Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
12 vulnerabilities by iniNet
VAR-202308-0261
Vulnerability from variot - Updated: 2024-04-28 22:20SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition. iniNet Solutions GmbH Provided by SpiderControl SCADA server The following vulnerabilities exist in. It was * by a user with administrator privileges Web Files on the server are overwritten and denial of service ( DoS ) state is triggered
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202308-0261",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scadawebserver",
"scope": "lte",
"trust": 1.0,
"vendor": "spidercontrol",
"version": "2.08"
},
{
"model": "scada web server",
"scope": "lte",
"trust": 0.8,
"vendor": "ininet",
"version": "2.08 and earlier"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.8,
"vendor": "ininet",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-002215"
},
{
"db": "NVD",
"id": "CVE-2023-3329"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:spidercontrol:scadawebserver:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.08",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2023-3329"
}
]
},
"cve": "CVE-2023-3329",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 1.2,
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 6.5,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2023-3329",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "High",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2023-3329",
"trust": 1.8,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-002215"
},
{
"db": "NVD",
"id": "CVE-2023-3329"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI\u0027s upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition. iniNet Solutions GmbH Provided by SpiderControl SCADA server The following vulnerabilities exist in. It was * by a user with administrator privileges Web Files on the server are overwritten and denial of service ( DoS ) state is triggered",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-3329"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-002215"
},
{
"db": "VULMON",
"id": "CVE-2023-3329"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-3329",
"trust": 2.7
},
{
"db": "ICS CERT",
"id": "ICSA-23-173-03",
"trust": 1.9
},
{
"db": "JVN",
"id": "JVNVU94326169",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2023-002215",
"trust": 0.8
},
{
"db": "VULMON",
"id": "CVE-2023-3329",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-3329"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-002215"
},
{
"db": "NVD",
"id": "CVE-2023-3329"
}
]
},
"id": "VAR-202308-0261",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.625
},
"last_update_date": "2024-04-28T22:20:21.109000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Download\u00a0Area",
"trust": 0.8,
"url": "https://spidercontrol.net/download/downloadbereich-neu/#scadaserver"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-002215"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "Path traversal (CWE-22) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-002215"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-03"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu94326169/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-3329"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2023-3329"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-002215"
},
{
"db": "NVD",
"id": "CVE-2023-3329"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2023-3329"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-002215"
},
{
"db": "NVD",
"id": "CVE-2023-3329"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-08-02T00:00:00",
"db": "VULMON",
"id": "CVE-2023-3329"
},
{
"date": "2023-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-002215"
},
{
"date": "2023-08-02T23:15:10.547000",
"db": "NVD",
"id": "CVE-2023-3329"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-08-03T00:00:00",
"db": "VULMON",
"id": "CVE-2023-3329"
},
{
"date": "2024-04-11T08:16:00",
"db": "JVNDB",
"id": "JVNDB-2023-002215"
},
{
"date": "2023-11-07T04:18:31.170000",
"db": "NVD",
"id": "CVE-2023-3329"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "iniNet\u00a0Solutions\u00a0GmbH Made SpiderControl\u00a0SCADA\u00a0server Past traversal vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-002215"
}
],
"trust": 0.8
}
}
VAR-201710-1115
Vulnerability from variot - Updated: 2023-12-18 14:05An Improper Privilege Management issue was discovered in SpiderControl SCADA Web Server Version 2.02.0007 and prior. Authenticated, non-administrative local users are able to alter service executables with escalated privileges, which could allow an attacker to execute arbitrary code under the context of the current system services. iniNet Solutions SCADA Web Server Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Failed attempts may lead to denial-of-service conditions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-1115",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scada webserver",
"scope": "lte",
"trust": 1.0,
"vendor": "spidercontrol",
"version": "2.02.0007"
},
{
"model": "scada web server",
"scope": "lte",
"trust": 0.8,
"vendor": "ininet",
"version": "2.02.0007"
},
{
"model": "scada web server",
"scope": "lte",
"trust": 0.6,
"vendor": "spidercontrol",
"version": "\u003c=2.02.0007"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.6,
"vendor": "spidercontrol",
"version": "2.02.0007"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "2.2.7"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "0"
},
{
"model": "scada web server",
"scope": "ne",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "2.02.0100"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "scada web server",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "318edf6e-d1a4-4e3c-80de-a908117a2cea"
},
{
"db": "CNVD",
"id": "CNVD-2017-25725"
},
{
"db": "BID",
"id": "100668"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009408"
},
{
"db": "NVD",
"id": "CVE-2017-12728"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:spidercontrol:scada_webserver:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.02.0007",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12728"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Karn Ganeshen.",
"sources": [
{
"db": "BID",
"id": "100668"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
],
"trust": 0.9
},
"cve": "CVE-2017-12728",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.2,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2017-12728",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CNVD-2017-25725",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "318edf6e-d1a4-4e3c-80de-a908117a2cea",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-12728",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-12728",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-25725",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201709-518",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "318edf6e-d1a4-4e3c-80de-a908117a2cea",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "318edf6e-d1a4-4e3c-80de-a908117a2cea"
},
{
"db": "CNVD",
"id": "CNVD-2017-25725"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009408"
},
{
"db": "NVD",
"id": "CVE-2017-12728"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Improper Privilege Management issue was discovered in SpiderControl SCADA Web Server Version 2.02.0007 and prior. Authenticated, non-administrative local users are able to alter service executables with escalated privileges, which could allow an attacker to execute arbitrary code under the context of the current system services. iniNet Solutions SCADA Web Server Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Failed attempts may lead to denial-of-service conditions",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12728"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009408"
},
{
"db": "CNVD",
"id": "CNVD-2017-25725"
},
{
"db": "BID",
"id": "100668"
},
{
"db": "IVD",
"id": "318edf6e-d1a4-4e3c-80de-a908117a2cea"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-12728",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-17-250-01",
"trust": 3.3
},
{
"db": "BID",
"id": "100668",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2017-25725",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201709-518",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009408",
"trust": 0.8
},
{
"db": "IVD",
"id": "318EDF6E-D1A4-4E3C-80DE-A908117A2CEA",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "318edf6e-d1a4-4e3c-80de-a908117a2cea"
},
{
"db": "CNVD",
"id": "CNVD-2017-25725"
},
{
"db": "BID",
"id": "100668"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009408"
},
{
"db": "NVD",
"id": "CVE-2017-12728"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
]
},
"id": "VAR-201710-1115",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "318edf6e-d1a4-4e3c-80de-a908117a2cea"
},
{
"db": "CNVD",
"id": "CNVD-2017-25725"
}
],
"trust": 1.6125
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "318edf6e-d1a4-4e3c-80de-a908117a2cea"
},
{
"db": "CNVD",
"id": "CNVD-2017-25725"
}
]
},
"last_update_date": "2023-12-18T14:05:38.786000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://spidercontrol.net/?lang=en"
},
{
"title": "Patch for SpiderControl SCADA Web Server Privilege Escalation Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/101789"
},
{
