Digital Security Research Group: Vulnerabilities

vCenter Orchestrator - password disclosure

The vCenter Orchestrator (vCO) Web Configuration tool reflects back saved passwords as part of web page.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

Oracle Application Server - multiple security vulnerabilities

Oracle Application Server Containers has multiple HTTP Response Splitting vulnerabilities.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

ASUS Net4Switch ipswcom.dll ActiveX - buffer overflow vulnerability

ASUS Net4Switch contains ActiveX component ipswcom.dll which is vulnerable to buffer overflow attack.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP MessagingSystem - information disclosure

Information disclosure in MessagingSystem servlet.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP Internet Sales - XSS

SAP NetWeaver 7.0 Internet Sales (crm.b2b) has XSS vulnerability.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP Adapter Monitor - information disclosure

Information disclosure in com.sap.aii.mdt.amt.web.AMTPageProcessor servlet.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP Application Administration - local file read

SAP NetWeaver 7.0 Application Administration (com.sap.ipc.webapp.ipc) has local file read vulnerability.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP NetWeaver Internet Sales - local file read

SAP NetWeaver 7.0 Internet Sales (crm.b2b) has local file read vulnerability.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP NetWeaver Business Communication Broker - multiple XSS

SAP NetWeaver Business Communication Broker has multiple linked XSS vulnerabilies.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP TesContainerAdmin service - stored XSS

SAP NetWeaver contains a flaw in its Text Container Administration Application - stored XSS vulnerability.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP NetWeaver PFL_CHECK_OS_FILE_EXISTENCE - missing authorization check and SMB Relay vulnerability

Missing authorization check in FRC function PFL_CHECK_OS_FILE_EXISTENCE.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP NetWeaver RWB - unauthorized acсess

Unauthorized access is possible to some Runtime Workbench resources.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

Tecomat PLC - Default passwords

Default passwords enabled for Tecomat PLC devices.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

OPC Systems.NET FlexGrid 7.1 ActiveX - Buffer Overflow

Buffer overflow found in 3rd party ActiveX control.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

wellintech KingSCADA 3.0 - Insecure password encryption

It is possible to obtain cleartext password to access KingSCADA because it is stored insecurely.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

WAGO PLC 750 - CSRF password change [0-day]

It is possible to change password by forcing administrator to open malicious link.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

WAGO PLC 750 - information disclosure [0-day]

It is possible to get some information from the PLC web interface without authentication.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

WAGO PLC 750 - unauthorized firmware download [0-day]

It is possible to download firmware from web interface of the PLC without authentication.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

WAGO PLC - default passwords [0-day]

Default passwords enabled for WAGO PLC devices.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

VMware Update Manager - Directory Traversal

Directory traversal vulnerability discovered in the VMware Update Manager, which allows you to read any file on the OS without authentification.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP NetWeaver - Authentication bypass (Verb Tampering)

Authentication bypass vulnerability in SAP NetWeaver CTC service can be exploited for unauthorized user management and OS command execution.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP NetWeaver SPML - XML CSRF user creation

Attacker can create a new user in J2EE Engine using CSRF attack on SPML service.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP NetWeaver TH_GREP module - Code injection vulnerability (NEW)

TH_GREP report is vulnerable for command execution vulnerability which is working with previous patch (note 1433101). Remote OS command execution is possible

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP BW Doc - Multiple XSS

BW DOC metadata application in SAP NetWeaver is vulnerable to XSS attack.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP RSTXSCRP report - smb relay vulnerability

SAP RSTXSCRP Report has path traversal vulnerability which can lead to SMB relay attack and full control on system.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP NetWaver Virus Scan Interface - multiple XSS

SAP Netweaver Virus Scan Interface has linked XSS vulnerabilities.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP GUI BAPI Explorer- Unauthorized execution of function

SAP GUI BAPI Explorer has stored XSS which can be used to unauthorized code execution on server side

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP NetWeaver J2EE MeSync – information disclose

Attacker can get information about mobile engine version and sometimes the name of the technical user.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP Crystal Report Server pubDBLogon - Linked ХSS vulnerability

XSS vulnerability found in pubDBLogon.jsp page of SAP Crystal Report Server 2008.

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary

SAP NetWeaver ipcpricing - information disclose

com.sap.ipc.webapp.ipcpricing application has information disclose vulnerability

Digital Secruity Research Group — www.dsecrg.com
Rss: Vulnerabilities, Exploits, News, Publications, Summary