2369 matches found
CVE-2018-7831
This entry documents CVE-2018-7831, affecting Schneider Electric Modicon embedded web servers in M340, Premium, Quantum PLCs and BMXNOR0200. The vulnerability is an improper neutralization of script-related HTML tags (Basic XSS) that can be exploited by sending a specially crafted URL to a curren...
CVE-2018-7809
The CVE-2018-7809 issue affects Schneider Electric Modicon embedded Web servers in M340, Premium, Quantum PLCs and BMXNOR0200. The root cause is an Unverified Password Change vulnerability that allows an unauthenticated remote attacker to access the password delete function via the web server. Im...
CVE-2018-7810
CVE-2018-7810 is an XSS vulnerability in the embedded web servers of Schneider Electric Modicon M340, Premium, Quantum PLCs and BMXNOR0200. The root cause is improper neutralization of input during web page generation, allowing an attacker to craft a URL containing JavaScript that will be execute...
CVE-2018-7810
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browse...
CVE-2018-7809
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server...
CVE-2018-7830: Improper Neutralization of CRLF Sequences in HTTP Headers
Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a denial of service can occur for 1 minute by sending a specially crafted HTTP request...
CVE-2018-7810: Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browse...
CVE-2018-7811: Weak Password Recovery Mechanism for Forgotten Password
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server...
CVE-2018-7831: Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a...
CVE-2018-7809: Weak Password Recovery Mechanism for Forgotten Password
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server...
Modicon Quantum HTTP Server 'formTest' 'name' Parameter XSS
Binary data scadamodiconformtestxss.nbin...
Updated libmspack/cabextract packages fix security vulnerabilities
Hanno Böck discovered that libmspack incorrectly handled certain CHM files. An attacker could possibly use this issue to cause a denial of service CVE-2018-14679, CVE-2018-14680. Jakub Wilk discovered that libmspack incorrectly handled certain KWAJ files. An attacker could possibly use this issue...
Phabricator: TOTP Key is shorter than RFC 4226 recommended minimum
mongoose Observed Behavior: When creating a TOTP secret a 16 character base32 encoded string is presented to the user. Expected Behavior: I would expect a 32 character base32 secret to be presented. The RFC recommends 160 bits of entropy, which is 32 character x 5 bits per character in a base32...
ALPINE-CVE-2018-18584
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write...
DEBIAN-CVE-2018-18584
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write...
CVE-2018-18584: Out-of-bounds Write
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write...
CVE-2018-18584
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write...
CVE-2018-18584
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write...
UBUNTU-CVE-2018-18584
In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write...
The vulnerability of the FTP server of the microprogramming software for Schneider Electric Modicon Quantum control devices arises from deficiencies in access control. This allows a intruder to execute arbitrary code, cause system failures, or upload malicious firmware.
The vulnerability of the microprogrammed logic controller Schneider Electric Modicon Quantum software is related to deficiencies in access control. Exploiting this vulnerability could allow an intruder to execute arbitrary code, cause malfunctions, or upload malicious firmware using a special FTP...