Schneider Electric IIoT Monitor Hard-coded Cryptographic Key Information Disclosure Vulnerability

This vulnerability allows the decryption of the administrator password on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists within encryption of the administrator password in the AESEncryption class....

Snyk - CLI And Build-Time Tool To Find & Fix Known Vulnerabilities In Open-Source Dependencies

Snyk helps you find, fix and monitor known vulnerabilities in Node.js npm, Ruby and Java dependencies, both on an ad hoc basis and as part of your CI Build system. Documentation Full documentation is available on snyk.io Installation 1. Install the Snyk utility using npm install -g snyk. 2. Once...

Denial Of Service (DoS)

spice is vulnerable to denial of service. An authenticated attacker is able to crash the application via invalid monitor configurations. This is due to an out-of-bounds memory access when processing malicious messages...

Information Disclosure

eap7-jboss-xnio-base is vulnerable to information disclosure attacks. The vulnerability exists as an information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marking information as sensitive, users with ...

January 15, 2019—KB4480967 (OS Build 16299.936)

None None...

PT-2019-1308

Name of the Vulnerable Software and Affected Versions IIoT Monitor version 3.1.38 Description A cryptographic issue exists in the software, which could allow information disclosure due to errors in the use of cryptography. This could enable an attacker to disclose protected information...

Schneider Electric IIoT Monitor AccountMgmt forgotPwd XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the forgotPwd method of the AccountMgmt servlet. Due to the improp...

Schneider Electric IIoT Monitor RecoveryMgmt upload Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is required to exploit this vulnerability but authentication can be easily bypassed. The specific flaw exists within the processing of the upload...

Schneider Electric IIoT Monitor downloadCSV Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists within downloadCSV.jsp servlet. The issue results from the lack of...

Schneider Electric IIoT Monitor DeviceMapMgmt upload Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the upload method of the DeviceMapMgmt servlet. The...

Schneider Electric IIoT Monitor RuleMgmt addRule XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the addRule method of the RuleMgmt servlet. Due to the improper...

Schneider Electric IIoT Monitor AccountMgmt Login XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the Login method of the AccountMgmt servlet. Due to the improper...

Schneider Electric IIoT Monitor EventMgmt getEvtPeriod XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the getEvtPeriod method of the EventMgmt servlet. Due to the...

Schneider Electric IIoT Monitor EventMgmt addEvent XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the addEvent method of the EventMgmt servlet. Due to the improper...

Schneider Electric IIoT Monitor AccountMgmt Logout XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the Logout method of the AccountMgmt servlet. Due to the improper...

WiFi-Pumpkin v0.8.7 - Framework for Rogue Wi-Fi Access Point Attack

The WiFi-Pumpkin is a rogue AP framework to easily create these fake networks, all while forwarding legitimate traffic to and from the unsuspecting target. It comes stuffed with features, including rogue Wi-Fi access points, deauth attacks on client APs, a probe request and credentials monitor,...

Schneider Electric IIoT Monitor (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: IIoT Monitor --------- Begin Update A Part 1 of 2 -------- Vulnerabilities: Path Traversal, Unrestricted Upload of File with Dangerous Type, XXE, Cryptographic Issues...

CVE-2017-18141

When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will give it access to privileged functions meant to only be accessible from the TEE in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions IPQ8074, MDM9206,...

Fedora 29 : php-phpmailer6 (2018-18f3eff32b)

Version 6.0.6 - SECURITY Fix potential object injection vulnerability. CVE-2018-19296. Reported by Sehun Oh of cyberone.kr. - Added Tagalog translation, thanks to StoneArtz - Added Malagache translation, thanks to Hackinet - Updated Serbian translation, fixed incorrect language code, thanks to...

CVE-2017-18141: Undefined Security Weakness

When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will give it access to privileged functions meant to only be accessible from the TEE in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions IPQ8074, MDM9206,...