PT-2011-5150

Name of the Vulnerable Software and Affected Versions Schneider Electric Quantum Ethernet Module on the NOE 771 device affected versions not specified Description The issue allows remote attackers to install arbitrary firmware updates. This is achieved by exploiting the modbus 125 handler functio...

PT-2011-5149

Name of the Vulnerable Software and Affected Versions Schneider Electric Quantum Ethernet Module on the NOE 771 device affected versions not specified Description The issue concerns the ComputePassword function in the Schneider Electric Quantum Ethernet Module, which generates the password for th...

CVE-2011-4861: Undefined Security Weakness

The modbus125handler function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device aka the Quantum 140NOE771 module allows remote attackers to install arbitrary firmware updates via a MODBUS 125 function code to TCP port 502...

CVE-2011-4859: Undefined Security Weakness

The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE771 and 140CPU65 modules, the Premium TSXETY and TSXP57 modules, the M340 BMXNOE01 and BMXP3420 modules, and the STB DIO STBNIC2212 and STBNIP2 modules, uses hardcoded passwords for the 1 AUTCSE, 2 AUTCSE, 3 fdrusers, 4...

CVE-2011-4860: Improper Authentication

The ComputePassword function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device aka the Quantum 140NOE771 module generates the password for the fwupgrade account by performing a calculation on the MAC address, which makes it easier for remote attackers to obtain access via a ...

Multiple Vulnerabilities Haunt Long List of PLC Modules

A long list of industrial-control modules manufactured by Schneider Electric and used to control operations at various industrial facilities contain multiple weaknesses and vulnerabilities that could allow an attacker to modify the firmware, login remotely and run arbitrary code on the vulnerable...

Schneider Electric Quantum Ethernet Module Hardcoded Credentials Authentication Bypass Vulnerability

Schneider Electric Quantum Ethernet Module is prone to an authentication- bypass vulnerability. Attackers can exploit this issue to gain access to the Telnet port service, Windriver Debug port service, and FTP service. Attackers can exploit this vulnerability to execute arbitrary code within the...

Schneider Electric Quantum Ethernet Module Hardcoded Credentials (FTP)

Schneider Electric Quantum Ethernet Module is using known hardcoded credentials. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Schneider Electric Quantum Ethernet Module Hardcoded Credentials (Telnet)

Schneider Electric Quantum Ethernet Module is using known default credentials. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-4263

Cross-site scripting XSS vulnerability in Schneider Electric PowerChute Business Edition before 8.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Schneider Electric PowerChute Business Edition before 8.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-4263

CVE-2011-4263 affects Schneider Electric APC PowerChute Business Edition prior to 8.5, with a cross-site scripting (XSS) vulnerability that could allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Multiple sources (NVD, JVN, Red Hat, OpenVAS entries) corroborat...

CVE-2011-4263

Cross-site scripting XSS vulnerability in Schneider Electric PowerChute Business Edition before 8.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2011-4916

Name of the Vulnerable Software and Affected Versions Schneider Electric PowerChute Business Edition versions prior to 8.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized actions on the affect...

CVE-2011-4263: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Schneider Electric PowerChute Business Edition before 8.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

KLA10049 CI vulnerability in APC PowerChute

A cross-site scripting vulnerability was found in PowerChute. By exploiting this vulnerability malicious users can inject arbitrary web script. This vulnerability can be exploited from the network at a point related to unknown vectors. Original advisories vulnerability description Exploitation...

PowerChute Business Edition vulnerable to cross-site scripting

Overview PowerChute Business Edition contains a cross-site scripting vulnerability. PowerChute Business Edition from Schneider Electric is a power management software. PowerChute Business Edition contains a cross-site scripting vulnerability. Jun Okada of GLOBAL TECHNOLOGY CORPORATION reported th...

CVE-2011-4033

Buffer overflow in the Steema TeeChart ActiveX control, as used in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier, allows remote attackers to cause a denial of service via unspecified vectors...

CVE-2011-4034

Buffer overflow in the Steema TeeChart ActiveX control, as used in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors...

CVE-2011-4035

Cross-site scripting XSS vulnerability in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...