Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
391 results · page 6 of 8
Jan 26, 2021A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that couldCVE-2021-22698 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.
- Product
- Ecostruxure Power Build - Rapsody
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govse.com
Jan 26, 2021A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that couldCVE-2021-22697 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a use-after-free condition which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.
- Product
- Ecostruxure Power Build - Rapsody
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govse.com
Jan 26, 2021A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that cCVE-2020-28221 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.8
A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the notification) that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI.
- Product
- Ecostruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2020There is an out-of-bounds read vulnerability in some versions of NIP6800, Secospace USG6600 and USG9500.CVE-2020-9201 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
There is an out-of-bounds read vulnerability in some versions of NIP6800, Secospace USG6600 and USG9500. The software reads data past the end of the intended buffer when parsing DHCP messages including crafted parameter. Successful exploit could cause certain service abnormal.
- Product
- Nip6800 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2020The configuration backup/restore function in Silver Peak Unity ECOSTM (ECOS) appliance software was found to directly incorporate the user-controlled config filCVE-2020-12149 · Other software · Silver Peak Systems, Inc. · reported by sirt@silver-peak.comMedium 6.8
The configuration backup/restore function in Silver Peak Unity ECOSTM (ECOS) appliance software was found to directly incorporate the user-controlled config filename in a subsequent shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to: 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0.
- Product
- ECOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsilver-peak.comsilver-peak.com
Dec 11, 2020A command injection flaw identified in the nslookup API in Silver Peak Unity ECOSTM (ECOS) appliance software could allow an attacker to execute arbitrary commaCVE-2020-12148 · Other software · Silver Peak Systems, Inc. · reported by sirt@silver-peak.comMedium 6.8
A command injection flaw identified in the nslookup API in Silver Peak Unity ECOSTM (ECOS) appliance software could allow an attacker to execute arbitrary commands with the privileges of the web server running on the EdgeConnect appliance. An attacker could exploit this vulnerability to establish an interactive channel, effectively taking control of the target system. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to : 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0.
- Product
- ECOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsilver-peak.comsilver-peak.com
Dec 10, 2020A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control ExpeCVE-2020-7560 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 8.6
A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions), that could cause a crash of the software or unexpected code execution when opening a malicious file in EcoStruxure™ Control Expert software.
- Product
- Ecostruxure Control Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2020A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 202CVE-2020-28219 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1), that could cause exposure of credentials to server-side users when web users are logged in to Virtual ViewX.
- Product
- Ecostruxure GEO Scada Expert 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020Matrix is an ecosystem for open federated Instant Messaging and VoIP.CVE-2020-26257 · Other software · matrix-org · reported by GitHubMedium 6.5
Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2020A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for veCVE-2020-7547 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 8.8
A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow a user the ability to perform actions via the web interface at a higher privilege level.
- Product
- Ecostruxure Energy Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2020A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA SoftwarCVE-2020-7546 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 5.4
A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.
- Product
- Ecostruxure Energy Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2020A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for verCVE-2020-7545 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.2
A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage.
- Product
- Ecostruxure Energy Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able toCVE-2020-7573 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 6.5
A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control.
- Product
- Webreports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause aCVE-2020-7572 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 8.8
A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser.
- Product
- Webreports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building OperCVE-2020-7571 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 5.4
A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a Cross-Site Scripting reflected attack against other WebReport users.
- Product
- Webreports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebRepCVE-2020-7570 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 5.4
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users.
- Product
- Webreports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authCVE-2020-7569 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 8.8
A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution.
- Product
- Webreports
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now UnitCVE-2020-7559 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request over Modbus.
- Product
- Ecostruxure Control Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordse.comtalosintelligence.com
Nov 19, 2020A CWE-269 Improper Privilege Management vulnerability exists in EcoStruxureª Operator Terminal Expert runtime (Vijeo XD) that could cause privilege escalation oCVE-2020-7544 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-269 Improper Privilege Management vulnerability exists in EcoStruxureª Operator Terminal Expert runtime (Vijeo XD) that could cause privilege escalation on the workstation when interacting directly with a driver installed by the runtime software of EcoStruxureª Operator Terminal Expert.
