Malicious code in expert-car-broker-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc0a274aad4381b33add1d70377311165bf88c22efc90b10b8c30b3bbda12be8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2922 Malicious code in expert-car-broker-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc0a274aad4381b33add1d70377311165bf88c22efc90b10b8c30b3bbda12be8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-3475 · Schneider Electric · Ecostruxure Cybersecurity Admin Expert

Name of the Vulnerable Software and Affected Versions: EcoStruxure Cybersecurity Admin Expert CAE versions prior to 2.2 Description: The issue is related to improper certificate validation, which could allow a remote attacker to conduct man-in-the-middle attacks and disclose protected information...

PT-2022-3484 · Unknown · Data Center Expert

Name of the Vulnerable Software and Affected Versions: Data Center Expert versions prior to 7.9.0 Description: The issue is related to insufficient protection of registration data in the Data Center Expert software. This could allow a remote attacker to gain full control over the software. The...

PT-2022-3483 · Unknown · Data Center Expert

Name of the Vulnerable Software and Affected Versions: Data Center Expert versions prior to V7.9.0 Description: The issue is related to the deserialization of untrusted data, which could allow a remote attacker to execute arbitrary code on the server by posting specially crafted data to the web...

PT-2022-3520 · Unknown · Data Center Expert

Name of the Vulnerable Software and Affected Versions: Data Center Expert versions prior to 7.9.0 Description: The issue is related to insufficient protection of registration data, which could allow a remote attacker to gain full control over the software. This could result in unwanted access to ...

PT-2022-3530 · Schneider Electric · Ecostruxure Cybersecurity Admin Expert

Name of the Vulnerable Software and Affected Versions: EcoStruxure Cybersecurity Admin Expert CAE versions prior to 2.2 Description: A vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local...

PT-2022-3482 · Unknown · Data Center Expert

Name of the Vulnerable Software and Affected Versions: Data Center Expert versions prior to V7.9.0 Description: A vulnerability exists where passwords are stored in a recoverable format, potentially allowing unwanted access to a Data Center Expert instance over a network by a malicious third-part...

The vulnerability of the programming software simulator PLC EcoStruxure Control Expert, the automation system ProcessExpert, the configuration software SCADAPack RemoteConnect, and the micro-software for programmable logic controllers Modicon M580 and Modicon M340 relates to the bypassing of authentication procedures. This allows a perpetrator to gain access in read-only and write mode.

The vulnerabilities of the EcoStruxure Control Expert programming tool, the ProcessExpert automation system, the SCADAPack RemoteConnect configuration tool, and the Modicon M580 and Modicon M340 programmable logic controllers are related to the ability to bypass authentication through spoofing...

PT-2022-3587 · Schneider Electric · Ecostruxure Process Expert +2

Name of the Vulnerable Software and Affected Versions: EcoStruxure Control Expert affected versions not specified EcoStruxure Process Expert affected versions not specified SCADAPack RemoteConnect affected versions not specified Description: The issue is related to a buffer overflow in memory,...

AT&T Labs Xmill 缓冲区错误漏洞

AT&T Labs Xmill is a new tool for efficiently compressing XML data from AT&T Labs. A buffer error vulnerability exists in AT&T Labs' Compressor XMilI and decompressor XDemill, which could be exploited by an attacker to cause code execution with elevated privileges on an engineering workstation. T...

CVE-2021-22794

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause remote code execution. Affected Product: StruxureWare Data Center Expert V7.8.1 and prior...

CVE-2021-22794

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause remote code execution. Affected Product: StruxureWare Data Center Expert V7.8.1 and prior...

CVE-2021-22795

A CWE-78 Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert V7.8.1 and prior...

CVE-2021-22797

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the...

Path traversal

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause remote code execution. Affected Product: StruxureWare Data Center Expert V7.8.1 and prior...

Path traversal

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the...

Command injection

A CWE-78 Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert V7.8.1 and prior...

expert-1.pl Cross Site Scripting vulnerability OBB-2480993

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-22797

CVE-2021-22797 is a CWE-22 path traversal vulnerability in Schneider Electric EcoStruxure Control Expert (incl. Unity Pro), EcoStruxure Process Expert, and SCADAPack RemoteConnect for x70. The root cause is improper validation of a user-supplied path when loading a malicious project file, which c...