1527 matches found
CVE-2021-22790
A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU part numbers BMEP and BMEH, all versions, Modicon M340 CPU part...
CVE-2021-22790
A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU part numbers BMEP and BMEH, all versions, Modicon M340 CPU part...
CVE-2021-22789
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file exists in Modicon M580 CPU part numbers BM...
多款 Schneider Electric 产品路径遍历漏洞
Schneider Electric EcoStruxure Machine Expert-Basic and others are products of Schneider Electric, France.Schneider Electric EcoStruxure Machine Expert-Basic is a PLC configuration application. Schneider Electric EcoStruxure Machine Expert-Basic is a PLC configuration application program.Schneide...
The vulnerability of the programming software for PLCs (programmable logic controllers), EcoStruxure Control Expert, allows a intruder to trigger a service failure.
The vulnerability of the programming software for PLCs programmable logic controllers, EcoStruxure Control Expert, lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow a malicious actor to cause malfunctions in the system remotely...
The vulnerability of the Ethernet Download function in Schneider Electric’s HMI terminal configuration software, EcoStruxure Operator Terminal Expert, and the SCADA software Pro-face BLUE, related to insufficient validation of input data, allows a perpetrator to execute arbitrary codes.
The vulnerability of the Ethernet Download function in Schneider Electric’s HMI terminal configuration software, EcoStruxure Operator Terminal Expert, and the SCADA software Pro-face BLUE is related to insufficient validation of input data. Exploiting this vulnerability could allow a remote...
The vulnerability of the programming software for PLCs (programmable logic controllers), EcoStruxure Control Expert, allows a intruder to trigger a service failure.
The vulnerability of the EcoStruxure Control Expert programming tool for programmable logic controllers is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow a malicious actor to trigger a service failure remotely...
The vulnerability of the programming software for PLCs (programmable logic controllers), EcoStruxure Control Expert, allows a intruder to bypass the authentication process.
The vulnerability of the programming software for PLCs programmable logic controllers, EcoStruxure Control Expert, is related to improper authentication. Exploiting this vulnerability can allow an attacker to bypass authentication processes...
The vulnerability of the programming software for PLCs (programmable logic controllers), EcoStruxure Control Expert, allows a intruder to bypass the authentication process.
The vulnerability of the programming software for PLCs programmable logic controllers, EcoStruxure Control Expert, lies in the absence of restrictions on the number of authentication attempts. Exploiting this vulnerability allows a malicious actor to bypass the authentication process remotely...
The vulnerability of SCADA systems such as EcoStruxure Geo SCADA Expert 2020 and EcoStruxure Geo SCADA Expert 2019 lies in the insufficient protection of registration data, allowing unauthorized access by attackers to the protected information.
The vulnerability of SCADA systems such as EcoStruxure Geo SCADA Expert 2020 and EcoStruxure Geo SCADA Expert 2019 is related to insufficient protection of registration data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...
AT&T Labs Xmill XML parsing CreateLabelOrAttrib memory corruption vulnerability
Summary A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. Tested Versions AT&T Labs Xmill 0...
Fuzz Off: How to Shake Up Code to Get It Right – Podcast
LAS VEGAS – In 2014, two teams of security researchers independently started fuzz testing OpenSSL. Within days, the advanced black-box software technique led to an exploitable vulnerability in OpenSSL: namely, the Heartbleed vulnerability. What is fuzzing? That’s what the FuzzCon event is all...
AT&T Labs Xmill XML decompression EnumerationUncompressor::UncompressItem heap-based buffer overflow vulnerability
Summary A heap-based buffer overflow vulnerability exists in the XML Decompression EnumerationUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability...
AT&T Labs Xmill XML decompression DecodeTreeBlock multiple heap-based buffer overflow vulnerabilities
Summary Multiple heap-based buffer overflow vulnerabilities exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. A specially crafted XMI File can lead to remote code execution. An attacker can provide a malicious file to trigger these vulnerabilities. Tested...
AT&T Labs Xmill XML decompression LabelDict::Load heap-based buffer overflow vulnerability
Summary A heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability. Tested Versions AT&T La...
AT&T Labs Xmill XML decompression PlainTextUncompressor::UncompressItem heap-based buffer overflow vulnerability
Summary A heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability...
AT&T Labs Xmill XML parsing ParseAttribs memory corruption vulnerability
Summary A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. Tested Versions AT&T Labs Xmill 0.7...
An expert discussion on XDR
Discover why industry veteran and former Gartner analyst, Greg Young, believes that XDR is the most exciting thing that has happened in cybersecurity in the last 20 years...
The vulnerability of the programming software for PLCs (programmable logic controllers), namely EcoStruxure Control Expert, and the micro-programming software for Schneider Electric’s Modicon M340 and Modicon M580 models. This vulnerability exists due to the failure to take measures to neutralize certain special elements, allowing a perpetrator to execute arbitrary codes.
The vulnerability of the programming software for PLCs programmable logic controllers, namely EcoStruxure Control Expert, and the microsoftware for Schneider Electric Modicon M340 programmable logic controllers, exists due to the lack of measures to neutralize certain components. Exploiting this...
Security Bulletin: An unspecified vulnerability in Java SE results in a low confidentiality impact
Summary An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified...