CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-7824
https://notcve.org/view.php?id=CVE-2018-7824
22 May 2019 — An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users with SYSTEM privilege or other important user files. Existe una vulnerabilidad de tipo referencias a recurso controlado externamente (CWE-610) en Schneider Electric Mod... • https://www.schneider-electric.com/en/download/document/SEVD-2019-099-01 • CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 9.8EPSS: 59%CPEs: 1EXPL: 4CVE-2018-7841 – Schneider Electric U.motion Builder SQL Injection Vulnerability
https://notcve.org/view.php?id=CVE-2018-7841
14 May 2019 — A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered. Existe una vulnerabilidad de Inyección de SQL (CWE-89) en U.motion Builder versión de software 1.3.4, que podría generar la ejecución de código no deseado cuando un ajuste inapropiado de caracteres es introducido. Schneider Electric U.Motion Builder version 1.3.4 suffers from an unauthenticated command injection vulnerability in tra... • https://packetstorm.news/files/id/152862 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 0CVE-2019-10953
https://notcve.org/view.php?id=CVE-2019-10953
17 Apr 2019 — ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets. En Controladores lógicos programables de ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - , versiones múltiples. Los investigadores han encontrado que algunos controladores son susceptibles a un ataque de Denegación de Servicio (DoS) debido a una inundación de paquetes de ... • http://www.securityfocus.com/bid/108413 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.3EPSS: 0%CPEs: 7EXPL: 0CVE-2015-1014
https://notcve.org/view.php?id=CVE-2015-1014
25 Mar 2019 — A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable... • https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01 • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.4EPSS: 0%CPEs: 22EXPL: 0CVE-2015-6462
https://notcve.org/view.php?id=CVE-2015-6462
21 Mar 2019 — Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser. Cross-Site Scripting (XSS) reflejado (no persistente) permite que un atacante manipule una URL específica, que contiene JavaScript que se ejecutará en el navegador del cliente P... • https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 22EXPL: 0CVE-2015-6461
https://notcve.org/view.php?id=CVE-2015-6461
21 Mar 2019 — Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page. La inclusión de archivos remotos permite que un atacante manipule una URL específica que referencia al servidor web PLC de Mo... • https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02 • CWE-20: Improper Input Validation CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7839 – Schneider Electric IIoT Monitor Hard-coded Cryptographic Key Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2018-7839
16 Jan 2019 — A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure. Existe una vulnerabilidad de problema criptográfico (CWE-310) en IIoT Monitor 3.1.38 que podría permitir la divulgación de información. This vulnerability allows the decryption of the administrator password on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists within encryption of the administrat... • https://ics-cert.us-cert.gov/advisories/ICSA-19-008-02 • CWE-310: Cryptographic Issues •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7817 – Schneider Electric ZelioSoft2 ZM2 File Parsing Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-7817
09 Jan 2019 — A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafted Zelio Soft project file. Existe una vulnerabilidad de uso de memoria previamente liberada (CWE-416) en Zelio Soft 2, en versiones v5.1 y anteriores, que podría provocar la ejecución remota de código al abrir un archivo de proyecto Zelio Soft especialmente manipulado. This vulnerability allows remote attackers to execute arbitrary code on vulnerable ... • http://www.securityfocus.com/bid/106481 • CWE-416: Use After Free •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-7796
https://notcve.org/view.php?id=CVE-2018-7796
24 Dec 2018 — A Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches), which could cause an overflow in the memcpy function, leading to corruption of data and program instability. Existe una vulnerabilidad de error en el búfer en PowerSuite 2, en todas las versiones publicadas (parches VW3A8104) que podría provocar un desbordamiento en la función memcpy, lo que conduce a la corrupción de los datos y a la inestabilidad del programa. • https://www.schneider-electric.com/en/download/document/SEVD-2018-351-01 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2018-7836 – Schneider Electric IIoT Monitor UpgradeMgmt upload Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-7836
24 Dec 2018 — An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files. Existe una vulnerabilidad de subida sin restricción de archivos con tipos peligrosos en numerosos métodos del software de IIoT Monitor 3.1.38 que podría permitir la subida y ejecución de archivos maliciosos. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric... • http://www.securityfocus.com/bid/106484 • CWE-434: Unrestricted Upload of File with Dangerous Type •