Vulnerabilities for Struxureware data center expert (...) - CXSECURITY.COM

Vulnerabilities for
'Struxureware data center expert'

2022-04-13

CVE-2021-22794

CWE-22

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior)

CVE-2021-22795

CWE-78

A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior)

2018-11-30

CVE-2018-7807

CWE-22

Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could allow for the arbitrary upload of files contained with the zip onto the server file system outside of the intended directory. This is leveraging the more commonly known ZipSlip vulnerability within Java code.

2018-07-10

CVE-2018-3693

CWE-noinfo

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a speculative buffer overflow and side-channel analysis.

2018-04-18

CVE-2018-2800

CWE-noinfo

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, JRockit accessible data as well as unauthorized read access to a subset of Java SE, JRockit accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

2017-04-30

CVE-2017-8371

CWE-522

Schneider Electric StruxureWare Data Center Expert before 7.4.0 uses cleartext RAM storage for passwords, which might allow remote attackers to obtain sensitive information via unspecified vectors.

>>> Vendor: Schneider-electric 299 Products

Software update

Citectfacilities

Clearscada 2005

Clearscada 2007

Clearscada 2009

Opc factory server

Telemecanique driver pack

Citecthistorian

Citectscada reports

Vijeo historian

M340 ethernet module bmxnoe0100

M340 ethernet module bmxnoe0110

M340 ethernet module bmxp342020

M340 ethernet module bmxp342030

Premium ethernet module tsxety4103

Premium ethernet module tsxety5103

Premium ethernet module tsxp57163m

Premium ethernet module tsxp572634m

Premium ethernet module tsxp573634m

Premium ethernet module tsxp574634m

Premium ethernet module tsxp575634m

Premium ethernet module tsxp576634m

Quantum ethernet module 140cpu65150

Quantum ethernet module 140cpu65160

Quantum ethernet module 140cpu65260

Quantum ethernet module 140noe77100

Quantum ethernet module 140noe77101

Quantum ethernet module 140noe77111

Stb dio ethernet module stbnic2212

Stb dio ethernet module stbnip2212

Stb dio ethernet module stbnip2311

Modicon quantum plc

Wonderware historian

Wonderware intouch

Software update utility

Interactive graphical scada system

Accutech manager

Modicon premium

Magelis xbt hmi

Micom s1 studio

Tburjr900 firmware

Scada expert clearscada

Telvent sage 3030

Telvent sage 3030 firmware

Struxureware scada expert vijeo citect

Struxureware powerscada expert

Powerlogic scada

Floating license manager

Ofs test client tlxcdlfofs33

Ofs test client tlxcdltofs33

Ofs test client tlxcdluofs33

Ofs test client tlxcdstofs33

Ofs test client tlxcdsuofs33

Modbus serial driver

Modbuscommdtm sl

Opc factory server tlxcdlfofs

Opc factory server tlxcdltofs

Opc factory server tlxcdluofs

Opc factory server tlxcdstofs

Opc factory server tlxcdsuofs

Modicon plc ethernet module

Wonderware intouch access anywhere server

Etg3000 factorycast hmi gateway firmware

Device type manager

Indusoft web studio

Wonderware intouch 2014

Wonderware system platform 2014

Imt25 magnetic flow dtm

See all Products for Vendor Schneider-electric

Copyright 2024, cxsecurity.com