CVE-2014-8514: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and CVE-2014-9188. NOTE: this may be clarified later based on details provided b...

PT-2014-8574

Name of the Vulnerable Software and Affected Versions Schneider Electric ProClima versions prior to 6.1.7 Description The issue is related to a buffer overflow in an ActiveX control in Atx45.ocx, which allows remote attackers to execute arbitrary code. This is a distinct issue from other known...

CVE-2014-9188: Improper Neutralization of Special Elements used in a Command

Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and CVE-2014-8514. NOTE: this may be clarified later based on details provided b...

PT-2014-8576

Name of the Vulnerable Software and Affected Versions Schneider Electric ProClima affected versions not specified Description The issue concerns a remote code execution vulnerability in Schneider Electric ProClima. Details about the exploitation of this issue include the use of the MetaDraw...

PT-2014-8877

Name of the Vulnerable Software and Affected Versions Schneider Electric ProClima affected versions not specified Description The issue concerns a remote code execution vulnerability in Schneider Electric ProClima. Details about the vulnerability include the potential for remote code execution, b...

CVE-2014-8512: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8511. NOTE: this may be clarified later based on details provided by researchers...

PT-2014-8577

Name of the Vulnerable Software and Affected Versions Schneider Electric ProClima affected versions not specified Description The issue concerns a remote code execution vulnerability. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

CVE-2014-8511: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in an ActiveX control in Atx45.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8512. NOTE: this may be clarified later based on details provided by researchers...

Critical Remotely Exploitable Bugs Found in Schneider Electric ProClima Software

There are a number of critical, remotely exploitable command injection vulnerabilities in Schneider Electric’s ProClima software, which is used in manufacturing and energy facilities. The ProClima application is a utility that customers use to design control panel enclosures in industrial...

Schneider Electric StruxureWare SCADA Expert ClearSCADA Parsing Vulnerability

OVERVIEW Andrew Brooks identified and reported to The Zero Day Initiative ZDI a File Parsing Vulnerability: Schneider Electric StruxureWare SCADA Expert ClearSCADA ServerMain.exe OPF File Parsing Vulnerability. Schneider Electric has prepared workarounds and helped develop security upgrades for a...

CVE-2014-7251

XML external entity XXE vulnerability in the WebHMI server in Yokogawa Electric Corporation FAST/TOOLS before R9.05-SP2 allows local users to cause a denial of service CPU or network traffic consumption or read arbitrary files via unspecified vectors...

Xxe

XML external entity XXE vulnerability in the WebHMI server in Yokogawa Electric Corporation FAST/TOOLS before R9.05-SP2 allows local users to cause a denial of service CPU or network traffic consumption or read arbitrary files via unspecified vectors...

CVE-2014-7251

XML external entity XXE vulnerability in the WebHMI server in Yokogawa Electric Corporation FAST/TOOLS before R9.05-SP2 allows local users to cause a denial of service CPU or network traffic consumption or read arbitrary files via unspecified vectors...

CVE-2014-7251

The CVE-2014-7251 entry describes an XML External Entity (XXE) vulnerability in Yokogawa FAST/TOOLS WebHMI server prior to R9.05-SP2. The root cause is improper restriction of XML external entities (CWE-611), which could allow a local attacker to cause DoS via CPU/network load or read arbitrary f...

CVE-2014-7251: Improper Input Validation

XML external entity XXE vulnerability in the WebHMI server in Yokogawa Electric Corporation FAST/TOOLS before R9.05-SP2 allows local users to cause a denial of service CPU or network traffic consumption or read arbitrary files via unspecified vectors...

Multiple Schneider Electric Modicon PLC Modules Directory Traversal

Binary data 7154.pasl...

Multiple Schneider Electric Modicon M340 Ethernet Modules Remote Denial of Service

Binary data 7161.pasl...

Schneider Electric OFS Buffer Overflow Vulnerability

OVERVIEW Schneider Electric has reported to NCCIC/ICS-CERT a Stack Buffer Overflow vulnerability supplied with the Schneider Electric OPC Factory Server OSF. Independent researcher known as 0x7A240E67 submitted the vulnerability to ZDI, who provided coordination with the vendor and ICS-CERT...

Schneider Electric Floating License Manager Vulnerability

OVERVIEW Schneider Electric had become aware of an “unquoted service path” vulnerability in the Schneider Electric Floating License Manager, produced a patchSchneider Electric Security Notification SEVD 2014-015-01v3,...

JVN#54775800: FAST/TOOLS vulnerable to improper restriction of XML external entity references

FAST/TOOLS provided by Yokogawa Electric Corporation contains a vulnerability where XML external entity XXE references are not properly restricted CWE-611. Impact When opening a project with a specially crafted XML file, information managed by the product may be disclosed or may become a victim o...