"title": "iniNet Solutions SpiderControl SCADA Web Server Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=74855"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-25725"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009408"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-269",
"trust": 1.0
},
{
"problemtype": "CWE-264",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009408"
},
{
"db": "NVD",
"id": "CVE-2017-12728"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-250-01"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/100668"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12728"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12728"
},
{
"trust": 0.3,
"url": "http://spidercontrol.net/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-25725"
},
{
"db": "BID",
"id": "100668"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009408"
},
{
"db": "NVD",
"id": "CVE-2017-12728"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "318edf6e-d1a4-4e3c-80de-a908117a2cea"
},
{
"db": "CNVD",
"id": "CNVD-2017-25725"
},
{
"db": "BID",
"id": "100668"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009408"
},
{
"db": "NVD",
"id": "CVE-2017-12728"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-08T00:00:00",
"db": "IVD",
"id": "318edf6e-d1a4-4e3c-80de-a908117a2cea"
},
{
"date": "2017-09-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-25725"
},
{
"date": "2017-09-07T00:00:00",
"db": "BID",
"id": "100668"
},
{
"date": "2017-11-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009408"
},
{
"date": "2017-10-05T01:29:05.117000",
"db": "NVD",
"id": "CVE-2017-12728"
},
{
"date": "2017-09-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-25725"
},
{
"date": "2017-09-07T00:00:00",
"db": "BID",
"id": "100668"
},
{
"date": "2017-11-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009408"
},
{
"date": "2020-08-19T19:11:55.950000",
"db": "NVD",
"id": "CVE-2017-12728"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "100668"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "iniNet Solutions SCADA Web Server Vulnerabilities related to authorization, permissions, and access control",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009408"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-518"
}
],
"trust": 0.6
}
}
VAR-201708-1121
Vulnerability from variot - Updated: 2023-12-18 14:01A Stack-based Buffer Overflow issue was discovered in SpiderControl SCADA MicroBrowser Versions 1.6.30.144 and prior. Opening a maliciously crafted html file may cause a stack overflow. SpiderControl SCADA MicroBrowser Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SpiderControl SCADA MicroBrowser. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within processing of the StaticHTMLTagsFileName tag. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. SCADA MicroBrowser is a software management platform. Failed exploit attempts will likely result in denial-of-service conditions. SCADA MicroBrowser 1.6.30.144 and prior are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201708-1121",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scada microbrowser",
"scope": "lte",
"trust": 1.0,
"vendor": "spidercontrol",
"version": "1.6.30.144"
},
{
"model": "scada microbrowser",
"scope": "eq",
"trust": 0.9,
"vendor": "spidercontrol",
"version": "1.6.30.144"
},
{
"model": "spidercontrol scada microbrowser",
"scope": "lte",
"trust": 0.8,
"vendor": "ininet",
"version": "1.6.30.144"
},
{
"model": "scada microbrowser",
"scope": null,
"trust": 0.7,
"vendor": "spidercontrol",
"version": null
},
{
"model": "scada microbrowser",
"scope": "lte",
"trust": 0.6,
"vendor": "spidercontrol",
"version": "\u003c=1.6.30.144"
},
{
"model": "scada microbrowser",
"scope": "eq",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "1.6.30.142"
},
{
"model": "scada microbrowser",
"scope": "ne",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "1.6.40.148"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "scada microbrowser",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c"
},
{
"db": "ZDI",
"id": "ZDI-17-694"
},
{
"db": "CNVD",
"id": "CNVD-2017-22814"
},
{
"db": "BID",
"id": "100453"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007390"
},
{
"db": "NVD",
"id": "CVE-2017-12707"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1071"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:spidercontrol:scada_microbrowser:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.6.30.144",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12707"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "juushya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-694"
}
],
"trust": 0.7
},
"cve": "CVE-2017-12707",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-12707",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2017-12707",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-22814",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-12707",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-12707",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "ZDI",
"id": "CVE-2017-12707",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2017-22814",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201708-1071",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c"
},
{
"db": "ZDI",
"id": "ZDI-17-694"
},
{
"db": "CNVD",
"id": "CNVD-2017-22814"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007390"
},
{
"db": "NVD",
"id": "CVE-2017-12707"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1071"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Stack-based Buffer Overflow issue was discovered in SpiderControl SCADA MicroBrowser Versions 1.6.30.144 and prior. Opening a maliciously crafted html file may cause a stack overflow. SpiderControl SCADA MicroBrowser Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SpiderControl SCADA MicroBrowser. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within processing of the StaticHTMLTagsFileName tag. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. SCADA MicroBrowser is a software management platform. Failed exploit attempts will likely result in denial-of-service conditions. \nSCADA MicroBrowser 1.6.30.144 and prior are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12707"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007390"
},
{
"db": "ZDI",
"id": "ZDI-17-694"
},
{
"db": "CNVD",
"id": "CNVD-2017-22814"
},
{
"db": "BID",
"id": "100453"
},
{
"db": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-12707",
"trust": 4.2
},
{
"db": "ICS CERT",
"id": "ICSA-17-234-02",
"trust": 3.3
},
{
"db": "BID",
"id": "100453",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2017-22814",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1071",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007390",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4194",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-17-694",
"trust": 0.7
},
{
"db": "IVD",
"id": "A6E1EC6C-668F-47FF-8A3F-BF8AED7E701C",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c"
},
{
"db": "ZDI",
"id": "ZDI-17-694"
},
{
"db": "CNVD",
"id": "CNVD-2017-22814"
},
{
"db": "BID",
"id": "100453"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007390"
},
{
"db": "NVD",
"id": "CVE-2017-12707"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1071"
}
]
},
"id": "VAR-201708-1121",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c"
},
{
"db": "CNVD",
"id": "CNVD-2017-22814"
}
],
"trust": 1.3714286
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c"
},
{
"db": "CNVD",
"id": "CNVD-2017-22814"
}
]
},
"last_update_date": "2023-12-18T14:01:30.102000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SpiderControl MicroBrowser",
"trust": 0.8,
"url": "http://www.ininet.ch/public/microbrowser/xp/index.html"
},
{
"title": "SpiderControl has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-234-02"
},
{
"title": "SpiderControl SCADA MicroBrowser Stack Buffer Overflow Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/100832"
},
{
"title": "iniNet Solutions SpiderControl SCADA MicroBrowser Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=74280"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-694"
},
{
"db": "CNVD",
"id": "CNVD-2017-22814"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007390"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1071"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-007390"
},
{
"db": "NVD",
"id": "CVE-2017-12707"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-234-02"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/100453"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12707"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12707"
},
{
"trust": 0.6,
"url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12707"
},
{
"trust": 0.3,
"url": "http://spidercontrol.net/"
},
{
"trust": 0.3,
"url": "http://www.ininet.ch/public/microbrowser/xp/releasenote.txt"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-694"
},
{
"db": "CNVD",
"id": "CNVD-2017-22814"
},
{
"db": "BID",
"id": "100453"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007390"
},
{
"db": "NVD",
"id": "CVE-2017-12707"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1071"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c"
},
{
"db": "ZDI",
"id": "ZDI-17-694"
},
{
"db": "CNVD",
"id": "CNVD-2017-22814"
},
{
"db": "BID",
"id": "100453"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007390"
},
{
"db": "NVD",
"id": "CVE-2017-12707"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1071"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c"
},
{
"date": "2017-08-23T00:00:00",
"db": "ZDI",
"id": "ZDI-17-694"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22814"
