CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 1CVE-2018-10620
https://notcve.org/view.php?id=CVE-2018-10620
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed. En AVEVA InduSoft Web Studio v8.1 y v8.1SP1 e InTouch Machine Edition v2017 8.1 y v2017 8.1 SP1, un usuario remoto podría enviar un paquete cuidadosamente manipulado para explotar una vulnerabilidad de desbordamiento de búfer basado en pila durante acciones relacionadas con etiquetas, alarmas o eventos, tales como la lectura y la escritura, con la posibilidad de que se ejecute código. • http://www.securityfocus.com/bid/104870 https://ics-cert.us-cert.gov/advisories/ICSA-18-200-01 https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec128%28002%29.pdf https://www.tenable.com/security/research/tra-2018-19 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2017-6021
https://notcve.org/view.php?id=CVE-2017-6021
In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build 77.5882) and prior, an attacker with network access to the ClearSCADA server can send specially crafted sequences of commands and data packets to the ClearSCADA server that can cause the ClearSCADA server process and ClearSCADA communications driver processes to terminate. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). En Schneider Electric ClearSCADA 2014 R1 (build 75.5210) y anteriores, 2014 R1.1 (build 75.5387) y anteriores, 2015 R1 (build 76.5648) y anteriores y 2015 R2 (build 77.5882) y anteriores, un atacante con acceso de red al servidor ClearSCADA puede enviar secuencias de comandos especialmente manipuladas y paquetes de datos al servidor ClearSCADA que pueden provocar que el proceso del servidor ClearSCADA y los procesos del controlador de comunicaciones ClearSCADA finalicen. Se ha calculado una puntuación base de CVSS v3 de 7.5; la cadena de vector CVSS es (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). • http://www.securityfocus.com/bid/96768 https://ics-cert.us-cert.gov/advisories/ICSA-17-068-01 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-9962
https://notcve.org/view.php?id=CVE-2017-9962
Schneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a memory allocation vulnerability, whereby malformed requests can be sent to ClearSCADA client applications to cause unexpected behavior. Client applications affected include ViewX and the Server Icon. Las versiones anteriores a agosto 2017 de ClearSCADA de Schneider Electric son susceptibles a una vulnerabilidad de asignación de memoria en la que se podrían enviar peticiones mal formadas a las aplicaciones cliente de ClearSCADA para provocar un comportamiento inesperado. Las aplicaciones cliente afectadas son ViewX y el icono de servidor. • http://www.schneider-electric.com/en/download/document/SEVD-2017-264-01 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5160
https://notcve.org/view.php?id=CVE-2017-5160
An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The software will connect via Transport Layer Security without verifying the peer's SSL certificate properly. Se ha descubierto un problema Inadequate Encryption Strength en Schneider Electric Wonderware InTouch Access Anywhere, versión 11.5.2 y en versiones anteriores. El software se conectará a través de Transport Layer Security sin verificar correctamente el certificado SSL de los pares. • http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114 http://www.securityfocus.com/bid/97256 https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01 • CWE-326: Inadequate Encryption Strength •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-5158
https://notcve.org/view.php?id=CVE-2017-5158
An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters, as arbitrary destination addresses may be specified. Se ha descubierto un problema de exposición de la información en Schneider Electric Wonderware InTouch Access Anywhere, versión 11.5.2 y en versiones anteriores. Las credenciales pueden estar expuestas a sistemas externos a través de parámetros específicos de URL, se pueden especificar direcciones de destino arbitrarias. • http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000114 http://www.securityfocus.com/bid/97256 https://ics-cert.us-cert.gov/advisories/ICSA-17-089-01 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •