ICS-CERT published an advisory on one of my reports recently –
LCDS – Leão Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA Access Control Vulnerability
Vendor: LCDS – Leão Consultoria e Desenvolvimento de Sistemas LTDA ME
Equipment: LAquis SCADA
Vulnerability: Improper Access Control
This vulnerability can allow attackers to execute arbitrary code on vulnerable installations of pgAdmin4 software. pgAdmin4 is a GUI application for database server administration, and comes packaged with PostgreSQL package.
User interaction is required to exploit this vulnerability in that the malicious dll file(s) should be saved in any of the DLL search paths.
Confirmed on products
pgAdmin4 v1.1: Current version packaged with PostgreSQL v184.108.40.206 (Windows x86 Current version)
Hacking Binom3 Electric Power Quality Meters
ELNet Energy meter & Electrical Powermeter vulnerabilities – another case of poor software security practices.
Multiple security issues in Powerlogic/Schneider Electric IONXXXX series power meters
The following IONXXXX series power meter versions are affected:
ION8800 series, and
Halliburton LogView Pro 9.7.5 – (.cgm/.tif/.tiff/.tifh) Denial of Service Crash exploit
mySCADAPro v7 Local Privilege Escalation
Reporting a vulnerability in mySCADAPro version 7 (current version).
Vendor: mySCADA Technologies s.r.o.
Product web page: https://www.myscada.org/
Affected application: myscadaPro
Affected version: v7 (Current version)
Exploiting RS232-NET Converter (model JTC-200)
Seen deployed in:
CHTD, Chunghwa Telecom Co., Ltd. (Taiwan)
HiNet (Taiwan & China)
PT Comunicacoes (Portugal)
Sony Network Taiwan Limited (Taiwan)
Vodafone Portugal (Portugal)
On a recent pentest, I came across CIMA DocuClass Enterprise Content Management application. I found multiple security vulnerabilities which can lead to unauthorized access to stored documents, access to underlying database, and code execution on the server via SQL Injection.
No response from vendor as expected. Read on.