},
{
"date": "2017-08-22T00:00:00",
"db": "BID",
"id": "100453"
},
{
"date": "2017-09-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007390"
},
{
"date": "2017-08-25T19:29:00.237000",
"db": "NVD",
"id": "CVE-2017-12707"
},
{
"date": "2017-08-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201708-1071"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-23T00:00:00",
"db": "ZDI",
"id": "ZDI-17-694"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22814"
},
{
"date": "2017-08-22T00:00:00",
"db": "BID",
"id": "100453"
},
{
"date": "2017-09-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007390"
},
{
"date": "2019-10-09T23:23:10.527000",
"db": "NVD",
"id": "CVE-2017-12707"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201708-1071"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201708-1071"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SpiderControl SCADA MicroBrowser Stack Buffer Overflow Vulnerability",
"sources": [
{
"db": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c"
},
{
"db": "CNVD",
"id": "CNVD-2017-22814"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer error",
"sources": [
{
"db": "IVD",
"id": "a6e1ec6c-668f-47ff-8a3f-bf8aed7e701c"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1071"
}
],
"trust": 0.8
}
}
VAR-201804-0424
Vulnerability from variot - Updated: 2023-12-18 13:19In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerability has been identified which could be exploited by placing a specially crafted DLL file in the search path. If the malicious DLL is loaded prior to the valid DLL, an attacker could execute arbitrary code on the system. SpiderControl MicroBrowser Contains a vulnerability related to uncontrolled search path elements.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. MicroBrowser is a touch screen operating system. SpiderControl MicroBrowser is prone to a remote code-execution vulnerability. SpiderControl MicroBrowser 1.6.30.144 and prior versions are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201804-0424",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scada microbrowser",
"scope": "lte",
"trust": 1.0,
"vendor": "spidercontrol",
"version": "1.6.30.144"
},
{
"model": "spidercontrol scada microbrowser",
"scope": "lte",
"trust": 0.8,
"vendor": "ininet",
"version": "1.6.30.144"
},
{
"model": "microbrowser windows xp",
"scope": "lte",
"trust": 0.6,
"vendor": "spidercontrol",
"version": "\u003c=1.6.30.144"
},
{
"model": "vista",
"scope": "eq",
"trust": 0.6,
"vendor": "spidercontrol",
"version": "7\u003c=1.6.30.144"
},
{
"model": "vista",
"scope": "eq",
"trust": 0.6,
"vendor": "spidercontrol",
"version": "8\u003c=1.6.30.144"
},
{
"model": "vista",
"scope": "eq",
"trust": 0.6,
"vendor": "spidercontrol",
"version": "10\u003c=1.6.30.144"
},
{
"model": "scada microbrowser",
"scope": "eq",
"trust": 0.6,
"vendor": "spidercontrol",
"version": "1.6.30.144"
},
{
"model": "microbrowser",
"scope": "eq",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "1.6.30.144"
},
{
"model": "microbrowser",
"scope": "ne",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "1.6.30.148"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "scada microbrowser",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70"
},
{
"db": "CNVD",
"id": "CNVD-2017-31144"
},
{
"db": "BID",
"id": "101505"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-013397"
},
{
"db": "NVD",
"id": "CVE-2017-14010"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:spidercontrol:scada_microbrowser:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.6.30.144",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows_8:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-14010"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Karn Ganeshen",
"sources": [
{
"db": "BID",
"id": "101505"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
],
"trust": 0.9
},
"cve": "CVE-2017-14010",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-14010",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-31144",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "160c362e-5959-49cd-be9c-7f1698471f70",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-14010",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-14010",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-31144",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201710-1056",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70"
},
{
"db": "CNVD",
"id": "CNVD-2017-31144"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-013397"
},
{
"db": "NVD",
"id": "CVE-2017-14010"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerability has been identified which could be exploited by placing a specially crafted DLL file in the search path. If the malicious DLL is loaded prior to the valid DLL, an attacker could execute arbitrary code on the system. SpiderControl MicroBrowser Contains a vulnerability related to uncontrolled search path elements.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. MicroBrowser is a touch screen operating system. SpiderControl MicroBrowser is prone to a remote code-execution vulnerability. \nSpiderControl MicroBrowser 1.6.30.144 and prior versions are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-14010"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-013397"
},
{
"db": "CNVD",
"id": "CNVD-2017-31144"
},
{
"db": "BID",
"id": "101505"
},
{
"db": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-14010",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-17-292-01",
"trust": 3.3
},
{
"db": "BID",
"id": "101505",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2017-31144",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201710-1056",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-013397",
"trust": 0.8
},
{
"db": "IVD",
"id": "160C362E-5959-49CD-BE9C-7F1698471F70",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70"
},
{
"db": "CNVD",
"id": "CNVD-2017-31144"
},
{
"db": "BID",
"id": "101505"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-013397"
},
{
"db": "NVD",
"id": "CVE-2017-14010"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
]
},
"id": "VAR-201804-0424",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70"
},
{
"db": "CNVD",
"id": "CNVD-2017-31144"
}
],
"trust": 1.6571428666666668
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70"
},
{
"db": "CNVD",
"id": "CNVD-2017-31144"
}
]
},
"last_update_date": "2023-12-18T13:19:10.009000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Download Area",
"trust": 0.8,
"url": "http://spidercontrol.net/download/downloadarea/?lang=en"
},
{
"title": "Patch for SpiderControl MicroBrowser arbitrary code execution vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/104382"
},
{
"title": "iniNet SpiderControl MicroBrowser Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=75927"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-31144"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-013397"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-427",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-013397"
},
{
"db": "NVD",
"id": "CVE-2017-14010"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-292-01"
},
{
"trust": 1.9,
"url": "http://spidercontrol.net/download/downloadarea/?lang=en"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/101505"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14010"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-14010"
},
{
"trust": 0.3,
"url": "http://blog.metasploit.com/2010/08/exploiting-dll-hijacking-flaws.html"
},
{
"trust": 0.3,
"url": "http://blogs.technet.com/b/srd/archive/2010/08/23/more-information-about-dll-preloading-remote-attack-vector.aspx"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-31144"
},
{
"db": "BID",
"id": "101505"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-013397"
},
{
"db": "NVD",
"id": "CVE-2017-14010"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70"
},
{
"db": "CNVD",
"id": "CNVD-2017-31144"
},
{
"db": "BID",
"id": "101505"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-013397"
},
{
"db": "NVD",
"id": "CVE-2017-14010"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-23T00:00:00",
"db": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70"
},
{
"date": "2017-10-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-31144"
},
{
"date": "2017-10-19T00:00:00",
"db": "BID",
"id": "101505"
},
{
"date": "2018-07-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-013397"
},
{
"date": "2018-04-26T19:29:00.370000",
"db": "NVD",
"id": "CVE-2017-14010"
},
{
"date": "2017-10-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-31144"
},
{
"date": "2017-10-19T00:00:00",
"db": "BID",
"id": "101505"
},
{
"date": "2018-07-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-013397"
},
{
"date": "2019-10-09T23:23:43.513000",
"db": "NVD",
"id": "CVE-2017-14010"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SpiderControl MicroBrowser Arbitrary code execution vulnerability",
"sources": [
{
"db": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70"
},
{
"db": "CNVD",
"id": "CNVD-2017-31144"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Code problem",
"sources": [
{
"db": "IVD",
"id": "160c362e-5959-49cd-be9c-7f1698471f70"
},
{
"db": "CNNVD",
"id": "CNNVD-201710-1056"
}
],
"trust": 0.8
}
}
VAR-201708-1115
