VARIoT IoT vulnerabilities database

ABB PCM600 before 2.7 uses an improper hash algorithm for the main application password, which makes it easier for local users to obtain sensitive cleartext information by leveraging read access to the ACTConfig configuration file. ABB PCM600 is a protection and control IED manager for the energy industry. A local attacker could exploit this vulnerability to access affected devices. ABB PCM600 is prone to following security vulnerabilities: 1. An insecure password-hash vulnerability 2. Multiple insecure password storage vulnerabilities Successful attacks can allow a local attacker to gain unauthorized access to the application's users' password information. ABB PCM600 prior to 2.7 are vulnerable

ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via unspecified vectors. ABB PCM600 is a protection and control IED manager for the energy industry. A local attacker could exploit this vulnerability to access affected devices. ABB PCM600 is prone to following security vulnerabilities: 1. An insecure password-hash vulnerability 2. ABB PCM600 prior to 2.7 are vulnerable

HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 allow remote attackers to cause a denial of service via unspecified vectors. HPE LoadRunner and Performance Center There is a service disruption (DoS) There are vulnerabilities that are put into a state.Service disruption by a third party (DoS) There is a possibility of being put into a state. HPE LoadRunner and Performance Center are performance load testing software from Hewlett Packard, USA. Multiple HP Products are prone to multiple remote code-execution and denial-of-service vulnerabilities. Successfully exploiting these issues allows remote attackers to execute arbitrary code or cause denial-of-service conditions; other attacks are also possible. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c05157423 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05157423 Version: 1 HPSBGN03609 rev.1 - HPE LoadRunner and Performance Center, Remote Code Execution, Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2016-05-31 Last Updated: 2016-05-31 Potential Security Impact: Remote Code Execution, Denial of Service (DoS) Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Several potential security vulnerabilities have been identified in HPE LoadRunner and Performance Center. These vulnerabilities could be exploited remotely to allow code execution, and Denial of Service (DoS). References: CVE-2016-4359 (PSRT110020, ZDI-CAN-3516) CVE-2016-4360 (PSRT110032, ZDI-CAN-3555) CVE-2016-4361 (SSRT102274) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. http://www.hpe.com/software/updates Performance Center v11.52, please update to Performance Center v12.53 or later. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJXTuaIAAoJEGIGBBYqRO9/2jsIANv3Bafqi6/Cl1UOgtPdLau8 FWnwoZnNUS8aEa33EKMMWQBZbNbLVSkILV/JmkgASHNY5nv2hAV7XPv+UsfEjMyv 99y6qa8ejcvI3E8L5nQFri6r7v9A8PqKfAedkUuZJrDZ3GTF7xX3jnmCmYezF843 PBvIF5/ZGu45xbWb7BavgsuXGmgnk2Ol6m6J9uJMTEKECwmRA1WH1lmbXXI5lxYT Let6E0F0dVyVly9avHZYkoQZbOxErVC00tUQUONCIEaYhlxhUJZxqAtjET/SwV+0 KCgliaNiCmbsBjXI+w2diYHI1QJALWUQ5gxdPhEmOfm/hT9LQ5G5Gj7PSp1unNo= =Yk9f -----END PGP SIGNATURE-----

web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 do not restrict file paths sent to an unlink call, which allows remote attackers to delete arbitrary files via the path parameter to data/import_csv, aka ZDI-CAN-3555. HPE LoadRunner and Performance Center The data will be changed or service operation will be disturbed (DoS) There are vulnerabilities that are put into a state. Zero Day Initiative Is vulnerable to this vulnerability ZDI-CAN-3555 Was numbered.Data is changed or service operation is interrupted by a third party (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of Hewlett Packard Enterprise LoadRunner. Authentication is not required to exploit this vulnerability.The specific flaw exists within the import_csv functionality. The issue lies in the failure to restrict file paths sent to an unlink call which allows for the deletion of arbitrary files as SYSTEM. A remote attacker can leverage this vulnerability to cause a denial-of-service condition. HPE LoadRunner and Performance Center are performance load testing software from Hewlett Packard, USA. Multiple HP Products are prone to multiple remote code-execution and denial-of-service vulnerabilities. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c05157423 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c05157423 Version: 1 HPSBGN03609 rev.1 - HPE LoadRunner and Performance Center, Remote Code Execution, Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. These vulnerabilities could be exploited remotely to allow code execution, and Denial of Service (DoS). References: CVE-2016-4359 (PSRT110020, ZDI-CAN-3516) CVE-2016-4360 (PSRT110032, ZDI-CAN-3555) CVE-2016-4361 (SSRT102274) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. http://www.hpe.com/software/updates Performance Center v11.52, please update to Performance Center v12.53 or later. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJXTuaIAAoJEGIGBBYqRO9/2jsIANv3Bafqi6/Cl1UOgtPdLau8 FWnwoZnNUS8aEa33EKMMWQBZbNbLVSkILV/JmkgASHNY5nv2hAV7XPv+UsfEjMyv 99y6qa8ejcvI3E8L5nQFri6r7v9A8PqKfAedkUuZJrDZ3GTF7xX3jnmCmYezF843 PBvIF5/ZGu45xbWb7BavgsuXGmgnk2Ol6m6J9uJMTEKECwmRA1WH1lmbXXI5lxYT Let6E0F0dVyVly9avHZYkoQZbOxErVC00tUQUONCIEaYhlxhUJZxqAtjET/SwV+0 KCgliaNiCmbsBjXI+w2diYHI1QJALWUQ5gxdPhEmOfm/hT9LQ5G5Gj7PSp1unNo= =Yk9f -----END PGP SIGNATURE-----

