CVE-2020-7571: Improper Neutralization of Input During Web Page Generation

A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation Cross-site Scripting Reflected vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of use...

Schneider Electric EcoStruxure Building Operation WebReports Cross-site Scripting Vulnerabilities

Schneider Electric EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in Schneider Electric EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of...

Schneider Electric EcoStruxure Building Operation WebReports security vulnerabilities

EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. An improper access control vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. A remote attacker could exploit this vulnerability to access restricted web resources...

CVE-2020-7572: Improper Restriction of XML External Entity Reference

A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server...

CVE-2020-28210: Improper Neutralization of Input During Web Page Generation

A CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser...

PT-2020-5820

Name of the Vulnerable Software and Affected Versions: EcoStruxure Building Operation WebReports versions V1.9 through V3.1 Description: A vulnerability exists due to the incorrect verification of user-supplied files, allowing an authenticated remote user to upload arbitrary files and achieve...

PT-2020-5822

Name of the Vulnerable Software and Affected Versions: EcoStruxure Building Operation WebReports versions 1.9 through 3.1 Description: The issue is related to insufficient protection of the web page structure, allowing a remote attacker to inject arbitrary web script or HTML due to incorrect...

PT-2020-5821

Name of the Vulnerable Software and Affected Versions: EcoStruxure Building Operation WebReports versions 1.9 through 3.1 Description: A Cross-site Scripting stored vulnerability exists due to improper neutralization of input during web page generation, allowing an authenticated remote user to...

PT-2020-5824 · Schneider Electric · Ecostruxure Building Operation Webreports

Name of the Vulnerable Software and Affected Versions: EcoStruxure Building Operation WebReports versions 1.9 through 3.1 Description: A CWE-284 Improper Access Control issue exists that could allow a remote attacker to access restricted web resources due to improper access control, potentially...

PT-2020-5823

Name of the Vulnerable Software and Affected Versions: EcoStruxure Building Operation WebReports versions 1.9 through 3.1 Description: A vulnerability exists due to improper restriction of XML external entity references, allowing an authenticated remote user to inject arbitrary XML code. This cou...

Schneider Electric Building Operation Automation Server Vulnerability

OVERVIEW Independent researcher Karn Ganeshen has identified a vulnerability in servers programmed with Schneider Electric’s StruxureWare Building Operation software. Schneider Electric has produced a new version to mitigate this vulnerability. This vulnerability could be exploited remotely...

Schneider Electric StruxureWare Building Operation Automation Server msh bypass

Added: 03/14/2016 CVE: CVE-2016-2278 Background The Schneider Electric StruxureWare Building Operation software suite provides integrated monitoring, control, and management of energy, HVAC, lighting and fire safety. The Automation Server is a building automation system for small and medium-sized...

Schneider Electric StruxureWare Building Operation Automation Server msh bypass

Added: 03/14/2016 CVE: CVE-2016-2278 Background The Schneider Electric StruxureWare Building Operation software suite provides integrated monitoring, control, and management of energy, HVAC, lighting and fire safety. The Automation Server is a building automation system for small and medium-sized...

Schneider Electric StruxureWare Building Operation Automation Server msh bypass

Added: 03/14/2016 CVE: CVE-2016-2278 Background The Schneider Electric StruxureWare Building Operation software suite provides integrated monitoring, control, and management of energy, HVAC, lighting and fire safety. The Automation Server is a building automation system for small and medium-sized...

Schneider Electric StruxureWare Building Operation Automation Server msh bypass

Added: 03/14/2016 CVE: CVE-2016-2278 Background The Schneider Electric StruxureWare Building Operation software suite provides integrated monitoring, control, and management of energy, HVAC, lighting and fire safety. The Automation Server is a building automation system for small and medium-sized...

Schneider Electric Building Operation Application Server Operating System Command Injection Vulnerability

Schneider Electric StruxureWare Building Operation Application Server is a set of automation systems for small and medium-sized buildings from the French company Schneider Electric Schneider Electric. An operating system command injection vulnerability exists in Schneider Electric StruxureWare...