Vulnerability from variot - Updated: 2023-12-18 13:08A Directory Traversal issue was discovered in SpiderControl SCADA Web Server. An attacker may be able to use a simple GET request to perform a directory traversal into system files. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of SpiderControl SCADA. Authentication is not required to exploit this vulnerability. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose files accessible to the SYSTEM account. Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to read arbitrary files in the context of the application. This may aid in further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201708-1115",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scada web server",
"scope": "eq",
"trust": 1.6,
"vendor": "spidercontrol",
"version": null
},
{
"model": "scada web server",
"scope": null,
"trust": 0.8,
"vendor": "ininet",
"version": null
},
{
"model": "scada webserver ininet",
"scope": null,
"trust": 0.7,
"vendor": "spidercontrol",
"version": null
},
{
"model": "scada web server",
"scope": null,
"trust": 0.6,
"vendor": "spidercontrol",
"version": null
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "0"
},
{
"model": "scada web server",
"scope": "ne",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "2.02.0100"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "scada web server",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97"
},
{
"db": "ZDI",
"id": "ZDI-17-695"
},
{
"db": "CNVD",
"id": "CNVD-2017-22815"
},
{
"db": "BID",
"id": "100456"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007389"
},
{
"db": "NVD",
"id": "CVE-2017-12694"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1070"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:spidercontrol:scada_web_server:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12694"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "juushya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-695"
}
],
"trust": 0.7
},
"cve": "CVE-2017-12694",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-12694",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-12694",
"impactScore": 6.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-22815",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "95deff53-7157-4b43-8155-5b5120c5ac97",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-12694",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-12694",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2017-12694",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-22815",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201708-1070",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97"
},
{
"db": "ZDI",
"id": "ZDI-17-695"
},
{
"db": "CNVD",
"id": "CNVD-2017-22815"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007389"
},
{
"db": "NVD",
"id": "CVE-2017-12694"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1070"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Directory Traversal issue was discovered in SpiderControl SCADA Web Server. An attacker may be able to use a simple GET request to perform a directory traversal into system files. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of SpiderControl SCADA. Authentication is not required to exploit this vulnerability. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose files accessible to the SYSTEM account. \nRemote attackers can use specially crafted requests with directory-traversal sequences (\u0027../\u0027) to read arbitrary files in the context of the application. This may aid in further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-12694"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007389"
},
{
"db": "ZDI",
"id": "ZDI-17-695"
},
{
"db": "CNVD",
"id": "CNVD-2017-22815"
},
{
"db": "BID",
"id": "100456"
},
{
"db": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-12694",
"trust": 4.2
},
{
"db": "ICS CERT",
"id": "ICSA-17-234-03",
"trust": 2.7
},
{
"db": "BID",
"id": "100456",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2017-22815",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1070",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007389",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4174",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-17-695",
"trust": 0.7
},
{
"db": "IVD",
"id": "95DEFF53-7157-4B43-8155-5B5120C5AC97",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97"
},
{
"db": "ZDI",
"id": "ZDI-17-695"
},
{
"db": "CNVD",
"id": "CNVD-2017-22815"
},
{
"db": "BID",
"id": "100456"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007389"
},
{
"db": "NVD",
"id": "CVE-2017-12694"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1070"
}
]
},
"id": "VAR-201708-1115",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97"
},
{
"db": "CNVD",
"id": "CNVD-2017-22815"
}
],
"trust": 1.425
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97"
},
{
"db": "CNVD",
"id": "CNVD-2017-22815"
}
]
},
"last_update_date": "2023-12-18T13:08:44.393000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://spidercontrol.net/?lang=en"
},
{
"title": "SpiderControl has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-234-03"
},
{
"title": "SpiderControl SCADA Web Server Directory Traversal Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/100834"
},
{
"title": "iniNet Solutions SpiderControl SCADA Web Server Repair measures for path traversal vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=74279"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-695"
},
{
"db": "CNVD",
"id": "CNVD-2017-22815"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007389"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1070"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-007389"
},
{
"db": "NVD",
"id": "CVE-2017-12694"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-234-03"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/100456"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12694"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-12694"
},
{
"trust": 0.6,
"url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12694"
},
{
"trust": 0.3,
"url": "http://spidercontrol.net/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-695"
},
{
"db": "CNVD",
"id": "CNVD-2017-22815"
},
{
"db": "BID",
"id": "100456"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007389"
},
{
"db": "NVD",
"id": "CVE-2017-12694"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1070"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97"
},
{
"db": "ZDI",
"id": "ZDI-17-695"
},
{
"db": "CNVD",
"id": "CNVD-2017-22815"
},
{
"db": "BID",
"id": "100456"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007389"
},
{
"db": "NVD",
"id": "CVE-2017-12694"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1070"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97"
},
{
"date": "2017-08-23T00:00:00",
"db": "ZDI",
"id": "ZDI-17-695"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22815"
},
{
"date": "2017-08-22T00:00:00",
"db": "BID",
"id": "100456"
},
{
"date": "2017-09-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007389"
},
{
"date": "2017-08-25T19:29:00.177000",
"db": "NVD",
"id": "CVE-2017-12694"
},
{
"date": "2017-08-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201708-1070"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-23T00:00:00",
"db": "ZDI",
"id": "ZDI-17-695"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22815"
},
{
"date": "2017-08-22T00:00:00",
"db": "BID",
"id": "100456"
},
{
"date": "2017-09-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007389"
},
{
"date": "2019-10-09T23:23:09.233000",
"db": "NVD",
"id": "CVE-2017-12694"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201708-1070"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201708-1070"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SpiderControl SCADA Web Server Directory Traversal Vulnerability",
"sources": [
{
"db": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97"
},
{
"db": "CNVD",
"id": "CNVD-2017-22815"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Path traversal",
"sources": [
{
"db": "IVD",
"id": "95deff53-7157-4b43-8155-5b5120c5ac97"
},
{
"db": "CNNVD",
"id": "CNNVD-201708-1070"
}
],
"trust": 0.8
}
}
VAR-201710-0792
Vulnerability from variot - Updated: 2023-12-18 13:02An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authenticate users, which may allow a malicious attacker to access sensitive information such as HMI pages or modify PLC variables. iniNet Solutions SCADA Web Server Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SCADA Webserver is a third-party web-based server software. IniNet Solutions SCADA Web Server is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks. IniNet Solutions SCADA Web Server prior to 2.02.0100 are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201710-0792",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ininet webserver",
"scope": "lte",
"trust": 1.0,
"vendor": "spidercontrol",
"version": "2.02.0000"
},
{
"model": "scada web server",
"scope": "lt",
"trust": 0.8,
"vendor": "ininet",
"version": "2.02.0100"
},
{
"model": "scada webserver",
"scope": "lt",
"trust": 0.6,
"vendor": "ininet",
"version": "2.02.0100"
},
{
"model": "ininet webserver",
"scope": "eq",
"trust": 0.6,
"vendor": "spidercontrol",
"version": "2.02.0000"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "ininet",
"version": "2.02"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "ininet",
"version": "2.01"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "ininet",
"version": "2.0"
},
{
"model": "scada web server",
"scope": "ne",
"trust": 0.3,
"vendor": "ininet",
"version": "2.02.0100"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ininet webserver",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303"
