Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-7933 State: PUBLISHED Published: 2018-06-06T20:00:00 Last Updated: 2024-08-05T16:19:29.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ABB IP GATEWAY 3.39 and prior, some configuration files contain passwords stored in plain-text, which may allow an attacker to gain unauthorized access. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104388 - https://ics-cert.us-cert.gov/advisories/ICSA-18-156-01
CVE ID: CVE-2017-7934 State: PUBLISHED Published: 2017-08-25T19:00:00 Last Updated: 2024-08-05T16:19:29.337Z Vendors: n/a Products: OSIsoft PI Server 2017 Problem Types: CWE-287 Description: An Improper Authentication issue was discovered in OSIsoft PI Server 2017 PI Data Archive versions prior to 2017. PI Network Manager using older protocol versions contains a flaw that could allow a malicious user to authenticate with a server and then cause PI Network Manager to behave in an undefined manner. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-164-02 - http://www.securityfocus.com/bid/99059
CVE ID: CVE-2017-7935 State: PUBLISHED Published: 2017-05-19T02:43:00 Last Updated: 2024-08-05T16:19:29.422Z Vendors: n/a Products: Phoenix Contact GmbH mGuard Problem Types: CWE-400 Description: A Resource Exhaustion issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may compromise the device's availability by performing multiple initial VPN requests. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-131-01
CVE ID: CVE-2017-7936 State: PUBLISHED Published: 2017-08-07T08:00:00 Last Updated: 2024-08-05T16:19:29.271Z Vendors: n/a Products: NXP i.MX Product Family Problem Types: CWE-121 Description: A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.
unprotected region of memory. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02 - http://www.securityfocus.com/bid/99966
CVE ID: CVE-2017-7937 State: PUBLISHED Published: 2017-05-19T02:43:00 Last Updated: 2024-08-05T16:19:29.218Z Vendors: n/a Products: Phoenix Contact GmbH mGuard Problem Types: CWE-287 Description: An Improper Authentication issue was discovered in Phoenix Contact GmbH mGuard firmware versions 8.3.0 to 8.4.2. An attacker may be able to gain unauthorized access to the user firewall when RADIUS servers are unreachable. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-131-01
CVE ID: CVE-2017-7938 State: PUBLISHED Published: 2017-04-20T00:00:00.000Z Last Updated: 2025-11-03T21:44:05.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname strings found in local log files. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - https://packetstormsecurity.com/files/142210/Dmitry-1.3a-Local-Stack-Buffer-Overflow.html - https://cxsecurity.com
es: - https://packetstormsecurity.com/files/142210/Dmitry-1.3a-Local-Stack-Buffer-Overflow.html - https://cxsecurity.com/issue/WLB-2017040113 - https://www.exploit-db.com/exploits/41898/ - https://github.com/jaygreig86/dmitry/pull/12
CVE ID: CVE-2017-7939 State: PUBLISHED Published: 2017-04-18T19:00:00 Last Updated: 2024-08-05T16:19:29.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: The read_next_pam_token function in imagew-pnm.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201706-06 - https://github.com/jsummers/imageworsener/issues/13
CVE ID: CVE-2017-7940 State: PUBLISHED Published: 2017-04-18T19:00:00 Last Updated: 2024-08-05T16:19:29.342Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iw_read_gif_file function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to consume an amount of available memory via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201706-06 - https://github.com/jsummers/imageworsener/issues/18
CVE ID: CVE-2017-7941 State: PUBLISHED Published: 2017-04-18T19:00:00 Last Updated: 2024-08-05T16:19:29.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadSGIImage function in sgi.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/428 - http://www.securityfocus.com/bid/97944 - http://www.debian.org/security/2017/dsa-3863
CVE ID: CVE-2017-7942 State: PUBLISHED Published: 2017-04-18T19:00:00 Last Updated: 2024-08-05T16:19:29.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadAVSImage function in avs.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/429 - http://www.securityfocus.com/bid/97946
CVE ID: CVE-2017-7943 State: PUBLISHED Published: 2017-04-18T19:00:00 Last Updated: 2024-08-05T16:19:29.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ReadSVGImage function in svg.c in ImageMagick 7.0.5-4 allows remote attackers to consume an amount of available memory via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3863 - http://www.securityfocus.com/bid/97956 - https://github.com/ImageMagick/ImageMagick/issues/427
