Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-7730 State: PUBLISHED Published: 2018-03-06T18:00:00 Last Updated: 2024-08-05T06:31:05.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Exempi through 2.4.4. A certain case of a 0xffffffff length is mishandled in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp, leading to a heap-based buffer over-read in the PSD_MetaHandler::CacheFileData() function. Additional Analyst Notes: - CVE Program Container: References: - https://cgit.freedesktop.org/exempi/commit/?id=6cbd34025e5fd3ba47b29b602096e456507ce83b - https://lists.debian.org/debian-lts-announce/2018/03/msg00013.html - https://bugs.freedesktop.org/show_bug.cgi?id=105204 - https://
ts.debian.org/debian-lts-announce/2018/03/msg00013.html - https://bugs.freedesktop.org/show_bug.cgi?id=105204 - https://usn.ubuntu.com/3668-1/ - https://access.redhat.com/errata/RHSA-2019:2048 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BCFXKOOATZ2B5G3G7EBXZWVZHEABN4ZV/
CVE ID: CVE-2018-7731 State: PUBLISHED Published: 2018-03-06T18:00:00 Last Updated: 2024-08-05T06:31:05.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FormatSupport/WEBP_Support.cpp does not check whether a bitstream has a NULL value, leading to a NULL pointer dereference in the WEBP::VP8XChunk class. Additional Analyst Notes: - CVE Program Container: References: - https://cgit.freedesktop.org/exempi/commit/?id=aabedb5e749dd59112a3fe1e8e08f2d934f56666 - https://usn.ubuntu.com/3668-1/ - https://bugs.freedesktop.org/show_bug.cgi?id=105247 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fe
/bugs.freedesktop.org/show_bug.cgi?id=105247 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BCFXKOOATZ2B5G3G7EBXZWVZHEABN4ZV/
CVE ID: CVE-2018-7732 State: PUBLISHED Published: 2018-03-06T18:00:00Z Last Updated: 2024-09-16T18:14:11.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in YxtCMF 3.1. SQL Injection exists in ShitiController.class.php via the ids array parameter to exam/shiti/delshiti.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SQYY/CVE/blob/master/YxtCMF_S.txt
CVE ID: CVE-2018-7733 State: PUBLISHED Published: 2018-03-06T18:00:00Z Last Updated: 2024-09-17T00:25:35.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/add_post.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SQYY/CVE/blob/master/YxtCMF_C
CVE ID: CVE-2018-7734 State: PUBLISHED Published: 2018-03-06T19:00:00Z Last Updated: 2024-09-17T01:25:29.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users&section=cpanel&page=list request. Additional Analyst Notes: - CVE Program Container: References: - https://feedback.filerun.com/communities/1/topics/189-critical-security-update-available - http://www.filerun.com/changelog - https://www.scanfsec.com/FileRun_2017_09_25_Blind_SQL.html
CVE ID: CVE-2018-7735 State: PUBLISHED Published: 2018-03-06T19:00:00Z Last Updated: 2024-09-17T01:16:47.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metadata&section=cpanel&page=list_filetypes request. Additional Analyst Notes: - CVE Program Container: References: - https://feedback.filerun.com/communities/1/topics/189-critical-security-update-available - http://www.filerun.com/changelog - https://www.scanfsec.com/FileRun_2017_09_25_Blind_SQL.html
CVE ID: CVE-2018-7736 State: PUBLISHED Published: 2018-03-06T21:00:00 Last Updated: 2024-08-05T06:31:05.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zblogcn/zblogphp/issues/205 - https://www.exploit-db.com/exploits/44406/ - https://packetstormsecurity.com/files/147066/Z-Blog-1.5.1.1740-Cross-Site-Scripting.html - https://github.com/ponyma233/cms/blob/master/Z-Blog_1.5.1.1740_bugs.md
CVE ID: CVE-2018-7737 State: PUBLISHED Published: 2018-03-06T21:00:00 Last Updated: 2024-08-05T06:37:57.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php. NOTE: the software maintainer disputes that this is a vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zblogcn/zblogphp/issues/205 - https://github.com/ponyma233/cms/blob/master/Z-Blog_1.5.1.1740_bugs.md#web-site-physical-path-leakage - https://www.exploit-db.com/exploits/44407/ - https://packetstormsecurity.com/files/147063/Z-Blog-1.5.1.1740-Full-Path-Discl
ps://www.exploit-db.com/exploits/44407/ - https://packetstormsecurity.com/files/147063/Z-Blog-1.5.1.1740-Full-Path-Disclosure.html
CVE ID: CVE-2018-7738 State: PUBLISHED Published: 2018-03-06T22:00:00 Last Updated: 2024-12-13T13:09:22.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/karelzak/util-linux/issues/539 - https://www.debian.org/security/2018/dsa-4134 - http://www.securityfocus.com/bid/103367