},
{
"db": "CNVD",
"id": "CNVD-2017-28914"
},
{
"db": "BID",
"id": "100951"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009407"
},
{
"db": "NVD",
"id": "CVE-2017-13995"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:spidercontrol:ininet_webserver:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.02.0000",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-13995"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "both of Augsburg University of Applied Sciences.,Matthias Niedermaier and Florian Fischer",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
],
"trust": 0.6
},
"cve": "CVE-2017-13995",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-13995",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-28914",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 10.0,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-13995",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-13995",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNVD",
"id": "CNVD-2017-28914",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201709-1089",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2017-13995",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303"
},
{
"db": "CNVD",
"id": "CNVD-2017-28914"
},
{
"db": "VULMON",
"id": "CVE-2017-13995"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009407"
},
{
"db": "NVD",
"id": "CVE-2017-13995"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authenticate users, which may allow a malicious attacker to access sensitive information such as HMI pages or modify PLC variables. iniNet Solutions SCADA Web Server Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SCADA Webserver is a third-party web-based server software. IniNet Solutions SCADA Web Server is prone to an authentication-bypass vulnerability. \nAn attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks. \nIniNet Solutions SCADA Web Server prior to 2.02.0100 are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-13995"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009407"
},
{
"db": "CNVD",
"id": "CNVD-2017-28914"
},
{
"db": "BID",
"id": "100951"
},
{
"db": "IVD",
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303"
},
{
"db": "VULMON",
"id": "CVE-2017-13995"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-13995",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-17-264-04",
"trust": 3.4
},
{
"db": "BID",
"id": "100951",
"trust": 2.0
},
{
"db": "CNVD",
"id": "CNVD-2017-28914",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201709-1089",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009407",
"trust": 0.8
},
{
"db": "IVD",
"id": "F360A512-61E8-46A7-9A28-C8F631A2E303",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2017-13995",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303"
},
{
"db": "CNVD",
"id": "CNVD-2017-28914"
},
{
"db": "VULMON",
"id": "CVE-2017-13995"
},
{
"db": "BID",
"id": "100951"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009407"
},
{
"db": "NVD",
"id": "CVE-2017-13995"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
]
},
"id": "VAR-201710-0792",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303"
},
{
"db": "CNVD",
"id": "CNVD-2017-28914"
}
],
"trust": 1.6125
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303"
},
{
"db": "CNVD",
"id": "CNVD-2017-28914"
}
]
},
"last_update_date": "2023-12-18T13:02:52.847000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://spidercontrol.net/?lang=en"
},
{
"title": "iniNet Solutions GmbH SCADA Webserver Unauthorized Access Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/102631"
},
{
"title": "IniNet Solutions SCADA Web Server Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=75076"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-28914"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009407"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-009407"
},
{
"db": "NVD",
"id": "CVE-2017-13995"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-264-04"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/100951"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-13995"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-13995"
},
{
"trust": 0.3,
"url": "http://spidercontrol.net/ininet/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/287.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-28914"
},
{
"db": "VULMON",
"id": "CVE-2017-13995"
},
{
"db": "BID",
"id": "100951"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009407"
},
{
"db": "NVD",
"id": "CVE-2017-13995"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303"
},
{
"db": "CNVD",
"id": "CNVD-2017-28914"
},
{
"db": "VULMON",
"id": "CVE-2017-13995"
},
{
"db": "BID",
"id": "100951"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-009407"
},
{
"db": "NVD",
"id": "CVE-2017-13995"
},
{
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-22T00:00:00",
"db": "IVD",
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303"
},
{
"date": "2017-09-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-28914"
},
{
"date": "2017-10-05T00:00:00",
"db": "VULMON",
"id": "CVE-2017-13995"
},
{
"date": "2017-09-21T00:00:00",
"db": "BID",
"id": "100951"
},
{
"date": "2017-11-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009407"
},
{
"date": "2017-10-05T01:29:05.227000",
"db": "NVD",
"id": "CVE-2017-13995"
},
{
"date": "2017-09-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-28914"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2017-13995"
},
{
"date": "2017-09-21T00:00:00",
"db": "BID",
"id": "100951"
},
{
"date": "2017-11-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-009407"
},
{
"date": "2019-10-09T23:23:41.607000",
"db": "NVD",
"id": "CVE-2017-13995"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "iniNet Solutions GmbH SCADA Webserver Unauthorized Access Vulnerability",
"sources": [
{
"db": "IVD",
"id": "f360a512-61e8-46a7-9a28-c8f631a2e303"
},
{
"db": "CNVD",
"id": "CNVD-2017-28914"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201709-1089"
}
],
"trust": 0.6
}
}
VAR-201510-0440
Vulnerability from variot - Updated: 2023-12-18 12:57Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before 2.02 allows remote attackers to read arbitrary files via a crafted pathname. IniNet SCADA Web Server is a third-party web-based server software. An attacker could exploit this vulnerability to read any OS file. IniNet Solutions SCADA Web Server is prone to following security vulnerabilities: 1. A directory-traversal vulnerability 2. A security-bypass vulnerability 3. Multiple stack-based buffer-overflow vulnerabilities Attackers can exploit these issue to bypass security restrictions and perform unauthorized actions, gain access to arbitrary files and execute arbitrary code. Failed attempts will likely cause a denial-of-service condition
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201510-0440",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scada web server",
"scope": "eq",
"trust": 1.6,
"vendor": "ininet",
"version": null
},
{
"model": "scada web server",
"scope": "lt",
"trust": 0.8,
"vendor": "ininet",
"version": "2.02"
},
{
"model": "solutions scada web server",
"scope": "lt",
"trust": 0.6,
"vendor": "ininet",
"version": "2.02"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "ininet",
"version": "2.01"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "ininet",
"version": "2.0"
},
{
"model": "embedded pc cx5100",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx5000",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx2000",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx1030",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx1020",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx1010",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "scada web server",
"scope": "ne",
"trust": 0.3,
"vendor": "ininet",
"version": "2.02"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "scada web server",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06935"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005597"
},
{
"db": "NVD",
"id": "CVE-2015-1003"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-565"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ininet_solutions:scada_web_server:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2015-1003"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kirill Nesterov and Aleksandr Timorin of Positive Technologies",
"sources": [
{
"db": "BID",
"id": "77259"
}
],
"trust": 0.3
},
"cve": "CVE-2015-1003",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2015-1003",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-06935",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "aa79606a-2351-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2015-1003",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2015-06935",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201510-565",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06935"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005597"
},
{
"db": "NVD",
"id": "CVE-2015-1003"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-565"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before 2.02 allows remote attackers to read arbitrary files via a crafted pathname. IniNet SCADA Web Server is a third-party web-based server software. An attacker could exploit this vulnerability to read any OS file. IniNet Solutions SCADA Web Server is prone to following security vulnerabilities:\n1. A directory-traversal vulnerability\n2. A security-bypass vulnerability\n3. Multiple stack-based buffer-overflow vulnerabilities\nAttackers can exploit these issue to bypass security restrictions and perform unauthorized actions, gain access to arbitrary files and execute arbitrary code. Failed attempts will likely cause a denial-of-service condition",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-1003"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005597"
