha is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. This may aid in further attacks. Koha 3.4.x prior to 3.4.7 and 3.6.x prior to 3.6.1 are vulnerable

Directory traversal vulnerability in the web server in Cogent DataHub 7.1.1.63 and earlier allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in an HTTP request. Cogent DataHub is software for SCADA and automation. The Cogent DataHub server/service uses a custom web server that listens on port 80. The software does not handle the directory traversal sequence correctly. An attacker can exploit the vulnerability to download files on the server. Cogent DataHub is prone to a directory-traversal vulnerability and an information-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting the issues may allow an attacker to obtain sensitive information that could aid in further attacks. Cogent DataHub 7.1.1.63 is vulnerable; other versions may also be affected

The web server in Cogent DataHub 7.1.1.63 and earlier allows remote attackers to obtain the source code of executable files via a request with a trailing (1) space or (2) %2e (encoded dot). Cogent DataHub is software for SCADA and automation. The Cogent DataHub server/service uses a custom web server that listens on port 80. The software does not handle the directory traversal sequence correctly. An attacker can exploit the vulnerability to download files on the server. Cogent DataHub is prone to a directory-traversal vulnerability and an information-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting the issues may allow an attacker to obtain sensitive information that could aid in further attacks. Cogent DataHub 7.1.1.63 is vulnerable; other versions may also be affected

The D-Link DSL-2640B is a router device. The D-Link DSL-2640B has a verification bypass vulnerability. After the administrator logs in to the router, an internal attacker can connect to the WEB management interface (default http://192.168.1.1:80) and view the MAC address of the logged in administrator. Simply change the attacker's MAC address to log in to the administrator. Address, which allows unauthorized access to the device. D-Link DSL-2640B is prone to an authentication-bypass vulnerability. Attackers can exploit this issue to connect to the affected device without authentication. This may aid in further attacks

Multiple stack-based buffer overflows in the DH_OneSecondTick function in Cogent DataHub 7.1.1.63 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long (1) domain, (2) report_domain, (3) register_datahub, or (4) slave commands. The software incorrectly handles the Content-Length field (-1 or 4294967295) plus one, which can cause integer overflow. Cogent DataHub is software for SCADA and automation. Cogent DataHub has server/service listening ports 4052 and 4053, except that the second port uses SSL, the first one uses plaintext. Cogent DataHub is prone to multiple buffer-overflow and integer-overflow vulnerabilities. Successfully exploiting these issues may allow attackers to execute arbitrary code within the context of the privileged domain (Dom0). Failed attempts will likely cause denial-of-service conditions. Cogent DataHub 7.1.1.63 is vulnerable; other versions may also be affected

The Siemens SIMATIC S7-1200 CPU device is a small programmable controller from Siemens AG in Germany that meets the requirements of small and medium-sized automation systems. A denial of service vulnerability exists in Siemens SIMATIC S7-1200 and other versions. A remote attacker could exploit this vulnerability to cause the affected device to crash. The impact of this will depend on how the device is used

SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. There are several security vulnerabilities in SAP NetWeaver, including: (1) There are errors in the access control processing of some resources, which can be utilized to obtain the Runtime Workbench resources. (2) The access restriction implementation provides a \"PFL_CHECK_OS_FILE_EXISTENCE\" function with an error that can be exploited to enumerate system files. (3) Passing the \"TXVDestination\" parameter to TextContainerAdmin/administration_setup.jsp, the input of the \"ValueIndustry\", \"ValueRegion\" and \"ValueExtension\" parameters passed to the system_context_settings.jsp script is not filtered before being displayed to the user, which can result in injecting arbitrary HTML and Script code. (4) Inputs passed to bcbadmSettings.jsp via the \"cc0Host\", \"cc0Id\", \"cc0Path\", \"cc0Port\" and \"cc0Protocol\" parameters are not filtered before being returned to the user and can be exploited to execute arbitrary HTML and script code. SAP NetWeaver is prone to multiple cross-site scripting vulnerabilities, multiple HTML-injection vulnerabilities, a security-bypass vulnerability, and an information-disclosure vulnerability. Attackers can exploit these issues to execute arbitrary script code in the context of the website, steal cookie-based authentication information, disclose sensitive information, or bypass certain security restrictions

Heap-based buffer overflow in httpsvr.exe 6.0.5.3 in Sunway ForceControl 6.1 SP1, SP2, and SP3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted URL. Sunway ForceControl mainly provides general monitoring configuration software services. Sunway ForceControl is prone to multiple heap-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. ---------------------------------------------------------------------- Frost & Sullivan 2011 Report: Secunia Vulnerability Research \"Frost & Sullivan believes that Secunia continues to be a major player in the vulnerability research market due to its diversity of products that provide best-in-class coverage, quality, and usability.\" This is just one of the key factors that influenced Frost & Sullivan to select Secunia over other companies. Read the report here: http://secunia.com/products/corporate/vim/fs_request_2011/ ---------------------------------------------------------------------- TITLE: Sunway ForceControl WebServer Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA45033 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/45033/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=45033 RELEASE DATE: 2011-06-21 DISCUSS ADVISORY: http://secunia.com/advisories/45033/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/45033/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=45033 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in Sunway ForceControl, which can be exploited by malicious people to compromise a vulnerable system. The vulnerability is reported in version 6.1 SP1, SP2, and SP3. SOLUTION: Apply patches (please see the vendor's advisory for details). PROVIDED AND/OR DISCOVERED BY: The vendor credits Dillon Beresford, NSS Labs. ORIGINAL ADVISORY: http://www.sunwayland.com.cn/news_info_.asp?Nid=3593 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Stack-based buffer overflow in Azeotech DAQFactory 5.85 build 1853 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a crafted NETB packet to UDP port 20034. AzeoTech DAQFactory is an HMI/SCADA software. When the DAQFactory runs on the UDP 20034 port, the maximum received NETB message is 0x400 bytes. AzeoTech DAQFactory is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions. DAQFactory 5.85 build 1853 is vulnerable; other versions may also be affected