arelzak/util-linux/issues/539 - https://www.debian.org/security/2018/dsa-4134 - http://www.securityfocus.com/bid/103367 - https://bugs.debian.org/892179 - https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55 - https://usn.ubuntu.com/4512-1/
CVE ID: CVE-2018-7739 State: PUBLISHED Published: 2018-03-06T22:00:00 Last Updated: 2024-08-05T06:37:58.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by a username=>&password=%0a string to the /login URI. This allows obtaining root permissions within the web management console, because the login process uses Java's ProcessBuilder class and a bash script called antsle-auth with insufficient input validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44262/ - http
tion. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44262/ - http://blog.codecatoctin.com/2018/02/antman-authentication-bypass.html - https://www.exploit-db.com/exploits/44220/
CVE ID: CVE-2018-7740 State: PUBLISHED Published: 2018-03-07T08:00:00 Last Updated: 2024-08-05T06:37:57.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted application that makes mmap system calls and has a large pgoff argument to the remap_file_pages system call. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3083 - https://www.debian.org/security/2018/dsa-4187 - https://usn.ubuntu.com/3910-1/ - https://www.debian.org/security/2018/dsa-4188 - https://usn.ubuntu.com/3910-2/
a-4187 - https://usn.ubuntu.com/3910-1/ - https://www.debian.org/security/2018/dsa-4188 - https://usn.ubuntu.com/3910-2/ - https://bugzilla.kernel.org/show_bug.cgi?id=199037 - http://www.securityfocus.com/bid/103316 - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - https://access.redhat.com/errata/RHSA-2018:3096
CVE ID: CVE-2018-7741 State: PUBLISHED Published: 2018-03-07T09:00:00Z Last Updated: 2024-09-17T01:41:01.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Eramba e1.0.6.033 has Reflected XSS in the Date Filter via the created parameter to the /crons URI. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issues-on-eramba-cf887bc0a069
CVE ID: CVE-2018-7745 State: PUBLISHED Published: 2018-03-07T17:00:00 Last Updated: 2024-08-05T06:37:59.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/installation/createuserinfo requests, resulting in account creation. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44419/ - https://github.com/cobub/razor/issues/161
CVE ID: CVE-2018-7746 State: PUBLISHED Published: 2018-03-07T17:00:00 Last Updated: 2024-08-05T06:37:58.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a crafted channel name, stored XSS is triggered during a later /index.php?/manage/channel request by an admin. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44416/ - https://github.com/cobub/razor/issues/161
CVE ID: CVE-2018-7747 State: PUBLISHED Published: 2018-04-20T21:00:00 Last Updated: 2024-08-05T06:37:59.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a greeting message, (2) the email transaction log, or (3) an imported form. Additional Analyst Notes: - CVE Program Container: References: - https://calderaforms.com/2018/03/caldera-forms-1-6-is-here/ - https://wordpress.org/plugins/caldera-forms/#developers - http://packetstormsecurity.com/files/147257/WordPress-Caldera-Forms-1.5
ordpress.org/plugins/caldera-forms/#developers - http://packetstormsecurity.com/files/147257/WordPress-Caldera-Forms-1.5.9.1-Cross-Site-Scripting.html - https://calderaforms.com/updates/caldera-forms-1-6-0/#security - https://www.exploit-db.com/exploits/44489/
CVE ID: CVE-2018-7748 State: PUBLISHED Published: 2018-08-03T18:00:00 Last Updated: 2024-08-05T06:37:59.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter. Additional Analyst Notes: - CVE Program Container: References: - https://telekomsecurity.github.io/2018/07/servicenow-privilege-escalation.html - https://telekomsecurity.github.io/assets/advisories/20180104_ServiceNow_GlideInjection.txt
CVE ID: CVE-2018-7749 State: PUBLISHED Published: 2018-03-12T19:00:00 Last Updated: 2024-08-05T06:37:59.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21msg/asyncssh-announce/57_5O7kiHSA/8BXZ_hxHAQAJ - https://github.com/ronf/asyncssh/commit/c161e26cdc0d41b745b63d9f17b437f073bf7ba4
CVE ID: CVE-2018-7750 State: PUBLISHED Published: 2018-03-13T18:00:00 Last Updated: 2024-08-05T06:37:58.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1124 - https://www.exploit-db.com/