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file. Supplementary information : CWE Vulnerability type by CWE-476: NULL Pointer Dereference (NULL Pointer dereference ) Has been identified. nginx is prone to a denial-of-service vulnerability. Attackers can exploit this issue to crash the affected application, resulting in denial-of-service conditions. nginx 1.3.9 through 1.11.0 are vulnerable. A security vulnerability exists in the os/unix/ngx_files.c file of nginx versions prior to 1.10.1 and versions 1.11.x prior to 1.11.1. ========================================================================== Ubuntu Security Notice USN-2991-1 June 02, 2016 nginx vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 15.10 - Ubuntu 14.04 LTS Summary: nginx could be made to crash if it received specially crafted network traffic. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: nginx-core 1.10.0-0ubuntu0.16.04.2 nginx-extras 1.10.0-0ubuntu0.16.04.2 nginx-full 1.10.0-0ubuntu0.16.04.2 nginx-light 1.10.0-0ubuntu0.16.04.2 Ubuntu 15.10: nginx-core 1.9.3-1ubuntu1.2 nginx-extras 1.9.3-1ubuntu1.2 nginx-full 1.9.3-1ubuntu1.2 nginx-light 1.9.3-1ubuntu1.2 Ubuntu 14.04 LTS: nginx-core 1.4.6-1ubuntu3.5 nginx-extras 1.4.6-1ubuntu3.5 nginx-full 1.4.6-1ubuntu3.5 nginx-light 1.4.6-1ubuntu3.5 In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-nginx18-nginx security update Advisory ID: RHSA-2016:1425-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2016:1425 Issue date: 2016-07-14 CVE Names: CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 CVE-2016-4450 ===================================================================== 1. Summary: An update for rh-nginx18-nginx is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: Nginx is a web and proxy server with a focus on high concurrency, performance, and low memory usage. The following packages have been upgraded to a newer upstream version: rh-nginx18-nginx (1.8.1). (CVE-2016-4450) * It was discovered that nginx could perform an out of bound read and dereference an invalid pointer when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash if nginx enabled the resolver in its configuration. (CVE-2016-0742) * A use-after-free flaw was found in the way nginx resolved certain CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to crash or, possibly, execute arbitrary code if nginx enabled the resolver in its configuration. (CVE-2016-0746) * It was discovered that nginx did not limit recursion when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to use an excessive amount of resources if nginx enabled the resolver in its configuration. (CVE-2016-0747) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The rh-nginx18-nginx service must be restarted for this update to take effect. 5. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: rh-nginx18-nginx-1.8.1-1.el6.src.rpm x86_64: rh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: rh-nginx18-nginx-1.8.1-1.el6.src.rpm x86_64: rh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: rh-nginx18-nginx-1.8.1-1.el6.src.rpm x86_64: rh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: rh-nginx18-nginx-1.8.1-1.el6.src.rpm x86_64: rh-nginx18-nginx-1.8.1-1.el6.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: rh-nginx18-nginx-1.8.1-1.el7.src.rpm x86_64: rh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1): Source: rh-nginx18-nginx-1.8.1-1.el7.src.rpm x86_64: rh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2): Source: rh-nginx18-nginx-1.8.1-1.el7.src.rpm x86_64: rh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-nginx18-nginx-1.8.1-1.el7.src.rpm x86_64: rh-nginx18-nginx-1.8.1-1.el7.x86_64.rpm rh-nginx18-nginx-debuginfo-1.8.1-1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-0742 https://access.redhat.com/security/cve/CVE-2016-0746 https://access.redhat.com/security/cve/CVE-2016-0747 https://access.redhat.com/security/cve/CVE-2016-4450 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXhy2gXlSAg2UNWIIRAjOgAJ9QjuFMrvK50IeJq8Ky7VkefuMBUwCeM+Cp ZhbDRXs2sdXbnakZ6oJi/K8= =7RBd -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201606-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: nginx: Multiple vulnerabilities Date: June 17, 2016 Bugs: #560854, #573046, #584744 ID: 201606-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in nginx, the worst of which may allow a remote attacker to cause a Denial of Service. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-servers/nginx < 1.10.1 >= 1.10.1 Description =========== Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All nginx users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.10.1" References ========== [ 1 ] CVE-2013-3587 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3587 [ 2 ] CVE-2016-0742 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0742 [ 3 ] CVE-2016-0746 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0746 [ 4 ] CVE-2016-0747 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-0747 [ 5 ] CVE-2016-4450 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4450 [ 6 ] CVE-2016-4450 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4450 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201606-06 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . For the stable distribution (jessie), this problem has been fixed in version 1.6.2-5+deb8u2. For the unstable distribution (sid), this problem has been fixed in version 1.10.1-1. We recommend that you upgrade your nginx packages

