CVE-2015-0999

The CVE-2015-0999 issue affects Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4, where OPC User credentials are stored in cleartext in configuration files. This enables local attackers with access to read the files to o...

CVE-2015-0999

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file...

CVE-2015-0996

CVE-2015-0996 affects Schneider Electric InduSoft Web Studio (before 7.1.3.4 SP3 Patch 4) and InTouch Machine Edition 2014 (before 7.1.3.4 SP3 Patch 4). Root cause is a hard-coded, cleartext password used to control read access to Project files and Project Configuration files, enabling local atta...

CVE-2015-0998

CVE-2015-0998 affects Schneider Electric InduSoft Web Studio (before 7.1.3.4 SP3 Patch 4) and InTouch Machine Edition 2014 (before 7.1.3.4 SP3 Patch 4). The issue is cleartext transmission of credentials (CWE-319), enabling an attacker on an adjacent network to sniff sensitive information. Root c...

Schneider Electric Patches Easily Exploitable Bugs in HMI Products

There are a series of vulnerabilities related to credentials and authentication in two of Schneider Electric’s HMI products, and an attacker who exploits them may be able to run arbitrary code. The bugs lie in Schneider’s InduSoft Web Studio and InTouch Machine Edition products, both of which are...

InduSoft Web Studio Unauthenticated Insecure Remote Operations Code Execution - Ver2 (CVE-2011-4051)

A code execution vulnerability has been reported in the Remote Agent component of InduSoft Web Studio. The vulnerability is due to the absence of authentication for incoming requests to the Remote Agent service. An attacker could exploit this vulnerability by sending crafted requests to the...

InduSoft Web Studio Arbitrary Upload Remote Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

InduSoft Web Studio < v7.1 + SP2 + P2 Security System Vulnerability

Binary data 8260.prm...

InduSoft Web Studio Thin Client Detection

Binary data 8033.prm...

InduSoft Web Studio Directory Traversal (CVE-2014-0780)

A directory traversal vulnerability has been reported in InduSoft Web Studio. The vulnerability is due to insufficient validation of certain requests while using the development web server. An unauthenticated attacker could exploit this vulnerability by sending crafted requests to the vulnerable...

InduSoft Web Studio NTWebServer < v7.1 + SP2 + P4 Directory Traversal Vulnerability

Binary data 8032.prm...

InduSoft Web Studio Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Indusoft Web Studio. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ability to browse outside of the web root via directory traversal. A remote...

CVE-2014-0780

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests...

Directory traversal

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests...

CVE-2014-0780 InduSoft Web Studio Path Traversal

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests...

CVE-2014-0780

CVE-2014-0780 affects InduSoft Web Studio NTWebServer in version 7.1 prior to SP2 Patch 4. The NTWebServer directory traversal flaw lets remote attackers read APP password files and can lead to remote code execution. Exploitation is described as remote and not requiring authentication, enabling u...

CVE-2014-0780 InduSoft Web Studio Path Traversal

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests...

PT-2014-3840 · Indusoft · Indusoft Web Studio

Name of the Vulnerable Software and Affected Versions: InduSoft Web Studio version 7.1 before SP2 Patch 4 Description: The issue allows remote attackers to read administrative passwords in APP files and execute arbitrary code via unspecified web requests. This is due to a directory traversal...

CVE-2014-0780

Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests. Recent assessments: Assessed Attacker Value: 0 Assessed...