104 matches found
Schneider Electric IIoT Monitor (Update A)
1. EXECUTIVE SUMMARY CVSS v3 9.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: IIoT Monitor --------- Begin Update A Part 1 of 2 -------- Vulnerabilities: Path Traversal, Unrestricted Upload of File with Dangerous Type, XXE, Cryptographic Issues...
IIoT Monitor Dangerous Type File Upload Vulnerability
Schneider Electric IIoT Monitor is an industrial IoT monitor from Schneider Electric France. A security vulnerability exists in Schneider Electric IIoT Monitor version 3.1.38. The vulnerability can be exploited by an attacker to upload and execute malicious files...
CVE-2018-7835
An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files available to SYSTEM user...
CVE-2018-7836
An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files...
Unrestricted file upload
An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files...
CVE-2018-7835
An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files available to SYSTEM user...
Path traversal
An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files available to SYSTEM user...
Xxe
An Improper Restriction of XML External Entity Reference 'XXE' vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its outp...
CVE-2018-7837
An Improper Restriction of XML External Entity Reference 'XXE' vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its outp...
CVE-2018-7836
Schneider Electric IIoT Monitor vulnerability CVE-2018-7836 (Unrestricted Upload of File with Dangerous Type) affects version 3.1.38 and earlier. The connected advisories describe a path to remote code execution via uploading malicious files, with high-severity impact (CVSS v3 base score 9.3). Ex...
CVE-2018-7837
An Improper Restriction of XML External Entity Reference 'XXE' vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, causing the software to embed incorrect documents into its outp...
CVE-2018-7836
An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files...
CVE-2018-7837
CVE-2018-7837 affects Schneider Electric IIoT Monitor (version 3.1.38 and earlier). The connected advisories describe an improper restriction of XML External Entity (XXE) references in multiple components (e.g., RuleMgmt addRule, AccountMgmt, EventMgmt, Login/Logout, and others) that can cause th...
CVE-2018-7835
Schneider Electric IIoT Monitor (versions 3.1.38 and older) contains a path traversal vulnerability (CVE-2018-7835) that may allow an attacker to access files reachable to the SYSTEM user. Multiple connected sources (ZDI-19-020, ICS-CERT Update A, CNVD-2019-03466) describe this as an improper val...
CVE-2018-7835
An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files available to SYSTEM user...
Code injection
Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...
Privilege escalation
User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...
CVE-2018-18390
User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1...