CVE-2014-5399

CVE-2014-5399 corresponds to SQL injection vulnerabilities in Schneider Electric Wonderware Information Server (WIS) Portal. Connected PT-2014-21 confirms multiple SQL injection flaws affecting WIS, with the vendor releasing updates to mitigate these issues. Affected products include Wonderware I...

CVE-2014-5397

CVE-2014-5397 concerns multiple Cross-Site Scripting (XSS) vulnerabilities in Schneider Electric Wonderware Information Server (WIS) Portal. Affected: WIS Portal versions 4.0 SP1 through 5.5. Root cause: improper input handling/encoding in the web portal frontend, allowing arbitrary web script or...

CVE-2014-5398: Improper Input Validation

Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

PT-2014-4667

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Information Server WIS Portal versions 4.0 SP1 through 5.5 Description The issue concerns the use of weak encryption in the software, allowing local users to access sensitive information by reading a credential...

CVE-2014-2380: Inadequate Encryption Strength

Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file...

PT-2014-4666

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Information Server WIS Portal versions 4.0 SP1 through 5.5 Description The issue allows remote attackers to obtain sensitive information by reading a credential file due to the use of weak encryption...

PT-2014-6454

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Information Server WIS Portal versions 4.0 SP1 through 5.5 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions 4.0 SP1 through 5.5, update to a version tha...

CVE-2014-5399: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2014-6452

Name of the Vulnerable Software and Affected Versions Wonderware Information Server WIS Portal versions 4.0 SP1 through 5.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized actions on the web...

CVE-2014-2381: Inadequate Encryption Strength

Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 uses weak encryption, which allows local users to obtain sensitive information by reading a credential file...

CVE-2014-5397: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Schneider Electric Wonderware Information Server WIS Portal 4.0 SP1 through 5.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-6453

Name of the Vulnerable Software and Affected Versions Schneider Electric Wonderware Information Server WIS Portal versions 4.0 SP1 through 5.5 Description The issue allows remote attackers to read arbitrary files or cause a denial of service via an XML external entity declaration in conjunction...

CVE-2014-3071

Cross-site scripting XSS vulnerability in the Data Quality Console in IBM InfoSphere Information Server 11.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL for adding a project connection...

Cross site scripting

Cross-site scripting XSS vulnerability in the Data Quality Console in IBM InfoSphere Information Server 11.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL for adding a project connection...

CVE-2014-3071

The CVE-2014-3071 vulnerability affects IBM InfoSphere Data Quality Console (11.3). The issue is a cross-site scripting (XSS) flaw that can be triggered when adding a new project connection, allowing an attacker to craft a link that could be used by an authenticated user to execute arbitrary scri...

CVE-2014-3071

Cross-site scripting XSS vulnerability in the Data Quality Console in IBM InfoSphere Information Server 11.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL for adding a project connection...

PT-2014-5064

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server version 11.3 Description A cross-site scripting XSS issue exists in the Data Quality Console, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL for adding a project connection...

CVE-2014-3071: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Data Quality Console in IBM InfoSphere Information Server 11.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL for adding a project connection...

Microsoft IIS 2.0/3.0 Long URL Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2654/info Microsoft Internet Information Server is vulnerable to a denial of service. This particular denial of service affects versions 2.0, 3.0 and 4.0 of the server prior to service pack 4. The URL which causes this...

Microsoft IIS 5.0 IDC Extension Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5900/info A vulnerability in Microsoft Internet Information Server IIS may make cross-site scripting attacks possible. When IIS receives a request for an .idc file, the server typically returns a 404 message when the page...