UpdateAgent in Lenovo Accelerator Application allows man-in-the-middle attackers to execute arbitrary code by spoofing an update response from susapi.lenovomm.com. Lenovo Accelerator Application is prone to a remote code-execution vulnerability.. Lenovo Accelerator Application is a set of acceleration programs specially designed for Intel chipsets by China Lenovo (Lenovo)

Lorex ECO DVR LH162400 is a digital video recorder product from Lorex Corporation in the United States. A security bypass vulnerability exists in Lorex ECO DVR LH162400 using version 5.2.0-20141008 firmware. An attacker could use this vulnerability to bypass the authentication mechanism and gain access to the affected device

Intex Wireless N150 is a wireless router product from the US Intex Corporation. Intex Wireless N150 Router with 5.07.51_en_INX01 firmware exists 1. Default password security bypass vulnerability 2. Security bypass vulnerability 3. Information disclosure vulnerability 4. Cross-site request forgery vulnerability Attackers can use these vulnerabilities to obtain sensitive information, bypass security restrictions, perform unauthorized operations, and gain access to affected devices. Intex Wireless N150 Router is prone to multiple security vulnerabilities including: 1. Other attacks are also possible

Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 and earlier allows remote attackers to read arbitrary files via unspecified vectors. Multiple wireless LAN routers provided by BUFFALO INC. contain a directory traversal vulnerability (CWE-22). Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.Arbitrary files on the server may be viewed by an attacker who can access the product. An attacker could exploit this vulnerability to read any file on the server. Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to retrieve arbitrary files from the affected system in the context of the application. Information obtained could aid in further attacks. The following versions are affected: WZR-S600DHP firmware version 2.16 and prior. WZR-600DHP3 firmware version 2.16 and prior

BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive information via unspecified vectors. Multiple Buffalo wireless LAN routers contain an information disclosure vulnerability. Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.Information such as authentication credentials may be disclosed by an unauthenticated remote attacker. The Buffalo WZR-600DHP3 and WZR-S600DHP are both wireless router products of the Buffalo Group in Japan. A remote attacker can exploit this vulnerability to obtain sensitive information

The web interface in Cisco Firepower Management Center 5.4.0 through 6.0.0.1 allows remote authenticated users to modify pages by placing crafted code in a parameter value, aka Bug ID CSCuy76517. Attackers can exploit this issue to execute arbitrary code in the context of the affected system. This issue being tracked by Cisco Bug ID CSCuy76517

Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier mishandles sessions, which allows remote attackers to bypass authentication and make arbitrary configuration changes via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlA third party may bypass authentication and change any settings. ESC 8832 is a web-based SCADA system from ESC Corporation of the United States. A security vulnerability exists in ESC 8832 3.02 and earlier. A remote attacker could exploit the vulnerability to unauthorizedly change the configuration. An authentication-bypass vulnerability 2. A privilege-escalation vulnerability An attacker can exploit these issues to bypass the authentication mechanism and to gain elevated privileges on an affected application. This may aid in further attacks. The vulnerability is caused by the program not handling sessions correctly

Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier allows remote attackers to bypass intended access restrictions and execute arbitrary functions via a modified parameter. Supplementary information : CWE Vulnerability type by CWE-284: Improper Access Control ( Inappropriate access control ) Has been identified. ESC 8832 is a web-based SCADA system from ESC Corporation of the United States. A security vulnerability exists in ESC 8832 3.02 and earlier. A remote attacker can exploit the vulnerability to gain unauthorized access by performing a brute force attack on the parameters. An authentication-bypass vulnerability 2. This may aid in further attacks

