Schneider Electric U.motion Builder localize.php SQL Injection (CVE-2017-7973)

An SQL injection vulnerability has been reported in Schneider Electric U.motion Builder. The vulnerability is due to insufficient validation of the username HTTP request parameter in requests made to localize.php. A remote, unauthenticated user can exploit this vulnerability by sending a crafted...

Schneider Electric Pelco VideoXpert Information Disclosure Vulnerability

VideoXpert is a video management solution designed for scalability to fit any size on-demand surveillance operation. An information disclosure vulnerability exists in Schneider Electric Pelco VideoXpert. An attacker could exploit the vulnerability to obtain sensitive information...

Fuji Electric V-Server Memory Corruption Vulnerability

Fuji Electric V-Server is a data collection software from Fuji Electric Japan. A memory corruption vulnerability exists in Fuji Electric V-Server 3.3.22.0 and earlier versions. A remote attacker could exploit the vulnerability to execute code...

Schneider Electric Pelco VideoXpert Directory Traversal Vulnerability

VideoXpert is a video management solution designed for scalability to fit any size on-demand surveillance operation. A directory traversal vulnerability exists in Schneider Electric Pelco VideoXpert, which can be exploited by an attacker to view arbitrary files in the context of a web server...

Fuji Electric V-Server VPR File Parsing Memory Corruption Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Fuji Electric V-Server. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within parsing o...

Schneider Electric Pelco Sarix/Spectra Cameras XSS

Schneider Electric Pelco Sarix/Spectra Cameras Multiple XSS Vulnerabilities Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: Sarix Enhanced - Model: IME219 Firmware: 2.1.2.0.8280-A0.0 Sarix Enhanced - Model: IME119 Firmware: 2.1.2.0.8280-A0.0 Sarix - Model:...

Schneider Electric Pelco Sarix/Spectra Cameras Root Remote Code Execution Vulnerability

Pelco IP cameras suffer from a code execution vulnerability. The affected cameras suffer from authenticated remote code execution vulnerability. The POST parameter 'enableleds' located in the update function called via the GeneralSetupController.php script is not properly sanitised before being...

Schneider Electric Pelco VideoXpert Privilege Escalation Vulnerability

Schneider Electric Pelco VideoXpert is vulnerable to an elevation of privileges vulnerability which can be used by a simple user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the 'F' flag full for the 'Users' group, for...

Schneider Electric Pelco VideoXpert Missing Encryption

Schneider Electric Pelco VideoXpert Missing Encryption Of Sensitive Information Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: 2.0.41 1.14.7 1.12.105 Summary: VideoXpert is a video management solution designed for scalability, fitting the needs surveillanc...

Schneider Electric Pelco VideoXpert Missing Encryption Vulnerability

Schneider Electric Pelco VideoXpert transmits sensitive data using double Base64 encoding for the Cookie 'authtoken' in a communication channel that can be sniffed by unauthorized actors or arbitrarily be read from the vxcore log file directly using directory traversal attack resulting in...

Schneider Electric Pelco VideoXpert Core Admin Portal Directory Traversal Vulnerability

Pelco VideoXpert suffers from a directory traversal vulnerability. Exploiting this issue will allow an unauthenticated attacker to view arbitrary files within the context of the web server. Schneider Electric Pelco VideoXpert Core Admin Portal Directory Traversal Vendor: Schneider Electric SE...

Schneider Electric Pelco Sarix/Spectra Cameras CSRF Enable SSH Root Access

Schneider Electric Pelco Sarix/Spectra Cameras CSRF Enable SSH Root Access Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: Sarix Enhanced - Model: IME219 Firmware: 2.1.2.0.8280-A0.0 Sarix Enhanced - Model: IME119 Firmware: 2.1.2.0.8280-A0.0 Sarix - Model:...

Schneider Electric Pelco Sarix/Spectra Cameras Root Remote Code Execution

Schneider Electric Pelco Sarix/Spectra Cameras Root Remote Code Execution Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: Sarix Enhanced - Model: IME219 Firmware: 2.1.2.0.8280-A0.0 Sarix Enhanced - Model: IME119 Firmware: 2.1.2.0.8280-A0.0 Sarix - Model:...

Schneider Electric Pelco VideoXpert Privilege Escalation

Schneider Electric Pelco VideoXpert Privilege Escalations Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: Core Software 1.12.105 Media Gateway Software 1.12.26 Exports 1.12 Summary: VideoXpert is a video management solution designed for scalability, fitting...

Schneider Electric Pelco Sarix/Spectra Cameras CSRF Enable SSH Root Access Vulnerability

Pelco IP cameras suffer from a cross site request forgery vulnerability. The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileg...

Schneider Electric Pelco VideoXpert Core Admin Portal Directory Traversal

Schneider Electric Pelco VideoXpert Core Admin Portal Directory Traversal Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: 2.0.41 1.14.7 1.12.105 Summary: VideoXpert is a video management solution designed for scalability, fitting the needs surveillance...

Schneider Electric Pelco Sarix/Spectra Cameras XSS Vulnerability

Pelco cameras suffer from multiple dom-based, stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser sessi...

Schneider Electric Ampla MES Information Disclosure Vulnerability

Ampla Manufacturing Execution System MES is a manufacturing execution system from Schneider Electric, France, for on-site production management in production plants and factories. An information disclosure vulnerability exists in the Schneider Electric Ampla MES, which provides the ability to...

Schneider Electric Ampla MES Weak Password Vulnerability

Ampla Manufacturing Execution System MES is a manufacturing execution system from Schneider Electric, France, for on-site production management in production plants and factories. A weak password vulnerability exists in Schneider Electric Ampla MES, where Ampla MES provides the ability to configu...

Fuji Electric V-Server

CVSS v3 7.3 ATTENTION: Remotely exploitable Vendor: Fuji Electric Equipment: V-Server Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer AFFECTED PRODUCTS The following versions of V-Server, a data collection and management service, are affected: V-Server Versi...