CVE-2022-32521

CVE-2022-32521 affects Schneider Electric Data Center Expert prior to v7.9.0. The issue stems from deserialization of untrusted data, enabling a remote attacker to execute arbitrary code on the server when specially crafted data is posted to the web server. Public-facing impact is described as re...

CVE-2022-32520

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32518. Affected Products: Data Center Expert Versions prior to V7.9.0...

CVE-2022-32518

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32520. Affected Products: Data Center Expert Versions prior to V7.9.0...

CVE-2022-32520

The CVE-2022-32520 entry affects Schneider Electric Data Center Expert before version 7.9.0. It describes a CWE-522 vulnerability (insufficiently protected credentials) that could allow a malicious remote actor to gain unauthorized access to a DCE instance over a network. The connected sources co...

CVE-2022-32519

A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. Affected Products: Data Center Expert Versions prior to V7.9.0...

CVE-2022-32521

A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server. Affected Products: Data Center Expert Versions prior to V7.9.0...

CVE-2022-32519

A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. Affected Products: Data Center Expert Versions prior to V7.9.0...

CVE-2022-32747

CVE-2022-32747 affects Schneider Electric’s EcoStruxure Cybersecurity Admin Expert (CAE) prior to 2.2. The issue is a CWE-290 authentication bypass by spoofing a device on the local network, which could cause legitimate users to be locked out or enable backdoor account creation. Root cause: spoof...

CVE-2022-32748

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...

CVE-2022-45788

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure Control Expert All...

Schneider Electric StruxureWare Data Center Expert 安全漏洞

Schneider Electric StruxureWare Data Center Expert StruxureWare Data Center Management Expert is a monitoring software from the French company Schneider Electric Schneider Electric. Suitable for a variety of organizations to monitor their company-wide power, cooling, security, environment. A...

Schneider Electric StruxureWare Data Center Expert 安全漏洞

Schneider Electric StruxureWare Data Center Expert StruxureWare Data Center Management Expert is a monitoring software from the French company Schneider Electric Schneider Electric. Suitable for a variety of organizations to monitor their company-wide power, cooling, security, environment. A...

CVE-2022-32748

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...

CVE-2022-32518

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32520. Affected Products: Data Center Expert Versions prior to V7.9.0...

Schneider Electric StruxureWare Data Center Expert 安全漏洞

Schneider Electric StruxureWare Data Center Expert StruxureWare Data Center Management Expert is a monitoring software from the French company Schneider Electric Schneider Electric. Suitable for a variety of organizations to monitor their company-wide power, cooling, security, environment. A...

Schneider Electric EcoStruxure Cybersecurity Admin Expert 安全漏洞

Schneider Electric EcoStruxure Cybersecurity Admin Expert Schneider Electric EcoStruxure CAE is a cybersecurity administration expert from Schneider Electric, France. A security vulnerability exists in versions of Schneider Electric EcoStruxure Cybersecurity Admin Expert prior to 2.2, which stems...

CVE-2022-32520

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32518. Affected Products: Data Center Expert Versions prior to V7.9.0...

CVE-2022-32519

CVE-2022-32519 affects Schneider Electric StruxureWare Data Center Expert prior to V7.9.0. The root cause is storing passwords in a recoverable format, which could allow a malicious third party to gain unauthorized, potentially full control over a DCE instance when accessed over a network. Affect...

CVE-2022-32518

CVE-2022-32518 affects Schneider Electric Data Center Expert prior to version 7.9.0. It is a CWE-522 Insufficiently Protected Credentials flaw that could allow unauthorized access to a DCE instance over a network by a malicious third party. The vulnerability impact is described as high/critical i...

expert-marketplace.de Cross Site Scripting vulnerability OBB-3169022

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...