Schneider Electric 多款产品安全漏洞

Schneider Electric Vijeo Designer Basic and Schneider Electric Vijeo Designer are both a suite of programming and design software for HMIs Human Machine Interfaces from Schneider Electric, France. A security vulnerability exists in a number of Schneider Electric products, which can be exploited b...

PT-2022-9287

Name of the Vulnerable Software and Affected Versions Harmony/Magelis iPC Series All Versions Vijeo Designer versions prior to V6.2 SP11 Multiple HotFix 4 Vijeo Designer Basic versions prior to V1.2.1 Description A vulnerability exists that could cause unauthorized access to the base installation...

CVE-2021-22817: Incorrect Default Permissions

A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation. Affected Product: Harmony/Magelis iPC Series All Versions, Vijeo Designer All Versions prior to V6.2 SP11 Multiple HotFix 4,...

Fancy Product Designer < 4.7.5 - Admin+ SQL Injection

The plugin is vulnerable to SQL Injection due to insufficient escaping and validation of the ID parameter found in the /inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information...

Mitsubishi (CVE-2017-9638) (deprecated)

Plugin deprecated because e-designer is not detectable in this way This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2023/03/10. Deprecated because...

Mitsubishi (CVE-2017-9634) (deprecated)

Plugin deprecated because e-designer is not detectable in this way This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2023/03/10. Deprecated because...

azureml-designer-recommender-modules (>=0.0.1, <=0.0.9), bent (>=0.0.9, <=0.0.27) +32 more potentially affected by CVE-2022-23591 via tensorflow-gpu (>=2.0.0, <=2.5.1)

tensorflow-gpu PYPI version =2.0.0, =0.0.1, =0.0.9, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.1.0, =0.2.0, =0.6.4, =0.8.2 - maupassant 0.1.1 - mlreflect 0.16.0 and more Source cves: CVE-2022-23591 Source advisory: OSV:PYSEC-2022-155...

azureml-designer-recommender-modules (>=0.0.1, <=0.0.9), bent (>=0.0.9, <=0.0.27) +32 more potentially affected by CVE-2022-21725 via tensorflow-gpu (>=2.0.0, <=2.5.1)

tensorflow-gpu PYPI version =2.0.0, =0.0.1, =0.0.9, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.1.0, =0.2.0, =0.6.4, =0.8.2 - maupassant 0.1.1 - mlreflect 0.16.0 and more Source cves: CVE-2022-21725 Source advisory: OSV:PYSEC-2022-104...

azureml-designer-recommender-modules (>=0.0.1, <=0.0.9), bent (>=0.0.9, <=0.0.27) +32 more potentially affected by CVE-2022-23569 via tensorflow-gpu (>=2.0.0, <=2.5.1)

tensorflow-gpu PYPI version =2.0.0, =0.0.1, =0.0.9, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.1.0, =0.2.0, =0.6.4, =0.8.2 - maupassant 0.1.1 - mlreflect 0.16.0 and more Source cves: CVE-2022-23569 Source advisory: OSV:PYSEC-2022-133...

azureml-designer-recommender-modules (>=0.0.1, <=0.0.9), bent (>=0.0.9, <=0.0.27) +32 more potentially affected by CVE-2022-21736 via tensorflow-gpu (>=2.0.0, <=2.5.1)

tensorflow-gpu PYPI version =2.0.0, =0.0.1, =0.0.9, =0.0.4, =1.1.1, =1.1.0, =0.1.1, =0.1.0, =0.2.0, =0.6.4, =0.8.2 - maupassant 0.1.1 - mlreflect 0.16.0 and more Source cves: CVE-2022-21736 Source advisory: OSV:PYSEC-2022-115...

entfrm-bpmn (>=8.6.2, <=8.6.6), entfrm-flowable-designer (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2021-23460 via min-dash (3.5.2)

min-dash NPM version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on min-dash and may be impacted: - entfrm-bpmn =8.6.2, =1.0.0, =2.2.0, =1.0.0, =1.1.3 Source cves: CVE-2021-23460 Source advisory: OSV:GHSA-2M53-83F3-562J...

WordPress Email Template Designer – WP HTML Mail 3.0.9 Cross Site Scripting

Exploit makes it possible for unauthenticated attackers to achieve complete site takeover. On December 23, 2021 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in “WordPress Email Template Designer – WP HTML Mail”, a WordPress...

WordPress Email Template Designer – WP HTML Mail 3.0.9 Cross Site Scripting Vulnerability

WordPress Email Template Designer – WP HTML Mail plugin versions 3.0.9 and below suffer from a cross site scripting vulnerability. Exploit makes it possible for unauthenticated attackers to achieve complete site takeover. On December 23, 2021 the Wordfence Threat Intelligence team initiated the...

entfrm-bpmn (>=8.6.2, <=8.6.6), entfrm-flowable-designer (>=1.0.0, <=1.2.6) +4 more potentially affected by CVE-2021-23460 via min-dash (3.5.2)

min-dash NPM version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on min-dash and may be impacted: - entfrm-bpmn =8.6.2, =1.0.0, =2.2.0, =1.0.0, =1.1.3 Source cves: CVE-2021-23460 Source advisory: SNYK:JS-MINDASH-2340605...

azureml-designer-classic-modules (>=0.0.127, <=0.0.129), azureml-designer-cv-modules (>=0.0.8, <=0.0.10) +17 more potentially affected by CVE-2022-22815 via pillow (7.1.0)

pillow PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - azureml-designer-classic-modules =0.0.127, =0.0.8, =0.0.10, =0.0.7, =0.0.7, =0.0.2, =0.3.1, =0.1.1, =0.0.2, =0.0.1, =0.0.4, =0.0.3, =0.1.0 - qweb...

azureml-designer-classic-modules (>=0.0.127, <=0.0.129), azureml-designer-cv-modules (>=0.0.8, <=0.0.10) +17 more potentially affected by CVE-2022-22816 via pillow (7.1.0)

pillow PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - azureml-designer-classic-modules =0.0.127, =0.0.8, =0.0.10, =0.0.7, =0.0.7, =0.0.2, =0.3.1, =0.1.1, =0.0.2, =0.0.1, =0.0.4, =0.0.3, =0.1.0 - qweb...

azureml-designer-classic-modules (>=0.0.127, <=0.0.129), azureml-designer-cv-modules (>=0.0.8, <=0.0.10) +17 more potentially affected by CVE-2022-22815 via pillow (7.1.0)

pillow PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - azureml-designer-classic-modules =0.0.127, =0.0.8, =0.0.10, =0.0.7, =0.0.7, =0.0.2, =0.3.1, =0.1.1, =0.0.2, =0.0.1, =0.0.4, =0.0.3, =0.1.0 - qweb...

Advantech WebAccess HMI Designer Buffer Overflow (CVE-2021-33000)

A buffer overflow vulnerability exists in the project management file parsing component of Advantech WebAccess HMI Designer. The vulnerability is due to lack of proper validation while processing user supplied NMultistateLamp object data...

Schneider Electric SESU

1. EXECUTIVE SUMMARY CVSS v3 3.8 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: Schneider Electric Software Update SESU Vulnerability: Insufficient Entropy 2. RISK EVALUATION Successful exploitation of this vulnerability could cause unintended connection from an internal...

Advantech WebAccess HMI Designer Resource Management Error Vulnerability

Advantech WebAccess HMI Designer is an integrated HMI development tool from Advantech, Taiwan, China. The product is equipped with features such as data transfer, menu editing and text editing. A resource management error vulnerability exists in Advantech WebAccess HMI Designer versions prior to...