- Product
- Operator Terminal Expert Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versioCVE-2020-7538 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request over Modbus.
- Product
- Ecostruxure Control Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that couCVE-2020-28213 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 8.8
A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when sending specially crafted requests over Modbus.
- Product
- Ecostruxure Control Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all vCVE-2020-28212 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.8
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when a brute force attack is done over Modbus.
- Product
- Ecostruxure Control Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass oCVE-2020-28211 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger.
- Product
- Ecostruxure Control Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central insCVE-2020-28209 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7
A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agent service binary path, being able to gain the privilege of the user who started the service. By default, the Enterprise Server and Enterprise Central is always installed at a location requiring Administrator privileges so the vulnerability is only valid if the application has been installed on a non-secure location.
- Product
- Enterprise Server Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2CVE-2020-28210 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 6.1
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser.
- Product
- Ecostruxure Building Operation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2020The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability, discovered in the addition a new contact in "Machine Address BCVE-2020-25890 · Other software · Kyocera · reported by MITREMedium 6.1
The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability, discovered in the addition a new contact in "Machine Address Book". Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions
- Product
- Ecosys M2640idw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvitor-santos.medium.comvitor-santos.medium.com
Jun 16, 2020A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 ServicCVE-2020-7497 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.8
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)which could cause arbitrary application execution when the computer starts.
- Product
- Ecostruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2020A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo CVE-2020-7496 · Other software · SE · reported by cybersecurity@se.comHigh 7.8
A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)which could cause unauthorized write access when opening the project file.
- Product
- Ecostruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2020A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists in EcoStruxure OperatorCVE-2020-7495 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 5.5
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) which could cause unauthorized write access outside of expected path folder when opening the project file.
- Product
- Ecostruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2020A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 ServicCVE-2020-7494 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) which could cause malicious code execution when opening the project file.
- Product
- Ecostruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2020A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 CVE-2020-7493 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) which could cause malicious code execution when opening the project file.
- Product
- Ecostruxure Operator Terminal Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2020Huawei products Secospace USG6300;USG6300E with versions of V500R001C30,V500R001C50,V500R001C60,V500R001C80,V500R005C00,V500R005C10;V600R006C00 have a vulnerabiCVE-2020-9075 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Huawei products Secospace USG6300;USG6300E with versions of V500R001C30,V500R001C50,V500R001C60,V500R001C80,V500R005C00,V500R005C10;V600R006C00 have a vulnerability of insufficient input verification. An attacker with limited privilege can exploit this vulnerability to access a specific directory. Successful exploitation of this vulnerability may lead to information leakage.
- Product
- Secospace Usg6300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2020Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500 with versions of V500R001C0CVE-2020-9099 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500 with versions of V500R001C00; V500R001C20; V500R001C30; V500R001C50; V500R001C60; V500R001C80; V500R005C00; V500R005C10; V500R005C20; V500R002C00; V500R002C10; V500R002C20; V500R002C30 have an improper authentication vulnerability. Attackers need to perform some operations to exploit the vulnerability. Successful exploit may obtain certain permissions on the device.
- Product
- IPS Module Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2020Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability.CVE-2020-1883 · Other software · Huawei · reported by psirt@huawei.comMedium 4.9
Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability. An attacker with high privileges exploits this vulnerability by continuously performing specific operations. Successful exploitation of this vulnerability can cause service abnormal.
- Product
- Nip6800 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2020A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert CVE-2020-7489 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.8
A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software (versions in security notification). The result of this vulnerability, DLL substitution, could allow the transference of malicious code to the controller.
- Product
- Ecostruxure Machine Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2020A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the CVE-2020-7488 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the Modicon M218, M241, M251, and M258 controllers.