},
{
"db": "CNVD",
"id": "CNVD-2015-06935"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-1003",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-15-293-02",
"trust": 3.3
},
{
"db": "CNVD",
"id": "CNVD-2015-06935",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201510-565",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005597",
"trust": 0.8
},
{
"db": "BID",
"id": "77259",
"trust": 0.3
},
{
"db": "IVD",
"id": "AA79606A-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06935"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005597"
},
{
"db": "NVD",
"id": "CVE-2015-1003"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-565"
}
]
},
"id": "VAR-201510-0440",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06935"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06935"
}
]
},
"last_update_date": "2023-12-18T12:57:41.437000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://spidercontrol.net/home/?l=1"
},
{
"title": "IniNet Solutions SCADA Web Server Path Traversal Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/65886"
},
{
"title": "IniNet Solutions embeddedWebServer Fixes for directory traversal vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=58409"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06935"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005597"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-565"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-005597"
},
{
"db": "NVD",
"id": "CVE-2015-1003"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-293-02"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1003"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-1003"
},
{
"trust": 0.3,
"url": "https://www.productpilot.com/en/suppliers/ininet-solutions-gmbh/products/en"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06935"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005597"
},
{
"db": "NVD",
"id": "CVE-2015-1003"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-565"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06935"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005597"
},
{
"db": "NVD",
"id": "CVE-2015-1003"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-565"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-28T00:00:00",
"db": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06935"
},
{
"date": "2015-10-20T00:00:00",
"db": "BID",
"id": "77259"
},
{
"date": "2015-10-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-005597"
},
{
"date": "2015-10-25T02:59:02.587000",
"db": "NVD",
"id": "CVE-2015-1003"
},
{
"date": "2015-10-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-565"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06935"
},
{
"date": "2015-10-20T00:00:00",
"db": "BID",
"id": "77259"
},
{
"date": "2015-10-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-005597"
},
{
"date": "2015-10-27T01:06:03.973000",
"db": "NVD",
"id": "CVE-2015-1003"
},
{
"date": "2015-10-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-565"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-565"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IniNet Solutions SCADA Web Server Path traversal vulnerability",
"sources": [
{
"db": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06935"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Path traversal",
"sources": [
{
"db": "IVD",
"id": "aa79606a-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-565"
}
],
"trust": 0.8
}
}
VAR-201510-0438
Vulnerability from variot - Updated: 2023-12-18 12:57Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request. IniNet SCADA Web Server is a third-party web-based server software. A directory-traversal vulnerability 2. A security-bypass vulnerability 3. Failed attempts will likely cause a denial-of-service condition
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201510-0438",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scada web server",
"scope": "eq",
"trust": 1.6,
"vendor": "ininet",
"version": null
},
{
"model": "scada web server",
"scope": "lt",
"trust": 0.8,
"vendor": "ininet",
"version": "2.02"
},
{
"model": "solutions scada web server",
"scope": "lt",
"trust": 0.6,
"vendor": "ininet",
"version": "2.02"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "ininet",
"version": "2.01"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "ininet",
"version": "2.0"
},
{
"model": "embedded pc cx5100",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx5000",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx2000",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx1030",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx1020",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx1010",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "scada web server",
"scope": "ne",
"trust": 0.3,
"vendor": "ininet",
"version": "2.02"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "scada web server",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06868"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005595"
},
{
"db": "NVD",
"id": "CVE-2015-1001"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-563"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ininet_solutions:scada_web_server:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2015-1001"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kirill Nesterov and Aleksandr Timorin of Positive Technologies",
"sources": [
{
"db": "BID",
"id": "77259"
}
],
"trust": 0.3
},
"cve": "CVE-2015-1001",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2015-1001",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-06868",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2015-1001",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2015-06868",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201510-563",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2015-1001",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06868"
},
{
"db": "VULMON",
"id": "CVE-2015-1001"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005595"
},
{
"db": "NVD",
"id": "CVE-2015-1001"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-563"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request. IniNet SCADA Web Server is a third-party web-based server software. A directory-traversal vulnerability\n2. A security-bypass vulnerability\n3. Failed attempts will likely cause a denial-of-service condition",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-1001"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005595"
},
{
"db": "CNVD",
"id": "CNVD-2015-06868"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "VULMON",
"id": "CVE-2015-1001"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-1001",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-15-293-02",
"trust": 2.8
},
{
"db": "CNVD",
"id": "CNVD-2015-06868",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201510-563",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005595",
"trust": 0.8
},
{
"db": "BID",
"id": "77259",
"trust": 0.3
},
{
"db": "IVD",
"id": "AA7E88B0-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2015-1001",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06868"
},
{
"db": "VULMON",
"id": "CVE-2015-1001"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005595"
},
{
"db": "NVD",
"id": "CVE-2015-1001"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-563"
}
]
},
"id": "VAR-201510-0438",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06868"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06868"
}
]
},
"last_update_date": "2023-12-18T12:57:41.401000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://spidercontrol.net/home/?l=1"
},
{
"title": "Patch for IniNet Solutions SCADA Web Server Buffer Overflow Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/65888"
},
{
"title": "IniNet Solutions SCADA Web Server Fixes for stack-based buffer overflow vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=58407"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06868"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005595"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-563"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-005595"
},
{
"db": "NVD",
"id": "CVE-2015-1001"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-293-02"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-1001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1001"
},
{
"trust": 0.3,
"url": "https://www.productpilot.com/en/suppliers/ininet-solutions-gmbh/products/en"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=41643"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06868"
},
{
"db": "VULMON",
"id": "CVE-2015-1001"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005595"
},
{
"db": "NVD",
"id": "CVE-2015-1001"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-563"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06868"
},
{
"db": "VULMON",
"id": "CVE-2015-1001"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005595"
},
{
"db": "NVD",
"id": "CVE-2015-1001"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-563"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-28T00:00:00",
"db": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06868"
