Schneider-Electric
Page 4 of 9 — Schneider-Electric CVEs from a corpus of 880, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22787 | High | 7.5 | 2022-02-11 | A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP reque… |
CVE-2021-22785 | High | 7.5 | 2022-02-11 | A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker… |
CVE-2021-22748 | High | 8.8 | 2022-02-11 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when a f… |
CVE-2022-24321 | High | 7.5 | 2022-02-09 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when recei… |
CVE-2022-24320 | Medium | 5.9 | 2022-02-09 | A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA… |
CVE-2022-24319 | Medium | 5.9 | 2022-02-09 | A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA… |
CVE-2022-24318 | High | 7.5 | 2022-02-09 | A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX… |
CVE-2022-24317 | High | 7.5 | 2022-02-09 | A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Intera… |
CVE-2022-24316 | High | 7.5 | 2022-02-09 | A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a specially crafted message. Affected Prod… |
CVE-2022-24315 | High | 7.5 | 2022-02-09 | A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message. Affected P… |
CVE-2022-24314 | High | 7.5 | 2022-02-09 | A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker repeatedly sends a… |
CVE-2022-24313 | Critical | 9.8 | 2022-02-09 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code ex… |
CVE-2022-24312 | Critical | 9.8 | 2022-02-09 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end o… |
CVE-2022-24311 | Critical | 9.8 | 2022-02-09 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at be… |
CVE-2022-24310 | Critical | 9.8 | 2022-02-09 | A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote… |
CVE-2022-22813 | Critical | 9.8 | 2022-02-09 | A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active control of the Courier t… |
CVE-2022-22812 | Medium | 6.1 | 2022-02-09 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a web session compromise w… |
CVE-2022-22811 | High | 8.1 | 2022-02-09 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could induce users to perform unintended actions, leading to the override of the system�… |
CVE-2022-22810 | Critical | 9.8 | 2022-02-09 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to manipulate the admin after numerous a… |
CVE-2022-22809 | Medium | 5.3 | 2022-02-09 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized mann… |
CVE-2022-22808 | High | 8.8 | 2022-02-09 | A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain… |
CVE-2022-22807 | High | 7.4 | 2022-02-09 | A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user… |
CVE-2021-22817 | High | 7.8 | 2022-02-09 | A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privileg… |
CVE-2022-22804 | Medium | 5.4 | 2022-02-04 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authenticated attacker… |
CVE-2022-22727 | High | 8.8 | 2022-02-04 | A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the… |
CVE-2022-22726 | Medium | 6.5 | 2022-02-04 | A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited ope… |
CVE-2022-22725 | High | 8.8 | 2022-02-04 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code exec… |
CVE-2022-22724 | High | 7.5 | 2022-02-04 | A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), when sending a larg… |
CVE-2022-22723 | High | 8.8 | 2022-02-04 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code exec… |
CVE-2022-22722 | High | 7.5 | 2022-02-04 | A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic… |
CVE-2020-7534 | High | 8.8 | 2022-02-04 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on… |
CVE-2021-22827 | High | 8.8 | 2022-01-28 | A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload… |
CVE-2021-22826 | High | 8.8 | 2022-01-28 | A CWE-20: Improper Input Validation vulnerability exists that could cause arbitrary code execution when the user visits a page containing the injected payload… |
CVE-2021-22825 | High | 8.0 | 2022-01-28 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system with elevated priv… |
CVE-2021-22822 | Medium | 6.1 | 2022-01-28 | A CWE-79 Improper Neutralization of Input During Web Page Generation (�Cross-site Scripting�) vulnerability exists that could allow an attacker to impersonate… |
CVE-2021-22821 | High | 8.6 | 2022-01-28 | A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended network targets whe… |
CVE-2021-22820 | Critical | 9.8 | 2022-01-28 | A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the c… |
CVE-2021-22819 | Medium | 4.3 | 2022-01-28 | A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user… |
CVE-2021-22818 | High | 7.5 | 2022-01-28 | A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the chargi… |
CVE-2021-22816 | High | 7.5 | 2022-01-28 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a Denial of Service of the RTU when receiving a specially… |
CVE-2021-22815 | Medium | 5.3 | 2022-01-28 | A CWE-200: Information Exposure vulnerability exists which could cause the troubleshooting archive to be accessed. Affected Products: 1-Phase Uninterruptible P… |
CVE-2021-22814 | Medium | 6.1 | 2022-01-28 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists which could cause arbritrary script executi… |
CVE-2021-22813 | Medium | 6.1 | 2022-01-28 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script executio… |
CVE-2021-22812 | Medium | 6.1 | 2022-01-28 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script executio… |
CVE-2021-22811 | Medium | 6.1 | 2022-01-28 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause script execution when the… |
CVE-2021-22810 | Medium | 6.1 | 2022-01-28 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause arbritrary script executio… |
CVE-2021-22809 | Medium | 5.5 | 2022-01-28 | A CWE-125:Out-of-Bounds Read vulnerability exists that could cause unintended data disclosure when a malicious *.gd1 configuration file is loaded into the GUIc… |
CVE-2021-22808 | High | 7.8 | 2022-01-28 | A CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is loaded into the GUIcon to… |
CVE-2021-22807 | High | 7.8 | 2022-01-28 | A CWE-787: Out-of-bounds Write vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is loaded into the GUIc… |
CVE-2021-22799 | Low | 3.8 | 2022-01-28 | A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker ma… |
CVE-2021-22725 | High | 8.8 | 2022-01-28 | A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when… |
CVE-2021-22724 | High | 8.8 | 2022-01-28 | A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when… |
CVE-2021-22793 | High | 7.2 | 2021-09-02 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exist in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSine PCSn… |
CVE-2021-22792 | High | 7.5 | 2021-09-02 | A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller a… |
CVE-2021-22791 | Medium | 6.5 | 2021-09-02 | A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller applic… |
CVE-2021-22790 | Medium | 6.5 | 2021-09-02 | A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller applica… |
CVE-2021-22789 | Medium | 6.5 | 2021-09-02 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the Modicon PLC contro… |
CVE-2021-22775 | High | 7.8 | 2021-09-02 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in GP-Pro EX,V4.09.250 and prior, that could cause local code execution with elevated privileg… |
CVE-2021-22704 | Critical | 9.1 | 2021-09-02 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions p… |
CVE-2021-22784 | Medium | 5.7 | 2021-07-21 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attacker to use a crafted w… |
CVE-2021-22777 | High | 7.8 | 2021-07-21 | A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file. |
CVE-2021-22774 | High | 7.5 | 2021-07-21 | A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (E… |
CVE-2021-22773 | Medium | 6.5 | 2021-07-21 | A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2… |
CVE-2021-22772 | Critical | 9.8 | 2021-07-21 | A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Easergy T200 ((IEC104)… |
CVE-2021-22771 | High | 7.3 | 2021-07-21 | A CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in Easergy T300 with firmware V2.7.1 and older that would allow arbi… |
CVE-2021-22770 | Medium | 6.5 | 2021-07-21 | A CWE-200: Information Exposure vulnerability exists in Easergy T300 with firmware V2.7.1 and older that exposes sensitive information to an actor not explicit… |
CVE-2021-22730 | Critical | 9.8 | 2021-07-21 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / E… |
CVE-2021-22729 | Critical | 9.8 | 2021-07-21 | A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2… |
CVE-2021-22728 | Medium | 6.5 | 2021-07-21 | A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV… |
CVE-2021-22727 | Critical | 9.8 | 2021-07-21 | A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV… |
CVE-2021-22726 | High | 8.1 | 2021-07-21 | A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW… |
CVE-2021-22723 | Medium | 6.1 | 2021-07-21 | A CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-siteScripting) through Cross-Site Request Forgery (CSRF) vulnerability exists in E… |
CVE-2021-22722 | Medium | 5.4 | 2021-07-21 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Stored Cross-site Scripting') vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4… |
CVE-2021-22721 | Medium | 5.3 | 2021-07-21 | A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV… |
CVE-2021-22708 | High | 7.2 | 2021-07-21 | A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlin… |
CVE-2021-22707 | Critical | 9.8 | 2021-07-21 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / E… |
CVE-2021-22706 | Medium | 6.1 | 2021-07-21 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all ve… |
CVE-2021-22782 | Medium | 5.5 | 2021-07-14 | Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro)… |
CVE-2021-22781 | Medium | 5.5 | 2021-07-14 | Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro)… |
CVE-2021-22780 | High | 7.1 | 2021-07-14 | Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro)… |
CVE-2021-22779 | Critical | 9.1 | 2021-07-14 | Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), Ec… |
CVE-2021-22778 | High | 7.1 | 2021-07-14 | Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro)… |
CVE-2021-22769 | Medium | 4.3 | 2021-06-11 | A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Easergy T300 with firmware V2.7.1 and older that could expose files or d… |
CVE-2021-22768 | Critical | 9.8 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22767 | Critical | 9.8 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22766 | High | 7.5 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22765 | Critical | 9.8 | 2021-06-11 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause… |
CVE-2021-22764 | Medium | 5.3 | 2021-06-11 | A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notifica… |
CVE-2021-22763 | Critical | 9.8 | 2021-06-11 | A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLog… |
CVE-2021-22762 | High | 7.8 | 2021-06-11 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could resul… |
CVE-2021-22761 | High | 7.8 | 2021-06-11 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior tha… |
CVE-2021-22760 | High | 7.8 | 2021-06-11 | A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data o… |
CVE-2021-22759 | High | 7.8 | 2021-06-11 | A CWE-416: Use after free vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution d… |
CVE-2021-22758 | High | 7.8 | 2021-06-11 | A CWE-824: Access of uninitialized pointer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote… |
CVE-2021-22757 | High | 7.8 | 2021-06-11 | A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote… |
CVE-2021-22756 | High | 7.8 | 2021-06-11 | A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote… |
CVE-2021-22755 | High | 7.8 | 2021-06-11 | A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remot… |
CVE-2021-22754 | High | 7.8 | 2021-06-11 | A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execut… |
CVE-2021-22753 | High | 7.8 | 2021-06-11 | A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code executi… |
CVE-2021-22752 | High | 7.8 | 2021-06-11 | A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execut… |