ScadaX News

@ScadaXNews

Channel's geo and language: not specified, not specified

Category: not specified

https://twitter.com/ScadaXSecurity

Related channels

Channel's geo and language

not specified, not specified

ScadaX News

24 Jul 2019, 16:54

IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the attacker could read arbitrary files.

UNCONTROLLED RESOURCE CONSUMPTION CWE-400
This vulnerability can be triggered when an attacker provides the target with a rogue project file (.frc2). Once a user opens the rogue project, CPU exhaustion occurs, which causes the software to quit responding until the application is restarted.

https://www.us-cert.gov/ics/advisories/icsa-19-204-01

Mitsubishi Electric FR Configurator2 | CISA

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low skill level to exploit Vendor: Mitsubishi Electric Equipment: Mitsubishi Electric FR Configurator2 Vulnerabilities: Improper Restriction of XML External Entity Reference, Uncontrolled Resource Consumption 2. RISK EVALUATION Successful exploitatio...

72 1 0

ScadaX News

24 Jul 2019, 16:52

STACK-BASED BUFFER OVERFLOW CWE-121
The application fails to prevent an exception handler from being overwritten with arbitrary code.

https://www.us-cert.gov/ics/advisories/icsa-19-204-02

NREL EnergyPlus | CISA

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Low skill level to exploit Vendor: National Renewable Energy Laboratory (NREL) Equipment: EnergyPlus Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitr...

7 0 0

ScadaX News

24 Jul 2019, 16:51

UNQUOTED SEARCH PATH OR ELEMENT CWE-428
Some services have an unquoted service path. If an authenticated user is able to insert code in the system root path, that code can be executed during the application startup.

https://www.us-cert.gov/ics/advisories/icsa-19-199-01

Johnson Controls exacqVision Server | CISA

1. EXECUTIVE SUMMARY CVSS v3 6.7 Vendor: Exacq Technologies, Inc., a subsidiary of Johnson Controls Equipment: exacqVision Server Vulnerability: Unquoted Search Path or Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthenticated user to elevate their ...

7 0 0

ScadaX News

24 Jul 2019, 16:48

IMPROPER ACCESS CONTROL CWE-284
The integrated configuration web application (TIA Administrator) may allow an attacker to execute certain application commands without proper authentication.

https://www.us-cert.gov/ics/advisories/icsa-19-192-03

Siemens TIA Administrator (TIA Portal) | CISA

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: TIA Administrator (TIA Portal) Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an execution of some commands without proper auth...

7 0 0

ScadaX News

24 Jul 2019, 16:48

UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434
The SIMATIC WinCC DataMonitor web application of the affected products allows an authenticated user with network access to the WinCC DataMonitor application to upload arbitrary ASPX code.
Successful exploitation requires no user interaction and may impact the confidentiality, integrity, and availability of the affected device. The vulnerability is relevant only in situations where an attacker has access via the web interface but not to the directory structure.

https://www.us-cert.gov/ics/advisories/icsa-19-192-02

Siemens SIMATIC WinCC and PCS7 | CISA

1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIMATIC WinCC and SIMATIC PCS7 Vulnerability: Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Successful exploitation of this vulnerability could cause a de...

7 0 0