es: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1124 - https://www.exploit-db.com/exploits/45712/ - https://github.com/paramiko/paramiko/issues/1175 - https://access.redhat.com/errata/RHSA-2018:1125 - https://access.redhat.com/errata/RHSA-2018:1972 - https://access.redhat.com/errata/RHSA-2018:1274 - https://lists.debian.org/debian-lts-announce/2018/10/msg00018.html - https://usn.ubuntu.com/3603-2/ - https://access.redhat.com/errata/RHSA-2018:0646 - https://access.redhat.com/errata/RHSA-2018:1213 - https://usn.ubuntu.com/3603-1/ - https://access.redhat.com/errata/RHSA-2018:1525 - https://access.redhat.com/errata/RHSA-2018:1328 - https://access.redhat.com/
//access.redhat.com/errata/RHSA-2018:1525 - https://access.redhat.com/errata/RHSA-2018:1328 - https://access.redhat.com/errata/RHSA-2018:0591 - http://www.securityfocus.com/bid/103713 - https://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516 - https://github.com/paramiko/paramiko/blob/master/sites/www/changelog.rst - https://lists.debian.org/debian-lts-announce/2021/12/msg00025.html
CVE ID: CVE-2018-7751 State: PUBLISHED Published: 2018-04-24T06:00:00 Last Updated: 2024-08-05T06:37:58.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (Infinite Loop) via a crafted XML file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103956 - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/a6cba062051f345e8ebfdff34aba071ed73d923f - https://security.gentoo.org/glsa/202003-65
CVE ID: CVE-2018-7752 State: PUBLISHED Published: 2018-03-07T23:00:00 Last Updated: 2024-08-05T06:37:59.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: GPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c, a different vulnerability than CVE-2018-1000100. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00040.html - https://github.com/gpac/gpac/commit/90dc7f853d31b0a4e9441cba97feccf36d8b69a4 - https://github.com/gpac/gpac/issues/997 - https://usn.ubuntu.com/3926-1/
CVE ID: CVE-2018-7753 State: PUBLISHED Published: 2018-03-07T23:00:00Z Last Updated: 2024-09-17T01:25:52.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mozilla/bleach/releases/tag/v2.1.3 - https://github.com/mozilla/bleach/commit/c5df5789ec3471a31311f42c2d19fc2cf21b35ef - https://bugs.debian.org/89225
.1.3 - https://github.com/mozilla/bleach/commit/c5df5789ec3471a31311f42c2d19fc2cf21b35ef - https://bugs.debian.org/892252
CVE ID: CVE-2018-7754 State: PUBLISHED Published: 2018-08-10T16:00:00 Last Updated: 2024-08-05T06:37:57.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: The aoedisk_debugfs_show function in drivers/block/aoe/aoeblk.c in the Linux kernel through 4.16.4rc4 allows local users to obtain sensitive address information by reading "ffree: " lines in a debugfs file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/johnsonwangqize/cve-linux/blob/master/CVE-2018-7754.md - https://elixir.bootlin.com/linux/v4.16-rc4/source/drivers/block/aoe/aoeblk.c#L421
CVE ID: CVE-2018-7755 State: PUBLISHED Published: 2018-03-08T07:00:00 Last Updated: 2024-08-05T06:37:58.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3695-1/ - https://usn.ubuntu.com/3696-1/ - https://u
otes: - CVE Program Container: References: - https://usn.ubuntu.com/3695-1/ - https://usn.ubuntu.com/3696-1/ - https://usn.ubuntu.com/3695-2/ - https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html - https://usn.ubuntu.com/3697-1/ - https://lkml.org/lkml/2018/3/7/1116 - https://usn.ubuntu.com/3697-2/ - https://www.debian.org/security/2018/dsa-4308 - https://usn.ubuntu.com/3698-1/ - https://usn.ubuntu.com/3696-2/ - https://usn.ubuntu.com/3698-2/ - https://access.redhat.com/errata/RHSA-2019:2043 - https://access.redhat.com/errata/RHSA-2019:2029
CVE ID: CVE-2018-7756 State: PUBLISHED Published: 2018-03-14T20:00:00 Last Updated: 2024-08-05T06:37:57.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which allows remote attackers to execute arbitrary code or access internal commands, as demonstrated by a RUN command that launches a .EXE file located at an arbitrary external URL, or a "SETFIREWALL Off" command. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/DEWESOFT-X3-REMOTE-INTERNAL-COMMAND-ACCESS.txt - https://www.exploit-db.com/ex
ttp://hyp3rlinx.altervista.org/advisories/DEWESOFT-X3-REMOTE-INTERNAL-COMMAND-ACCESS.txt - https://www.exploit-db.com/exploits/44275/
