PT-2023-5872 · Schneider Electric · Ecostruxure Power Monitoring Expert

Name of the Vulnerable Software and Affected Versions: Schneider Electric EcoStruxure Power Monitoring Expert versions affected versions not specified Description: A deserialization of untrusted data issue exists, allowing an attacker to execute arbitrary code on the targeted system by sending a...

Schneider Electric EcoStruxure Power Monitoring Expert Code Issue Vulnerability

The Schneider Electric EcoStruxure Power Monitoring Expert is a device from Schneider Electric France that is used to perform power distribution monitoring in IoT environments. The Schneider Electric EcoStruxure Power Monitoring Expert suffers from a code issue vulnerability that originates from...

SUSE CVE-2023-20583

A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time potentially resulting in a leak of sensitive information...

AMD CPU Security Vulnerability

AMD CPUs are a family of CPUs from the American company Ultraviolet Semiconductor AMD. The AMD CPUs suffer from a security vulnerability that stems from allowing an authenticated attacker to monitor data changes in CPU power, leading to information disclosure...

Power Monitoring Expert Unauthorized Access

The vulnerability of the Power Monitoring Exper software-related system is related to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Schneider Electric EcoStruxure Power Monitoring Expert 代码问题漏洞

The Schneider Electric EcoStruxure Power Monitoring Expert is a device from Schneider Electric France that is used to perform power distribution monitoring in IoT environments. The Schneider Electric EcoStruxure Power Monitoring Expert has a code issue vulnerability that stems from the presence o...

EcoStruxure Power Monitoring Expert Session Duration Unauthorized Access

The vulnerability of the EcoStruxure Power Monitoring Expert software is related to incorrect session duration settings. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

PT-2023-1876 · Schneider Electric · Ecostruxure Power Monitoring Expert

Name of the Vulnerable Software and Affected Versions: EcoStruxure Power Monitoring Expert affected versions not specified Description: A CWE-613: Insufficient Session Expiration issue exists, allowing an attacker to maintain unauthorized access over a hijacked session after the legitimate user h...

Power Monitoring Expert Vulnerable Settings

The vulnerability of the Power Monitoring Exper software-related software is related to insufficient verification of input data. Exploiting this vulnerability allows a remote attacker to view and modify the settings of the equipment...

CVE-2022-22804

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could allow an authenticated attacker to view data, change settings, or impact availability of the software when the user visits a page containing the injected payload. Affected...

CVE-2022-22727

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power...

CVE-2022-22804

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could allow an authenticated attacker to view data, change settings, or impact availability of the software when the user visits a page containing the injected payload. Affected...

CVE-2022-22726

A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected Product: EcoStruxure Power Monitoring Expert Versions 2020 and prior...

CVE-2022-22727

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power...

CVE-2022-22726

A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected Product: EcoStruxure Power Monitoring Expert Versions 2020 and prior...

CVE-2022-22727

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power...

Cross site scripting

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could allow an authenticated attacker to view data, change settings, or impact availability of the software when the user visits a page containing the injected payload. Affected...

Input validation

A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected Product: EcoStruxure Power Monitoring Expert Versions 2020 and prior...

Input validation

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user?s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power...

CVE-2022-22804

The CVE-2022-22804 entry concerns an XSS (CWE-79) in EcoStruxure Power Monitoring Expert (versions 2020 and prior). The vulnerability arises from improper neutralization of input during web page generation, enabling an authenticated attacker to view data, change settings, or affect availability w...