EUVD-2014-5285

Malware in sbrugna...

EUVD-2014-5287

Malware in sbrugna...

EUVD-2013-0696

Malware in sbrugna...

EUVD-2014-5286

Malware in sbrugna...

CVE-2013-0686

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in...

CVE-2013-0685

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

CVE-2013-0684

SQL injection vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-5399

SQL injection vulnerability in Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-5397

Cross-site scripting XSS vulnerability in Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file...

Sql injection

SQL injection vulnerability in Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-5397

CVE-2014-5397 concerns multiple Cross-Site Scripting (XSS) vulnerabilities in Schneider Electric Wonderware Information Server (WIS) Portal. Affected: WIS Portal versions 4.0 SP1 through 5.5. Root cause: improper input handling/encoding in the web portal frontend, allowing arbitrary web script or...

CVE-2014-5398 Schneider Electric Wonderware Input Validation

Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2014-5399

CVE-2014-5399 corresponds to SQL injection vulnerabilities in Schneider Electric Wonderware Information Server (WIS) Portal. Connected PT-2014-21 confirms multiple SQL injection flaws affecting WIS, with the vendor releasing updates to mitigate these issues. Affected products include Wonderware I...

PT-2014-4667

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Information Server WIS Portal versions 4.0 SP1 through 5.5 Description The issue concerns the use of weak encryption in the software, allowing local users to access sensitive information by reading a credential...

PT-2014-4666

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Information Server WIS Portal versions 4.0 SP1 through 5.5 Description The issue allows remote attackers to obtain sensitive information by reading a credential file due to the use of weak encryption...

PT-2014-6452

Name of the Vulnerable Software and Affected Versions Wonderware Information Server WIS Portal versions 4.0 SP1 through 5.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized actions on the web...

PT-2014-6453

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Information Server WIS Portal versions 4.0 SP1 through 5.5 Description The issue allows remote attackers to read arbitrary files or cause a denial of service via an XML external entity declaration in conjunction...

PT-2014-6454

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Information Server WIS Portal versions 4.0 SP1 through 5.5 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions 4.0 SP1 through 5.5, update to a version tha...

CVE-2014-2380: Inadequate Encryption Strength

Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file...