CVE ID: CVE-2018-7757 State: PUBLISHED Published: 2018-03-08T14:00:00 Last Updated: 2024-08-05T06:37:57.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3083 - https://www.debian.org/security/2018/dsa-4187 - https://usn.ubuntu.com/3654-
//access.redhat.com/errata/RHSA-2018:3083 - https://www.debian.org/security/2018/dsa-4187 - https://usn.ubuntu.com/3654-1/ - https://github.com/torvalds/linux/commit/4a491b1ab11ca0556d2fda1ff1301e862a2d44c4 - https://usn.ubuntu.com/3697-1/ - https://www.debian.org/security/2018/dsa-4188 - https://access.redhat.com/errata/RHSA-2018:2948 - https://usn.ubuntu.com/3697-2/ - http://www.securityfocus.com/bid/103348 - https://usn.ubuntu.com/3654-2/ - https://usn.ubuntu.com/3698-1/ - https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html - https://usn.ubuntu.com/3656-1/ - https://access.redhat.com/errata/RHSA-2018:3096 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/comm
- https://access.redhat.com/errata/RHSA-2018:3096 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4a491b1ab11ca0556d2fda1ff1301e862a2d44c4 - https://usn.ubuntu.com/3698-2/
CVE ID: CVE-2018-7758 State: PUBLISHED Published: 2018-04-18T20:00:00 Last Updated: 2024-08-05T06:37:57.963Z Vendors: Schneider Electric SE Products: MiCOM P540D Range with Legacy Ethernet Board Problem Types: Denial of Service Description: A denial of service vulnerability exists in Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet board, MiCOM P540D Range with Legacy Ethernet Board, and MiCOM Px4x Rejuvenated could lose network communication in case of TCP/IP open requests on port 20000 (DNP3oE) if an older TCI/IP session is still open with identical IP address and port number. Additional Analyst Notes: - CVE Program Container: References: - https://www.schneider-e
cal IP address and port number. Additional Analyst Notes: - CVE Program Container: References: - https://www.schneider-electric.com/en/download/document/SEVD-2018-074-04/ - https://www.schneider-electric.com/en/download/document/SEVD-2018-074-03/ - https://www.schneider-electric.com/en/download/document/SEVD-2018-074-02/
CVE ID: CVE-2018-7759 State: PUBLISHED Published: 2018-04-18T20:00:00 Last Updated: 2024-08-05T06:37:57.979Z Vendors: Schneider Electric SE Products: Modicon M340, Modicon Premium, Modicon Quantum, BMXNOR0200 Problem Types: Buffer overflow Description: A buffer overflow vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. The buffer overflow vulnerability is caused by the length of the source string specified (instead of the buffer size) as the number of bytes to be copied. Additional Analyst Notes: - CVE Program Container: References: - https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/
CVE ID: CVE-2018-7760 State: PUBLISHED Published: 2018-04-18T20:00:00 Last Updated: 2024-08-05T06:37:59.111Z Vendors: Schneider Electric SE Products: Modicon M340, Modicon Premium, Modicon Quantum, BMXNOR0201 Problem Types: Authorization Bypass Description: An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200. Requests to CGI functions allow malicious users to bypass authorization. Additional Analyst Notes: - CVE Program Container: References: - https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/
CVE ID: CVE-2018-7761 State: PUBLISHED Published: 2018-04-18T20:00:00 Last Updated: 2024-08-05T06:37:57.953Z Vendors: Schneider Electric SE Products: Modicon M340, Modicon Premium, Modicon Quantum, BMXNOR0202 Problem Types: Arbritrary Code Execution Description: A vulnerability exists in the HTTP request parser in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/
CVE ID: CVE-2018-7762 State: PUBLISHED Published: 2018-04-18T20:00:00 Last Updated: 2024-08-05T06:37:58.095Z Vendors: Schneider Electric SE Products: Modicon M340, Modicon Premium, Modicon Quantum, BMXNOR0203 Problem Types: Buffer overflow Description: A vulnerability exists in the web services to process SOAP requests in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow result in a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.schneider-electric.com/en/download/document/SEVD-2018-081-02/
CVE ID: CVE-2018-7763 State: PUBLISHED Published: 2018-07-03T14:00:00Z Last Updated: 2024-09-16T18:55:37.819Z Vendors: Schneider Electric SE Products: U.Motion Problem Types: Directory Traversal Information Disclosure Description: The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The 'css' parameter contains a directory traversal vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/