68 matches found
CVE-2020-7571
A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation Cross-site Scripting Reflected vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of use...
Unrestricted file upload
A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code...
Improper access control
A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control...
CVE-2020-7572
A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server...
Cross site scripting
A CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting Stored vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect...
CVE-2020-7570
A CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting Stored vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect...
CVE-2020-7573
The CVE concerns EcoStruxure Building Operation WebReports, affected in versions 1.9–3.1, with a CWE-284 Improper Access Control vulnerability that could allow a remote attacker to access restricted web resources. Root cause is improper access control in WebReports. The ICSA advisory notes exploi...
CVE-2020-7573
A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control...
CVE-2020-7572
CVE-2020-7572 affects Schneider Electric EcoStruxure Building Operation WebReports (WebReports) versions 1.9–3.1. The vulnerability is CWE-611: improper restriction of XML external entity references caused by misconfiguration of the XML parser, enabling an authenticated remote user to inject arbi...
CVE-2020-7572
A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server...
CVE-2020-7571
A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation Cross-site Scripting Reflected vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of use...
CVE-2020-7571
Schneider Electric EcoStruxure Building Operation WebReports (V1.9–V3.1) is affected by a reflected Cross-site Scripting (CWE-79) due to improper input sanitization during webpage generation. A remote, authenticated user could inject arbitrary web script/HTML that may be executed in other WebRepo...
CVE-2020-7569
Summary (CVE-2020-7569) : EcoStruxure Building Operation WebReports (versions 1.9–3.1) are affected by CWE-434 Unrestricted Upload of File with Dangerous Type. An authenticated remote user could upload arbitrary files due to improper verification of user-supplied files, potentially enabling remot...
Schneider Electric EcoStruxure Building Operation WebReports 跨站脚本漏洞
EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of user-supplied data. A remote attacker...
Schneider Electric EcoStruxure Building Operation WebReports 跨站脚本漏洞
Schneider Electric EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in Schneider Electric EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of...
Schneider Electric EcoStruxure Building Operation WebReports 代码问题漏洞
Schneider Electric EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. An arbitrary file upload vulnerability exists in Schneider Electric EcoStruxure Building Operation WebReports 1.9-3.1. The vulnerability stems from improper validation of...
Schneider Electric EcoStruxure Building Operation WebReports 安全漏洞
EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. An improper access control vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. A remote attacker could exploit this vulnerability to access restricted web resources...
Schneider Electric EcoStruxure Building Operation WebReports 代码问题漏洞
EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. An improperly restricted XML external entity reference vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from a misconfiguration of the XML...
