CVE-2020-7496

A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XDwhich could cause unauthorized write access when opening the project file...

CVE-2020-7497

The CVE-2020-7497 entry concerns a Path Traversal (CWE-22) vulnerability in Schneider Electric EcoStruxure Operator Terminal Expert (O Te) 3.1 Service Pack 1 and earlier (formerly Vijeo XD) that could cause arbitrary application execution when the computer starts. Affected component: the OT Exper...

CVE-2020-7496

The CVE-2020-7496 entry applies to Schneider Electric EcoStruxure Operator Terminal Expert (3.1 Service Pack 1 and prior, formerly Vijeo XD). The vulnerability is CWE-88: Argument Injection or Modification, which could enable unauthorized write access when opening a project file. Red Hat and NVD ...

CVE-2020-7495

Schneider Electric EcoStruxure Operator Terminal Expert (OTE) — CVE-2020-7495: A path traversal in ZIP file extraction affects OTE 3.1 Service Pack 1 and earlier (formerly Vijeo XD). The flaw allows writing outside the intended folder when opening a project file, enabling unauthorized writes. Evi...

CVE-2020-7494

EcoStruxure Operator Terminal Expert (Schneider Electric) vulnerable through CVE-2020-7494 (Path Traversal) in version 3.1 Service Pack 1 and earlier. Affects handling of project files and can lead to code execution within the current process when opening a malicious project file. Red Hat/RedTeam...

CVE-2020-7493

The CVE-2020-7493 issue affects Schneider Electric EcoStruxure Operator Terminal Expert (3.1 Service Pack 1 and earlier, formerly Vijeo XD). The vulnerability is a SQL Injection (CWE-89) in handling project files that can lead to code execution when opening a crafted project file. Public sources ...

CVE-2020-7494: Improper Limitation of a Pathname to a Restricted Directory

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause malicious code execution when opening the project file...

CVE-2020-7497: Improper Limitation of a Pathname to a Restricted Directory

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XDwhich could cause arbitrary application execution when the computer starts...

PT-2020-19611

Name of the Vulnerable Software and Affected Versions EcoStruxure Operator Terminal Expert versions 3.1 Service Pack 1 and prior Description A CWE-88: Argument Injection or Modification issue exists which could cause unauthorized write access when opening the project file. Recommendations For...

CVE-2020-7493: Improper Neutralization of Special Elements used in an SQL Command

A CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause malicious code execution when opening the project file...

CVE-2020-7495: Improper Limitation of a Pathname to a Restricted Directory

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XD which could cause unauthorized write access outside of expected pa...

CVE-2020-7496: Improper Neutralization of Argument Delimiters in a Command

A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior formerly known as Vijeo XDwhich could cause unauthorized write access when opening the project file...

PT-2020-19612

Name of the Vulnerable Software and Affected Versions EcoStruxure Operator Terminal Expert versions 3.1 Service Pack 1 and prior Description A path traversal issue exists, which could cause arbitrary application execution when the computer starts. This is due to improper limitation of a pathname ...

News Wrap: Fake Minneapolis Police Breach, Zoom End-To-End Encryption Debate

Threatpost editors Lindsey O’Donnell-Welch and Tara Seals discuss the top security news stories of the week, including: Reports emerged earlier this week that the Minneapolis police department had been breached by hacktivist group Anonymous. Security expert Troy Hunt debunked the reports, however...

Schneider Electric EcoStruxure Operator Terminal Expert Parameter Injection Vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A parameter injection vulnerability exists in Schneider Electric EcoStruxure Operator...

Schneider Electric EcoStruxure Operator Terminal Expert Path Traversal Vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A path traversal vulnerability exists in Schneider Electric EcoStruxure Operator...

Schneider Electric EcoStruxure Operator Terminal Expert

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Low skill level to exploit/public exploits are available Vendor: Schneider Electric Equipment: EcoStruxure Operator Terminal Expert Vulnerabilities: SQL Injection, Path Traversal, Argument Injection 2. RISK EVALUATION Successful exploitation of these...

Schneider Electric EcoStruxure Operator Terminal Expert SQL Injection Vulnerability

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A SQL injection vulnerability exists in the handling of VXDZ files in Schneider Electr...

Schneider Electric EcoStruxure Operator Terminal Expert Path Traversal Vulnerability (CNVD-2020-37620)

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software branch is mainly used for creating and editing touch applications. A path traversal vulnerability exists in the processing of ZIP files in Schneider...

PT-2020-19609

Name of the Vulnerable Software and Affected Versions EcoStruxure Operator Terminal Expert versions 3.1 Service Pack 1 and prior Description A path traversal issue exists, which could lead to malicious code execution when opening a project file. This is due to improper limitation of a pathname to...