- Product
- Ecostruxure Machine Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2020A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M24CVE-2020-7487 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.8
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M241, M251, and M258 controllers.
- Product
- Ecostruxure Machine Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2020A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS.CVE-2020-6994 · Other software · Hirschmann Automation and Control GmbH, a division of Belden Inc. · reported by ics-cert@hq.dhs.govCritical 9.8
A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer. The following devices using HiOS Version 07.0.02 and lower are affected: RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED. The following devices using HiSecOS Version 03.2.00 and lower are affected: EAGLE20/30.
- Product
- HiOS for the following devices RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 23, 2020A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxurCVE-2020-7475 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.8
A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10), which, if exploited, could allow attackers to transfer malicious code to the controller.
- Product
- Ecostruxure Control Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2020Some Huawei products have a security vulnerability due to improper authentication.CVE-2020-1864 · Other software · Huawei · reported by psirt@huawei.comHigh 8.1
Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain some information and forge the peer device to send specific packets to the affected device. Due to the improper implementation of the authentication function, attackers can exploit the vulnerability to connect to affected devices and execute a series of commands.Affected product versions include:Secospace AntiDDoS8000 versions V500R001C00,V500R001C20,V500R001C60,V500R005C00.
- Product
- Secospace Antiddos8000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2020Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the okhtmlfile and failhtmlfile parametCVE-2019-13202 · Other software · Kyocera · reported by MITRECritical 9.8
Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the okhtmlfile and failhtmlfile parameters of several functionalities of the web application that would allow an unauthenticated attacker to perform a Denial of Service attack, crashing the device, or potentially execute arbitrary code on the device.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the LPD service.CVE-2019-13201 · Other software · Kyocera · reported by MITRECritical 9.8
Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the LPD service. This would allow an unauthenticated attacker to cause a Denial of Service (DoS) in the LPD service and potentially execute arbitrary code on the device.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Reflected XSS.CVE-2019-13200 · Other software · Kyocera · reported by MITREMedium 6.1
The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Reflected XSS. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) did not implement any mechanism to avoid CSRF.CVE-2019-13199 · Other software · Kyocera · reported by MITREMedium 6.5
Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) did not implement any mechanism to avoid CSRF. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Stored XSS.CVE-2019-13198 · Other software · Kyocera · reported by MITREMedium 6.1
The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Stored XSS. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the URI paths of the web application thCVE-2019-13197 · Other software · Kyocera · reported by MITRECritical 9.8
Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the URI paths of the web application that would allow an unauthenticated attacker to perform a Denial of Service attack, crashing the device, or potentially execute arbitrary code on the device.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the arg4 and arg9 parameters of severalCVE-2019-13196 · Other software · Kyocera · reported by MITREHigh 8.8
Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the arg4 and arg9 parameters of several functionalities of the web application that would allow an authenticated attacker to perform a Denial of Service attack, crashing the device, or potentially execute arbitrary code on the device.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path traversal, allowing an unauthenticated user tCVE-2019-13195 · Other software · Kyocera · reported by MITREHigh 7.5
The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path traversal, allowing an unauthenticated user to retrieve arbitrary files, or check if files or folders existed within the file system.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in multiple parameters of the Document BoxCVE-2019-13206 · Other software · Kyocera · reported by MITREHigh 8.8
Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in multiple parameters of the Document Boxes functionality of the web application that would allow an authenticated attacker to perform a Denial of Service attack, crashing the device, or potentially execute arbitrary code on the device.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Mar 13, 2020All configuration parameters of certain Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were accessible by unauthenticated users.CVE-2019-13205 · Other software · Kyocera · reported by MITREHigh 7.5
All configuration parameters of certain Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were accessible by unauthenticated users. This information was only presented in the menus when authenticated, and the pages that loaded this information were also protected. However, all files that contained the configuration parameters were accessible. These files contained sensitive information, such as users, community strings, and other passwords configured in the printer.
- Product
- Ecosys M5526cdw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnccgroup.trustnccgroup.trust
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.