Default credentials

Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Amp...

CVE-2017-9635

Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Amp...

CVE-2017-9637

Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that...

CVE-2017-9635

Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are configured to use Simple Security, a weakness in the password hashing algorithm could be exploited to reverse the user's password. Schneider Electric recommends that users of Amp...

CVE-2017-9637

Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that...

CVE-2017-9635

In Ampla MES, CVE-2017-9635 describes a vulnerability when users are configured to use Simple Security: a weakness in the password hashing algorithm could allow an attacker to reverse a user’s password. Affected products are Schneider Electric Ampla MES 6.4 and earlier. Impact details from the IC...

CVE-2017-9637

CVE-2017-9637 affects Schneider Electric Ampla MES 6.4 and earlier. The vulnerability allows sniffing of the connection string when third-party database connectivity uses SQL credentials (cleartext transmission of sensitive information). Root cause is transmission of credentials in cleartext; Win...

CVE-2017-17451

The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php...

CVE-2017-17451

CVE-2017-17451 affects WordPress WP Mailster plugin versions before 1.5.5. It is a cross-site scripting (XSS) vulnerability in the unsubscribe handler (view/subscription/unsubscribe2.php) exploitable via the mes parameter. Impact, as described: an attacker could inject malicious scripts into page...

Schneider Electric Ampla MES Information Disclosure Vulnerability

Ampla Manufacturing Execution System MES is a manufacturing execution system from Schneider Electric, France, for on-site production management in production plants and factories. An information disclosure vulnerability exists in the Schneider Electric Ampla MES, which provides the ability to...

Schneider Electric Ampla MES

CVSS v3 6.7 ATTENTION: Low skill level to exploit. Vendor: Schneider Electric Equipment: Ampla MES Vulnerabilities: Cleartext Transmission of Sensitive Information, Inadequate Encryption Strength AFFECTED PRODUCTS Schneider Electric reports that the vulnerability affects the following Ampla...

CVE-2016-0923

CVE-2016-0923 affects the EMC RSA BSAFE Micro Edition Suite (MES) client. The vulnerability is that MES 4.0.x (before 4.0.9) and 4.1.x (before 4.1.5) places the weakest signature algorithms first in the signature-algorithm list sent to the server, enabling a remote attacker to defeat cryptographi...

CVE-2016-0887

EMC RSA BSAFE Micro Edition Suite MES 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition CCME 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 allow remote attackers to discover a private-key prime by...

CVE-2016-0887

The CVE-2016-0887 entry concerns EMC RSA BSAFE products: MES 4.0.x and 4.1.x before 4.1.5, CCME 4.0.x and 4.1.x before 4.1.3, Crypto-J before 6.2.1, SSL-J before 6.2.1, and SSL-C before 2.8.9. A Lenstra side-channel attack can be conducted when an application fails to detect an RSA signature fail...

CVE-2015-0533

EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier allow remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message, a similar issue to CVE-2014-35...

Authentication flaw

EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allow remote attackers to cause a denial of service daemon crash via a ClientKeyExchange messa...

Integer overflow

Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-C Micro Edition Crypto-C ME before 4.0.4 and 4.1, and RSA BSAFE SSL-C 2.8.9 and earlier allows remote attackers to cause a denial of service...

CVE-2015-0534

CVE-2015-0534 affects multiple EMC RSA BSAFE products where certificate data in the unsigned portion can bypass a fingerprint-based blacklist, allowing remote attackers to defeat the protection mechanism. The initial entry lists affected components: MES 4.0.x (before 4.0.8) and 4.1.x (before 4.1....

CVE-2015-0535

Technical details about CVE-2015-0535 are not provided in the connected documents. Public information that is present covers FREAK generally and related CVEs, but does not specify affected products, versions, or fixes for this exact CVE. Monitor for updates.

CVE-2015-0533

CVE-2015-0533 concerns EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x prior to 4.0.8 and 4.1.x prior to 4.1.3, and RSA BSAFE SSL-C 2.8.9 and earlier. It allows remote SSL servers to perform an ECDHE-to-ECDH downgrade by omitting the ServerKeyExchange message, potentially harming forward secrecy. T...