Cross-site scripting (XSS) vulnerability in vpn/js/gateway_login_form_view.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to inject arbitrary web script or HTML via the NSC_TMAC cookie. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. Citrix NetScaler Gateway 11.x versions prior to 11.0 Build 66.11 are vulnerable. Note: Citrix NetScaler Gateway is formerly known as Citrix Access Gateway Enterprise Edition. This solution provides administrators with application-level and data-level control functions to enable users to remotely access applications and data from any location

Sixnet BT-5xxx and BT-6xxx M2M devices before 3.8.21 and 3.9.x before 3.9.8 have hardcoded credentials, which allows remote attackers to obtain access via unspecified vectors. RedLionSixnetBT-5xxx is a BT series router that provides wireless connectivity for RedLion. Prior to SixnetBT-5xxxBT-6xxxM2Mdevices 3.8.2, there was a privilege escalation vulnerability in version 3.9.x prior to 3.9.8. The following products are affected: Sixnet BT-5xxx versions prior to 3.8.21. Red Lion Sixnet BT-5xxx and BT-6xxx M2M are both BT series routers of Red Lion Company in the United States that provide wireless connection functions. A security vulnerability exists in Red Lion Sixnet BT-5xxx and BT-6xxx M2M versions prior to 3.8.21 and 3.9.x prior to 3.9.8 due to the use of hard-coded certificates

Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with firmware before SP473, and AlertWerks ServSensor Contact with firmware before SP473 allow remote authenticated users to discover administrator and user passwords via unspecified vectors. Black Box AlertWerks ServSensor is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. AlertWerks ServSensor is a core product for environmental monitoring system; AlertWerks ServSensor Junior is a remote environmental monitoring host product. The following models and versions are affected: Black Box AlertWerks ServSensor, EME105A, EME106A, EME108A-R2, EME109A-R2, EME110A-R2, AlertWerks ServSensor Junior, EME102A-R2, EME103A-R2, EME104A-R2, ServSensor Junior with PoE, EME152A, EME153A, EME154A, EME155A, EME158A, AlertWerks ServSensor Contact, EME111A-20-R2, EME111A?60-R2, EME112A-20-R2, EME112A-60-R2, EME113A, EME132A-20-R ?60-R2

Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by (1) attending or (2) hosting a meeting, aka Bug ID CSCux84312. Cisco WebEx Meeting Center is prone to a user-enumeration vulnerability. An attacker may leverage this issue to harvest valid user accounts, which may aid in brute-force attacks. This issue being tracked by Cisco Bug IDs CSCux84312 and CSCux84317. The product invites others to join the meeting via email or instant messaging (IM), enabling online product demonstrations, information sharing, and more

Directory traversal vulnerability in Fortinet FortiWeb before 5.5.3 allows remote authenticated administrators with read and write privileges to read arbitrary files by leveraging the autolearn feature. Fortinet FortiWeb is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker could exploit this vulnerability using directory-traversal characters ('../') to perform unauthorized actions. Versions prior to Fortinet FortiWeb 5.5.3 are vulnerable. Fortinet FortiWeb is a web application layer firewall developed by Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, etc., to ensure the security of web applications and protect sensitive database content. A directory traversal vulnerability exists in Fortinet FortiWeb versions 4.4.6 through 5.5.2

The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS XE 2.1 through 3.17S, IOS XR 2.0.0 through 5.3.2, and NX-OS allows remote attackers to cause a denial of service (packet-processing outage) via crafted ND messages, aka Bug ID CSCuz66542, as exploited in the wild in May 2016. Vendors have confirmed this vulnerability Bug ID CSCuz66542 It is released as. Attacks on this vulnerability 2016 Year 5 Observed on the moon.Skillfully crafted by a third party ND Service disruption via message ( Stop packet processing ) There is a possibility of being put into a state. Cisco IOSXR Software and Cisco IOSXE Software are products of Cisco. The former is a fully modular, distributed network operating system in the IOS software family (including IOST, IOSS, and IOSXR), which is an operating system developed for its network devices. Multiple Cisco products are prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to cause a denial-of-service condition; denying service to legitimate users. This issue is being tracked by Cisco Bug IDs CSCuz66542, CSCuz79330, CSCuz80276, CSCuz80281, CSCuz81292, CSCuz87803, CSCuz89940 and CSCuz96600. (Note: This vulnerability was widely exploited in May 2016)

eFront is an online learning system. eFront has a cross-site scripting vulnerability. A remote attacker could exploit the vulnerability to inject malicious script code into the affected application side.