Luigi Auriemma

The issue is related to a Denial of Service (DoS) condition caused by a malformed client query.

The issue allows remote attackers to read cleartext credentials for administrative accounts via SELECT statements that leverage the guest role. This is related to an information disclosure vulnerability.

The issue is related to a stack-based buffer overflow in the SCADA server, which can be triggered by remote attackers to cause a denial of service, resulting in a system crash. This occurs when access is attempted to DLL code located in the IntegraXor directory.

The issue allows remote attackers to read arbitrary project backup files by using a crafted URL.

The issue is related to a buffer overflow in phrelay, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via crafted packets to TCP port 4868. This is due to improper handling of the /dev/photon device file.

A directory traversal issue exists in the PmWebDir object within the web server of MICROSYS PROMOTIC, allowing remote attackers to read arbitrary files.

A stack-based buffer overflow issue exists in an ActiveX component, allowing remote attackers to cause a denial of service via a crafted web page.

A heap-based buffer overflow issue exists in an ActiveX component, allowing remote attackers to cause a denial of service via a crafted web page.

The issue involves multiple unspecified vulnerabilities that allow remote attackers to execute arbitrary code via crafted input. A specific example is a stack-based buffer overflow in iNodeMngChecker.exe when processing a crafted 0x0A0BF007 packet.

The issue allows remote attackers to cause a denial of service, potentially resulting in an invalid 0x00 write operation and daemon crash, via a crafted TCP packet sent to port 46824. The packet must contain a crafted positive integer after the opcode.

The issue allows remote attackers to read arbitrary files via port 46824 TCP packets. This is achieved by specifying a file-open operation with opcode `0x78` and a `..` (dot dot) in a pathname, followed by a file-read operation with opcode `0x96`, `0x97`, or `0x98`.

The issue allows remote attackers to execute arbitrary code via a crafted TCP packet sent to port 46824, containing a negative integer after the opcode. This triggers incorrect function-pointer processing, potentially leading to a buffer overflow.

The issue allows remote attackers to execute arbitrary code via a crafted TCP packet on port 46824. This is achieved by sending a packet with a crafted positive integer after the opcode, which triggers incorrect function-pointer processing and can lead to a buffer overflow.

The issue is related to the lack of validation of the return value of the `realloc` function, which can be exploited by remote attackers. This can be achieved by sending a crafted TCP packet to port 46824 with a negative integer after the opcode, potentially causing a denial of service due to an invalid 0x00 write operation and daemon crash. There may be other unspecified impacts.

A stack-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a crafted TCP packet on port 46824. This occurs due to an incorrect file-open attempt triggered by the ` TCPIPS BinOpenFileFP` function.

The issue allows remote attackers to cause a denial of service, resulting in a crash, by sending a long string in certain fields. This can be demonstrated using the MAC address field and may be related to a buffer overflow.

The issue allows remote attackers to cause a denial of service, resulting in a continuous restart, by using a crafted controller name.

The issue allows remote attackers to execute arbitrary code. It is related to the ConnectDDNS method in the STWConfigNVR and STWConfig ActiveX controls.

The issue allows remote attackers to cause a denial of service, resulting in an infinite loop. This can be achieved by sending a TCP request with a negative size value to specific services, including "NiwMasterService" or "NiwStorageService".

The issue is related to multiple stack-based buffer overflows in the BackupToAvi method within the UMS Ctrl and UMS Ctrl STW ActiveX controls. This allows remote attackers to execute arbitrary code via a long string in the `fname` parameter.