CVE-2018-7810

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browse...

CVE-2018-7830

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for 1 minute by sending a specially crafted HTTP request...

CVE-2018-7831

An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a...

CVE-2018-7809

The CVE-2018-7809 issue affects Schneider Electric Modicon embedded Web servers in M340, Premium, Quantum PLCs and BMXNOR0200. The root cause is an Unverified Password Change vulnerability that allows an unauthenticated remote attacker to access the password delete function via the web server. Im...

CVE-2018-7810

CVE-2018-7810 is an XSS vulnerability in the embedded web servers of Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200. The root cause is improper neutralization of input during web page generation, allowing an attacker to craft a URL containing JavaScript that will be execute...

CVE-2018-7831

This entry documents CVE-2018-7831, affecting Schneider Electric Modicon embedded web servers in M340, Premium, Quantum PLCs and BMXNOR0200. The vulnerability is an improper neutralization of script-related HTML tags (Basic XSS) that can be exploited by sending a specially crafted URL to a curren...

CVE-2018-7811

CVE-2018-7811 affects Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200. The embedded web servers expose an Unverified Password Change vulnerability that allows an unauthenticated remote attacker to access the change password function. This is a server-side authentication/auth...

CVE-2018-7830: Improper Neutralization of CRLF Sequences in HTTP Headers

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for 1 minute by sending a specially crafted HTTP request...

CVE-2018-7810: Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browse...

CVE-2018-7811: Weak Password Recovery Mechanism for Forgotten Password

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server...

CVE-2018-7831: Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a...

CVE-2018-7809: Weak Password Recovery Mechanism for Forgotten Password

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server...

WordPress Events Calendar Premium 1.0 Database Disclosure

Exploit Title : WordPress events-calendar-premium Plugins 1.0 Database Backup Information Disclosure Vulnerability Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 30/11/2018 Vendor Homepage : wordpress.org Tested On : Windows and Linux Category : WebApps Version...

PT-2018-2169

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 affected versions not specified Description The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows an attacker ...

PT-2018-2170

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs versions affected versions not specified BMXNOR0200 versions affected versions not specified Description The issue is related to the lack of necessary checks when changing passwords in the programmable logic...

PT-2018-2171

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 affected versions not specified Description The issue is related to improper neutralization of CRLF sequences in HTTP headers, also known as 'HTTP Response Splitting'. This can lead to a denia...

PT-2018-2172

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 affected versions not specified Description The issue is related to an improper neutralization of script-related HTML tags in a web page, which can be exploited to execute a password change on...

PT-2018-2168

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 affected versions not specified Description The issue is related to an Unverified Password Change vulnerability in the embedded web servers. This could allow an unauthenticated remote user to...

premiumlawnservice.com XSS vulnerability

Open Bug Bounty ID: OBB-695044 Description| Value ---|--- Affected Website:| premiumlawnservice.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

PT-2018-1977

Name of the Vulnerable Software and Affected Versions Modicon M340, Premium, Quantum PLCs and BMXNOR0200 affected versions not specified Description The issue is related to insufficient input validation in the microprogram software of Modicon controllers. This can allow an attacker to redirect a...