CVSS: 7.5EPSS: 0%CPEs: 38EXPL: 0CVE-2019-6819
https://notcve.org/view.php?id=CVE-2019-6819
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames are sent to the controller in the products: Modicon M340 - firmware versions prior to V3.01, Modicon M580 - firmware versions prior to V2.80, All firmware versions of Modicon Quantum and Modicon Premium. Una CWE-754: Existe una vulnerabilidad de Comprobación Inapropiada para condiciones inusuales o excepcionales, que podría generar una posible Denegación de Servicio cuando se envían tramas Modbus específicas hacia el controlador en los productos: Modicon M340 - versiones de firmware anteriores a la V3.01, Modicon M580 - versiones de firmware anteriores a V2.80, y todas las versiones de firmware de Modicon Quantum y Modicon Premium. • http://www.securityfocus.com/bid/109004 https://www.schneider-electric.com/en/download/document/SEVD-2019-134-05 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.4EPSS: 0%CPEs: 22EXPL: 0CVE-2015-6462
https://notcve.org/view.php?id=CVE-2015-6462
Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser. Cross-Site Scripting (XSS) reflejado (no persistente) permite que un atacante manipule una URL específica, que contiene JavaScript que se ejecutará en el navegador del cliente PLC de Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H o BMXP342030H. • https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 22EXPL: 0CVE-2015-6461
https://notcve.org/view.php?id=CVE-2015-6461
Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page. La inclusión de archivos remotos permite que un atacante manipule una URL específica que referencia al servidor web PLC de Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H o BMXP342030H, de Schneider Electric, el cual, una vez lanzado, resultará en la redirección del navegador a un archivo remoto mediante un script de Java cargado con la página web. • https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02 • CWE-20: Improper Input Validation CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 10.0EPSS: 0%CPEs: 120EXPL: 0CVE-2018-7241
https://notcve.org/view.php?id=CVE-2018-7241
Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. Existen cuentas embebidas en los controladores Modicon Premium, Modicon Quantum, Modicon M340 y BMXNOR0200, de Schneider Electric, en todas las versiones de los módulos de comunicación. • http://www.securityfocus.com/bid/103542 https://ics-cert.us-cert.gov/advisories/ICSA-18-086-01 https://www.schneider-electric.com/en/download/document/SEVD-2018-081-01 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 120EXPL: 0CVE-2018-7762
https://notcve.org/view.php?id=CVE-2018-7762
A vulnerability exists in the web services to process SOAP requests in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow result in a buffer overflow. Existe una vulnerabilidad en los servicios web que procesan peticiones SOAP en Modicon M340, Modicon Premium, Modicon Quantum PLC y BMXNOR0200, de Schneider Electric, que podría conducir a un desbordamiento de búfer. • https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •