Schneider-Electric
Page 7 of 9 — Schneider-Electric CVEs from a corpus of 880, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-7854 | High | 7.5 | 2019-05-22 | A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a d… |
CVE-2018-7853 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause de… |
CVE-2018-7844 | High | 7.5 | 2019-05-22 | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause… |
CVE-2018-7803 | Medium | 5.9 | 2019-05-22 | A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TriStation Emulator V1.2.0, which could cause the emulator to c… |
CVE-2019-6821 | Medium | 6.5 | 2019-05-22 | CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon… |
CVE-2019-6820 | High | 8.2 | 2019-05-22 | A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network m… |
CVE-2019-6819 | High | 7.5 | 2019-05-22 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when specific Modbus frames… |
CVE-2019-6816 | Critical | 9.1 | 2019-05-22 | In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware modification with possible Denial of Serv… |
CVE-2019-6815 | Critical | 9.1 | 2019-05-22 | In Modicon Quantum all firmware versions, CWE-264: Permissions, Privileges, and Access Control vulnerabilities could cause a denial of service or unauthorized… |
CVE-2019-6814 | Critical | 9.8 | 2019-05-22 | A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiali… |
CVE-2019-6812 | High | 7.2 | 2019-05-22 | A CWE-798 use of hardcoded credentials vulnerability exists in BMX-NOR-0200H with firmware versions prior to V1.7 IR 19 which could cause a confidentiality iss… |
CVE-2018-7852 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause de… |
CVE-2018-7851 | Medium | 6.5 | 2019-05-22 | CWE-119: Buffer errors vulnerability exists in Modicon M580 with firmware prior to V2.50, Modicon M340 with firmware prior to V3.01, BMxCRA312xx with firmware… |
CVE-2018-7850 | Medium | 5.3 | 2019-05-22 | A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Mod… |
CVE-2018-7849 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a p… |
CVE-2018-7848 | High | 7.5 | 2019-05-22 | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause… |
CVE-2018-7847 | Critical | 9.8 | 2019-05-22 | A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cau… |
CVE-2018-7846 | Critical | 9.8 | 2019-05-22 | A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and… |
CVE-2018-7845 | High | 7.5 | 2019-05-22 | A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause th… |
CVE-2018-7843 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause de… |
CVE-2018-7842 | Critical | 9.8 | 2019-05-22 | A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which… |
CVE-2018-7841 | Critical | 9.8 | 2019-05-22 | A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of char… |
CVE-2018-7834 | Medium | 6.1 | 2019-05-22 | A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a specially crafted URL with an embedded scrip… |
CVE-2018-7829 | High | 8.8 | 2019-05-22 | An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which… |
CVE-2018-7828 | High | 8.8 | 2019-05-22 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user… |
CVE-2018-7827 | Medium | 5.4 | 2019-05-22 | A Cross-Site Scripting (XSS) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which a remote attacker can execu… |
CVE-2018-7826 | High | 8.8 | 2019-05-22 | A Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrar… |
CVE-2018-7825 | High | 8.8 | 2019-05-22 | A Command Injection vulnerability exists in the web-based GUI of the 1st Gen PelcoSarix Enhanced Camera that could allow a remote attacker to execute arbitrary… |
CVE-2018-7824 | Medium | 4.9 | 2019-05-22 | An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 a… |
CVE-2018-7823 | Medium | 5.3 | 2019-05-22 | A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which c… |
CVE-2018-7822 | Medium | 5.5 | 2019-05-22 | An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmwa… |
CVE-2018-7821 | High | 7.5 | 2019-05-22 | An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which… |
CVE-2018-7816 | Medium | 6.5 | 2019-05-22 | A Permissions, Privileges, and Access Control vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote at… |
CVE-2018-7788 | Medium | 6.5 | 2019-05-22 | A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which could cause a Denial Of Service when usin… |
CVE-2019-10953 | High | 7.5 | 2019-04-17 | ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are suscep… |
CVE-2015-1014 | High | 7.3 | 2019-03-25 | A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric… |
CVE-2015-6462 | Medium | 5.4 | 2019-03-21 | Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider El… |
CVE-2015-6461 | Medium | 5.4 | 2019-03-21 | Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BM… |
CVE-2018-7839 | Medium | 5.5 | 2019-02-06 | A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure. |
CVE-2018-7817 | High | 7.8 | 2019-02-06 | A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafte… |
CVE-2018-7815 | High | 7.8 | 2019-02-06 | A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3core.dll which could cause remote code t… |
CVE-2018-7814 | High | 7.8 | 2019-02-06 | A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) which could cause remote code to… |
CVE-2018-7813 | High | 7.8 | 2019-02-06 | A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pcwin.dll which could cause remote code to… |
CVE-2018-7837 | High | 7.5 | 2018-12-24 | An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow… |
CVE-2018-7836 | Critical | 9.8 | 2018-12-24 | An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and exe… |
CVE-2018-7835 | High | 7.5 | 2018-12-24 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files… |
CVE-2018-7832 | High | 8.8 | 2018-12-24 | An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause the execution arbitrary executable when G… |
CVE-2018-7802 | High | 8.8 | 2018-12-24 | A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full privileges. |
CVE-2018-7801 | High | 8.8 | 2018-12-24 | A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when a remote code executi… |
CVE-2018-7800 | Critical | 9.8 | 2018-12-24 | A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device. |
CVE-2018-7796 | Medium | 6.3 | 2018-12-24 | A Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches), which could cause an overflow in the memcpy function, leading… |
CVE-2018-7793 | High | 8.7 | 2018-12-24 | A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro DCS Control Core Servi… |
CVE-2018-7833 | High | 7.5 | 2018-12-17 | An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0… |
CVE-2018-7812 | High | 7.5 | 2018-12-17 | An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where th… |
CVE-2018-7804 | Medium | 6.1 | 2018-12-17 | A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user cli… |
CVE-2018-7797 | Medium | 6.1 | 2018-12-17 | A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all… |
CVE-2018-7831 | High | 8.8 | 2018-11-30 | An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium… |
CVE-2018-7830 | High | 7.5 | 2018-11-30 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedded web servers in all Modicon M340, Pre… |
CVE-2018-7811 | Critical | 9.8 | 2018-11-30 | An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an u… |
CVE-2018-7810 | Medium | 6.1 | 2018-11-30 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in all Modicon M340, P… |
CVE-2018-7809 | Critical | 9.8 | 2018-11-30 | An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an u… |
CVE-2018-7807 | High | 8.8 | 2018-11-30 | Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file… |
CVE-2018-7806 | High | 8.8 | 2018-11-30 | Data Center Operation allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly upload… |
CVE-2018-7799 | High | 7.8 | 2018-11-02 | A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attacker to execute arbit… |
CVE-2018-7798 | High | 8.2 | 2018-11-02 | A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configura… |
CVE-2018-7792 | High | 7.5 | 2018-08-29 | A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware… |
CVE-2018-7791 | Critical | 9.8 | 2018-08-29 | A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware… |
CVE-2018-7790 | Critical | 9.8 | 2018-08-29 | An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). Th… |
CVE-2018-7795 | Medium | 5.4 | 2018-08-29 | A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the prod… |
CVE-2018-7789 | High | 7.5 | 2018-08-29 | An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior t… |
CVE-2018-3693 | Medium | 5.6 | 2018-07-10 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local u… |
CVE-2018-7787 | Medium | 5.3 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTT… |
CVE-2018-7786 | Medium | 6.1 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability exists which could allow injection of mali… |
CVE-2018-7785 | Critical | 9.8 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass. |
CVE-2018-7784 | Critical | 9.8 | 2018-07-03 | In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data of an input string is evaluated as a comm… |
CVE-2018-7783 | High | 7.5 | 2018-07-03 | Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulti… |
CVE-2018-7782 | High | 8.8 | 2018-07-03 | In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear… |
CVE-2018-7781 | High | 8.8 | 2018-07-03 | In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authen… |
CVE-2018-7780 | Critical | 9.8 | 2018-07-03 | In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerability exist in cgi pro… |
CVE-2018-7779 | High | 7.5 | 2018-07-03 | In Schneider Electric Wiser for KNX V2.1.0 and prior, homeLYnk V2.0.1 and prior; and spaceLYnk V2.1.0 and prior, weak and unprotected FTP access could allow an… |
CVE-2018-7778 | Critical | 9.8 | 2018-07-03 | In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12_v1, the Web Interface has an issue that may allow a remote attacker to gain administr… |
CVE-2018-7777 | High | 8.8 | 2018-07-03 | The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software version… |
CVE-2018-7776 | Medium | 4.3 | 2018-07-03 | The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attac… |
CVE-2018-7774 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of localize.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite data… |
CVE-2018-7773 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of nfcserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite dat… |
CVE-2018-7772 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software versions prior to v1… |
CVE-2018-7771 | High | 8.0 | 2018-07-03 | The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vu… |
CVE-2018-7770 | Medium | 6.5 | 2018-07-03 | The vulnerability exists within processing of sendmail.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The applet allows callers… |
CVE-2018-7769 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of xmlserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite dat… |
CVE-2018-7768 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of loadtemplate.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite… |
CVE-2018-7767 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of editobject.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite da… |
CVE-2018-7766 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of track_getdata.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite… |
CVE-2018-7765 | High | 8.8 | 2018-07-03 | The vulnerability exists within processing of track_import_export.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying… |
CVE-2018-7764 | Medium | 4.3 | 2018-07-03 | The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal v… |
CVE-2018-7763 | Medium | 4.3 | 2018-07-03 | The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The 'css' parameter contains a directory… |
CVE-2018-1126 | Medium | 4.8 | 2018-05-23 | procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related… |
CVE-2018-1124 | High | 7.8 | 2018-05-23 | procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escal… |
CVE-2018-3639 | Medium | 5.5 | 2018-05-22 | Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are know… |
CVE-2017-9637 | Medium | 4.1 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to us… |
CVE-2017-9635 | Low | 3.9 | 2018-05-18 | Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a wea… |