},
{
"date": "2015-10-25T00:00:00",
"db": "VULMON",
"id": "CVE-2015-1001"
},
{
"date": "2015-10-20T00:00:00",
"db": "BID",
"id": "77259"
},
{
"date": "2015-10-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-005595"
},
{
"date": "2015-10-25T02:59:00.133000",
"db": "NVD",
"id": "CVE-2015-1001"
},
{
"date": "2015-10-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-563"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06868"
},
{
"date": "2015-10-27T00:00:00",
"db": "VULMON",
"id": "CVE-2015-1001"
},
{
"date": "2015-10-20T00:00:00",
"db": "BID",
"id": "77259"
},
{
"date": "2015-10-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-005595"
},
{
"date": "2015-10-27T00:19:48.017000",
"db": "NVD",
"id": "CVE-2015-1001"
},
{
"date": "2015-10-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-563"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-563"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IniNet Solutions SCADA Web Server Buffer Overflow Vulnerability",
"sources": [
{
"db": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06868"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "aa7e88b0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-563"
}
],
"trust": 0.8
}
}
VAR-201510-0439
Vulnerability from variot - Updated: 2023-12-18 12:57IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string. IniNet SCADA Web Server Is URL A vulnerability exists that causes the encoding to be handled incorrectly and that is written to or deleted from the file. Supplementary information : CWE Vulnerability type by CWE-177: Improper Handling of URL Encoding (URL Improper handling of encoding ) Has been identified. IniNet SCADA Web Server is a third-party web-based server software. Prior to SCADA Web Server 2.02, there was a security restriction bypass vulnerability when dealing with URL-encoded input. An attacker could exploit the vulnerability to perform unauthorized actions. A directory-traversal vulnerability 2. A security-bypass vulnerability 3. Multiple stack-based buffer-overflow vulnerabilities Attackers can exploit these issue to bypass security restrictions and perform unauthorized actions, gain access to arbitrary files and execute arbitrary code. Failed attempts will likely cause a denial-of-service condition
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201510-0439",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scada web server",
"scope": "eq",
"trust": 1.6,
"vendor": "ininet",
"version": null
},
{
"model": "scada web server",
"scope": "lt",
"trust": 0.8,
"vendor": "ininet",
"version": "2.02"
},
{
"model": "solutions scada web server",
"scope": "lt",
"trust": 0.6,
"vendor": "ininet",
"version": "2.02"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "ininet",
"version": "2.01"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "ininet",
"version": "2.0"
},
{
"model": "embedded pc cx5100",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx5000",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx2000",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx1030",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx1020",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "embedded pc cx1010",
"scope": null,
"trust": 0.3,
"vendor": "beckhoff",
"version": null
},
{
"model": "scada web server",
"scope": "ne",
"trust": 0.3,
"vendor": "ininet",
"version": "2.02"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "scada web server",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06867"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005596"
},
{
"db": "NVD",
"id": "CVE-2015-1002"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-564"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ininet_solutions:scada_web_server:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2015-1002"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Kirill Nesterov and Aleksandr Timorin of Positive Technologies",
"sources": [
{
"db": "BID",
"id": "77259"
}
],
"trust": 0.3
},
"cve": "CVE-2015-1002",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.4,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2015-1002",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-06867",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2015-1002",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2015-06867",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201510-564",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06867"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005596"
},
{
"db": "NVD",
"id": "CVE-2015-1002"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-564"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string. IniNet SCADA Web Server Is URL A vulnerability exists that causes the encoding to be handled incorrectly and that is written to or deleted from the file. Supplementary information : CWE Vulnerability type by CWE-177: Improper Handling of URL Encoding (URL Improper handling of encoding ) Has been identified. IniNet SCADA Web Server is a third-party web-based server software. Prior to SCADA Web Server 2.02, there was a security restriction bypass vulnerability when dealing with URL-encoded input. An attacker could exploit the vulnerability to perform unauthorized actions. A directory-traversal vulnerability\n2. A security-bypass vulnerability\n3. Multiple stack-based buffer-overflow vulnerabilities\nAttackers can exploit these issue to bypass security restrictions and perform unauthorized actions, gain access to arbitrary files and execute arbitrary code. Failed attempts will likely cause a denial-of-service condition",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-1002"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005596"
},
{
"db": "CNVD",
"id": "CNVD-2015-06867"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "IVD",
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-1002",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-15-293-02",
"trust": 2.7
},
{
"db": "CNVD",
"id": "CNVD-2015-06867",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201510-564",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005596",
"trust": 0.8
},
{
"db": "BID",
"id": "77259",
"trust": 0.3
},
{
"db": "IVD",
"id": "AA7C80E2-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06867"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005596"
},
{
"db": "NVD",
"id": "CVE-2015-1002"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-564"
}
]
},
"id": "VAR-201510-0439",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06867"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06867"
}
]
},
"last_update_date": "2023-12-18T12:57:41.367000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://spidercontrol.net/home/?l=1"
},
{
"title": "IniNet Solutions SCADA Web Server Security Restricted Patch Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/65889"
},
{
"title": "IniNet Solutions embeddedWebServer Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=58408"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06867"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005596"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-564"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-005596"
},
{
"db": "NVD",
"id": "CVE-2015-1002"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-293-02"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-1002"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1002"
},
{
"trust": 0.3,
"url": "https://www.productpilot.com/en/suppliers/ininet-solutions-gmbh/products/en"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-06867"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005596"
},
{
"db": "NVD",
"id": "CVE-2015-1002"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-564"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06867"
},
{
"db": "BID",
"id": "77259"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-005596"
},
{
"db": "NVD",
"id": "CVE-2015-1002"
},
{
"db": "CNNVD",
"id": "CNNVD-201510-564"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-28T00:00:00",
"db": "IVD",
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06867"
},
{
"date": "2015-10-20T00:00:00",
"db": "BID",
"id": "77259"
},
{
"date": "2015-10-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-005596"
},
{
"date": "2015-10-25T02:59:01.523000",
"db": "NVD",
"id": "CVE-2015-1002"
},
{
"date": "2015-10-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-564"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-10-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-06867"
},
{
"date": "2015-10-20T00:00:00",
"db": "BID",
"id": "77259"
},
{
"date": "2015-10-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-005596"
},
{
"date": "2015-10-27T01:04:01.577000",
"db": "NVD",
"id": "CVE-2015-1002"
},
{
"date": "2015-10-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201510-564"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201510-564"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IniNet Solutions SCADA Web Server Security Restriction Bypass Vulnerability",
"sources": [
{
"db": "IVD",
"id": "aa7c80e2-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2015-06867"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Input Validation Error",
"sources": [
{
"db": "BID",
"id": "77259"
}
],
"trust": 0.3
}
}
VAR-201812-0478
Vulnerability from variot - Updated: 2023-12-18 12:50Reflected cross-site scripting (non-persistent) in SCADA WebServer (Versions prior to 2.03.0001) could allow an attacker to send a crafted URL that contains JavaScript, which can be reflected off the web application to the victim's browser. SCADA WebServer Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. iniNetSpiderControlSCADAWebServer is a SCADA system server from Swiss iniNetSolutions. A cross-site scripting vulnerability exists in versions prior to iniNetSpiderControlSCADAWebServer2.03.0001. A remote attacker could exploit the vulnerability to execute JavaScript code by sending a specially crafted URL. Successful exploits will result in the execution of arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201812-0478",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scada webserver",
"scope": "lt",
"trust": 1.0,
"vendor": "spidercontrol",
"version": "2.03.0001"
},
{
"model": "scada web server",
"scope": "lt",
"trust": 0.8,
"vendor": "ininet",
"version": "2.03.0001"
},
{
"model": "solutions ininet spidercontrol scada webserver",
"scope": "lt",
"trust": 0.6,
"vendor": "ininet",
"version": "2.03.0001"
},
{
"model": "scada web server",
"scope": "eq",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "2.3"
},
{
"model": "scada web server",
"scope": "ne",
"trust": 0.3,
"vendor": "spidercontrol",
"version": "2.3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "scada webserver",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25282"
},
{
"db": "BID",
"id": "106105"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012969"
},
{
"db": "NVD",
"id": "CVE-2018-18991"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:spidercontrol:scada_webserver:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.03.0001",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18991"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ismail Bulbul",
"sources": [
{
"db": "BID",
"id": "106105"
}
],
"trust": 0.3
},
"cve": "CVE-2018-18991",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-18991",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-25282",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.1,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2018-18991",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-18991",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2018-25282",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201812-126",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25282"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012969"
},
{
"db": "NVD",
"id": "CVE-2018-18991"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-126"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Reflected cross-site scripting (non-persistent) in SCADA WebServer (Versions prior to 2.03.0001) could allow an attacker to send a crafted URL that contains JavaScript, which can be reflected off the web application to the victim\u0027s browser. SCADA WebServer Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. iniNetSpiderControlSCADAWebServer is a SCADA system server from Swiss iniNetSolutions. A cross-site scripting vulnerability exists in versions prior to iniNetSpiderControlSCADAWebServer2.03.0001. A remote attacker could exploit the vulnerability to execute JavaScript code by sending a specially crafted URL. \nSuccessful exploits will result in the execution of arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18991"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012969"
},
{
"db": "CNVD",
"id": "CNVD-2018-25282"
},
{
"db": "BID",
"id": "106105"
},
{
"db": "IVD",
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-18991",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-18-338-02",
"trust": 3.3
},
{
"db": "BID",
"id": "106105",
"trust": 2.5
},
{
"db": "CNVD",
"id": "CNVD-2018-25282",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201812-126",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012969",
"trust": 0.8
},
{
"db": "IVD",
"id": "7D825C0F-463F-11E9-94AC-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25282"
},
{
"db": "BID",
"id": "106105"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012969"
},
{
"db": "NVD",
"id": "CVE-2018-18991"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-126"
}
]
},
"id": "VAR-201812-0478",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25282"
}
],
"trust": 1.675
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25282"
}
]
},
"last_update_date": "2023-12-18T12:50:28.683000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://spidercontrol.net/"
},
{
"title": "Patch for iniNetSpiderControlSCADAWebServer cross-site scripting vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/146971"
},
{
"title": "iniNet SpiderControl SCADA WebServer Fixes for cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=87422"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-25282"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012969"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-126"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012969"
},
{
"db": "NVD",
"id": "CVE-2018-18991"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-338-02"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/106105"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18991"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18991"
},
{
"trust": 0.3,
"url": "http://spidercontrol.net/download/downloadarea/?lang=en"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-25282"
},
{
"db": "BID",
"id": "106105"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012969"
},
{
"db": "NVD",
"id": "CVE-2018-18991"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-126"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25282"
},
{
"db": "BID",
"id": "106105"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012969"
},
{
"db": "NVD",
"id": "CVE-2018-18991"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-126"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-12-14T00:00:00",
"db": "IVD",
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1"
},
{
"date": "2018-12-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-25282"
},
{
"date": "2018-12-04T00:00:00",
"db": "BID",
"id": "106105"
},
{
"date": "2019-02-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012969"
},
{
"date": "2018-12-04T21:29:00.333000",
"db": "NVD",
"id": "CVE-2018-18991"
},
{
"date": "2018-12-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201812-126"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-25282"
},
{
"date": "2018-12-04T00:00:00",
"db": "BID",
"id": "106105"
},
{
"date": "2019-02-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012969"
},
{
"date": "2019-10-09T23:37:32.317000",
"db": "NVD",
"id": "CVE-2018-18991"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201812-126"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201812-126"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "iniNet SpiderControl SCADA WebServer Cross-Site Scripting Vulnerability",
"sources": [
{
"db": "IVD",
"id": "7d825c0f-463f-11e9-94ac-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25282"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-126"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201812-126"
}
],
"trust": 0.6
}
}
CVE-2023-3329 (GCVE-0-2023-3329)
Vulnerability from nvd – Published: 2023-08-02 22:26 – Updated: 2024-10-29 17:48
VLAI
EPSS
VEX
Title
CVE-2023-3329
Summary
SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iniNet | SCADAWebServer |
Affected:
0 , ≤ 2.08
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:55:03.291Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-03"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-29T17:48:36.940300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T17:48:43.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SCADAWebServer",
"vendor": "iniNet",
"versions": [
{
"lessThanOrEqual": "2.08",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI\u0027s upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-02T22:26:07.157Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-03"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2023-3329",
"x_generator": {
"engine": "VINCE 2.1.3",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2023-3329"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2023-3329",
"datePublished": "2023-08-02T22:26:07.157Z",
"dateReserved": "2023-06-19T17:52:02.498Z",
"dateUpdated": "2024-10-29T17:48:43.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3329 (GCVE-0-2023-3329)
Vulnerability from cvelistv5 – Published: 2023-08-02 22:26 – Updated: 2024-10-29 17:48
VLAI
EPSS
VEX
Title
CVE-2023-3329
Summary
SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iniNet | SCADAWebServer |
Affected:
0 , ≤ 2.08
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:55:03.291Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-03"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-29T17:48:36.940300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T17:48:43.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "SCADAWebServer",
"vendor": "iniNet",
"versions": [
{
"lessThanOrEqual": "2.08",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI\u0027s upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-08-02T22:26:07.157Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-03"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2023-3329",
"x_generator": {
"engine": "VINCE 2.1.3",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2023-3329"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2023-3329",
"datePublished": "2023-08-02T22:26:07.157Z",
"dateReserved": "2023-06-19T17:52:02.498Z",
"dateUpdated": "2024-10-29T17:48:43.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}