An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer. PcVue is a data acquisition control system software from ARC Informatique. There is a security hole in the PcVue control. You can write dword to any memory location through the GetExtendedColor method in SVUIGrd.ocx. Arc Informatique handles the \"SaveObject()\" and \"LoadObject()\" methods (SVUIGrd.ocx) with errors that can be exploited to execute virtual function calls at any memory location via a specially crafted \"aStream\" parameter. The Save/LoadObject method in SVUIGrd.ocx can be used to destroy local files. The aipgctl.ocx DeletePage method has an array overflow problem. The PcVue ActiveX control is prone to multiple vulnerabilities. Failed exploit attempts may result in a denial-of-service condition. PcVue 10.0 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: Arc Informatique Products Multiple ActiveX Controls Vulnerabilities SECUNIA ADVISORY ID: SA47131 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47131/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47131 RELEASE DATE: 2011-12-07 DISCUSS ADVISORY: http://secunia.com/advisories/47131/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47131/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47131 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in multiple Arc Informatique products, which can be exploited by malicious people to manipulate certain data and compromise a user's system. 3) An error in the "SaveObject()" method (SVUIGrd.ocx) can be exploited to overwrite arbitrary files via directory traversal sequences. The vulnerabilities are reported in the following versions: * PcVue versions 6.x, 7.x, 8.x, 9.x, and 10.x. SOLUTION: Update to a fixed version. Contact the vendor for details. PROVIDED AND/OR DISCOVERED BY: 1 - 4) Luigi Auriemma 2) ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute Information and Communication Security Technology Center (ICST) ORIGINAL ADVISORY: Luigi: http://aluigi.altervista.org/adv/pcvue_1-adv.txt ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-11-340-01.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to cause a denial of service via a crafted HTML document. Arc Informatique handles the \"DeletePage()\" method (aipgctl.ocx) with an error that can be exploited to execute virtual function calls at any memory location. PcVue is a data acquisition control system software from ARC Informatique. There is a security hole in the PcVue control. You can write dword to any memory location through the GetExtendedColor method in SVUIGrd.ocx. The Save/LoadObject method in the SVUIGrd.ocx control is used directly as a function pointer, and there is an arbitrary code execution vulnerability. The Save/LoadObject method in SVUIGrd.ocx can be used to destroy local files. The aipgctl.ocx DeletePage method has an array overflow problem. The PcVue ActiveX control is prone to multiple vulnerabilities. Successfully exploiting these issues allows remote attackers to create or overwrite arbitrary local files and execute arbitrary code. Failed exploit attempts may result in a denial-of-service condition. PcVue 10.0 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: Arc Informatique Products Multiple ActiveX Controls Vulnerabilities SECUNIA ADVISORY ID: SA47131 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47131/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47131 RELEASE DATE: 2011-12-07 DISCUSS ADVISORY: http://secunia.com/advisories/47131/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47131/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47131 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in multiple Arc Informatique products, which can be exploited by malicious people to manipulate certain data and compromise a user's system. 3) An error in the "SaveObject()" method (SVUIGrd.ocx) can be exploited to overwrite arbitrary files via directory traversal sequences. The vulnerabilities are reported in the following versions: * PcVue versions 6.x, 7.x, 8.x, 9.x, and 10.x. SOLUTION: Update to a fixed version. Contact the vendor for details. PROVIDED AND/OR DISCOVERED BY: 1 - 4) Luigi Auriemma 2) ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute Information and Communication Security Technology Center (ICST) ORIGINAL ADVISORY: Luigi: http://aluigi.altervista.org/adv/pcvue_1-adv.txt ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-11-340-01.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code via a large value for an integer parameter, leading to a buffer overflow. PcVue is a data acquisition control system software from ARC Informatique. There is a security hole in the PcVue control. You can write dword to any memory location through the GetExtendedColor method in SVUIGrd.ocx. The Arc Informatique \"GetExtendedColor()\" method (SVUIGrd.ocx) has an error that can be exploited to corrupt memory. The Save/LoadObject method in the SVUIGrd.ocx control is used directly as a function pointer, and there is an arbitrary code execution vulnerability. The Save/LoadObject method in SVUIGrd.ocx can be used to destroy local files. The aipgctl.ocx DeletePage method has an array overflow problem. The PcVue ActiveX control is prone to multiple vulnerabilities. Failed exploit attempts may result in a denial-of-service condition. PcVue 10.0 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: Arc Informatique Products Multiple ActiveX Controls Vulnerabilities SECUNIA ADVISORY ID: SA47131 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47131/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47131 RELEASE DATE: 2011-12-07 DISCUSS ADVISORY: http://secunia.com/advisories/47131/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47131/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47131 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in multiple Arc Informatique products, which can be exploited by malicious people to manipulate certain data and compromise a user's system. 1) An error when handling the "SaveObject()" and "LoadObject()" methods (SVUIGrd.ocx) can be exploited to perform a virtual function call into an arbitrary memory location via a specially crafted "aStream" argument. The vulnerabilities are reported in the following versions: * PcVue versions 6.x, 7.x, 8.x, 9.x, and 10.x. SOLUTION: Update to a fixed version. Contact the vendor for details. PROVIDED AND/OR DISCOVERED BY: 1 - 4) Luigi Auriemma 2) ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute Information and Communication Security Technology Center (ICST) ORIGINAL ADVISORY: Luigi: http://aluigi.altervista.org/adv/pcvue_1-adv.txt ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-11-340-01.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calls to unknown methods. PcVue is a data acquisition control system software from ARC Informatique. There is a security hole in the PcVue control. You can write dword to any memory location through the GetExtendedColor method in SVUIGrd.ocx. The Save/LoadObject method in the SVUIGrd.ocx control is used directly as a function pointer, and there is an arbitrary code execution vulnerability. The Save/LoadObject method in SVUIGrd.ocx can be used to destroy local files. The aipgctl.ocx DeletePage method has an array overflow problem. The Arc Informatique \"SaveObject()\" method (SVUIGrd.ocx) has an error that can be exploited to overwrite any file with a directory traversal sequence. The PcVue ActiveX control is prone to multiple vulnerabilities. Failed exploit attempts may result in a denial-of-service condition. PcVue 10.0 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Secunia is hiring! Find your next job here: http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: Arc Informatique Products Multiple ActiveX Controls Vulnerabilities SECUNIA ADVISORY ID: SA47131 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/47131/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=47131 RELEASE DATE: 2011-12-07 DISCUSS ADVISORY: http://secunia.com/advisories/47131/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/47131/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=47131 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in multiple Arc Informatique products, which can be exploited by malicious people to manipulate certain data and compromise a user's system. 1) An error when handling the "SaveObject()" and "LoadObject()" methods (SVUIGrd.ocx) can be exploited to perform a virtual function call into an arbitrary memory location via a specially crafted "aStream" argument. The vulnerabilities are reported in the following versions: * PcVue versions 6.x, 7.x, 8.x, 9.x, and 10.x. SOLUTION: Update to a fixed version. Contact the vendor for details. PROVIDED AND/OR DISCOVERED BY: 1 - 4) Luigi Auriemma 2) ICS-CERT credits Kuang-Chun Hung, Security Research and Service Institute Information and Communication Security Technology Center (ICST) ORIGINAL ADVISORY: Luigi: http://aluigi.altervista.org/adv/pcvue_1-adv.txt ICS-CERT: http://www.us-cert.gov/control_systems/pdf/ICSA-11-340-01.pdf OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Buffer overflow in TurboPower Abbrevia before 4.0, as used in ScadaTEC ScadaPhone 5.3.11.1230 and earlier, ScadaTEC ModbusTagServer 4.1.1.81 and earlier, and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ZIP file. A failed attack can result in a denial of service. To trigger this vulnerability, you need to trick the target user into loading an object from the zip file. ScadaTEC ModbusTagServer and ScadaPhone are prone to a remote buffer-overflow vulnerability. The following versions are vulnerable: ScadaTEC ScadaPhone 5.3.11.1230 and prior. ScadaTEC ModbusTagServer 4.1.1.81 and prior

RabbitWiki has a cross-site scripting vulnerability. The vulnerability stems from the insufficient filtering of data provided to users. An attacker could exploit the vulnerability to execute arbitrary script code in an uninformed user's browser within the context of the affected site, stealing a cookie-based authentication certificate and performing other attacks. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. cookie Certificate to perform other attacks