CVE ID: CVE-2017-7944 State: PUBLISHED Published: 2017-04-24T10:00:00 Last Updated: 2024-08-05T16:19:29.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in page_dbsettings.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97978 - https://tsublogs.wordpress.com/2017/04/24/xoops-core-2-5-8-1-install-db-cross-site-scripting/
CVE ID: CVE-2017-7945 State: PUBLISHED Published: 2017-04-29T00:00:00 Last Updated: 2024-08-05T16:19:29.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests, aka PAN-SA-2017-0014 and PAN-72769. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2017-7945
CVE ID: CVE-2017-7946 State: PUBLISHED Published: 2017-04-18T20:00:00Z Last Updated: 2024-09-16T19:31:07.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: The get_relocs_64 function in libr/bin/format/mach0/mach0.c in radare2 1.3.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted Mach0 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radare/radare2/issues/7301 - https://github.com/radare/radare2/commit/d1e8ac62c6d978d4662f69116e30230d43033c92
CVE ID: CVE-2017-7947 State: PUBLISHED Published: 2017-07-17T21:00:00 Last Updated: 2024-08-05T16:19:29.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, and 9.1 before P5 allow attackers to obtain sensitive password information by leveraging logging of passwords entered non-interactively on the command line. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netapp.com/support/s/article/NTAP-20170630-0001
CVE ID: CVE-2017-7948 State: PUBLISHED Published: 2017-04-19T14:00:00 Last Updated: 2024-08-05T16:19:29.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201811-12 - https://bugs.ghostscript.com/show_bug.cgi?id=697762 - http://git.ghostscript.com/?p=ghostpdl.git%3Bh=8210a2864372723b49c526e2b102fdc00c9c4699
CVE ID: CVE-2017-7950 State: PUBLISHED Published: 2017-07-07T11:00:00 Last Updated: 2024-08-05T16:19:29.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nitro Pro 11.0.3 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted PCX file. Additional Analyst Notes: - CVE Program Container: References: - https://www.gonitro.com/support/downloads#securityUpdates - http://www.securityfocus.com/bid/99514
CVE ID: CVE-2017-7951 State: PUBLISHED Published: 2017-04-21T02:11:00 Last Updated: 2024-08-05T16:19:29.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context. Additional Analyst Notes: - CVE Program Container: References: - https://www.wondercms.com/forum/viewtopic.php?f=8&p=1684 - https://github.com/robiso/wondercms/releases/tag/2.0.3
CVE ID: CVE-2017-7952 State: PUBLISHED Published: 2017-05-16T10:00:00 Last Updated: 2024-08-05T16:19:29.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2017/May/55 - https://www.exploit-db.com/exploits/42028/
CVE ID: CVE-2017-7953 State: PUBLISHED Published: 2017-05-16T10:00:00 Last Updated: 2024-08-05T16:19:29.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: INFOR EAM V11.0 Build 201410 has XSS via comment fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42029/ - http://seclists.org/fulldisclosure/2017/May/54
CVE ID: CVE-2017-7957 State: PUBLISHED Published: 2017-04-29T19:00:00 Last Updated: 2024-08-05T16:19:29.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2888 - https://access.redhat.com/errata/RHSA-2017:1832 - https://access.redhat.com/errata/RHSA-2017:2889 - http://www.securitytracker.com/id/1039499 - https://www-pr
2017:1832 - https://access.redhat.com/errata/RHSA-2017:2889 - http://www.securitytracker.com/id/1039499 - https://www-prd-trops.events.ibm.com/node/715749 - https://exchange.xforce.ibmcloud.com/vulnerabilities/125800 - http://www.debian.org/security/2017/dsa-3841 - http://x-stream.github.io/CVE-2017-7957.html - http://www.securityfocus.com/bid/100687
CVE ID: CVE-2017-7960 State: PUBLISHED Published: 2017-04-19T15:00:00 Last Updated: 2024-08-05T16:19:29.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201707-13 - https://git.gnome.org/browse/libcroco/commit/?id=898e3a8c8c0314d2e6b106809a8e3e93cf9d4394 - https://blogs.gentoo.org/ago/2017/04/17/libcroco-heap-overflow-and-undefined-behavior/ - http://lists.opensuse.org/opensuse-security-announce/20
/ago/2017/04/17/libcroco-heap-overflow-and-undefined-behavior/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00043.html
CVE ID: CVE-2017-7961 State: PUBLISHED Published: 2017-04-19T15:00:00 Last Updated: 2024-08-05T16:19:29.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an "outside the range of representable values of type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports "This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components. Additio
ly is truncating the double into a long value, but there is no impact as the value is one of the RGB components. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - https://git.gnome.org/browse/libcroco/commit/?id=9ad72875e9f08e4c519ef63d44cdbd94aa9504f7 - https://security.gentoo.org/glsa/201707-13 - http://openwall.com/lists/oss-security/2017/04/24/2 - https://bugzilla.suse.com/show_bug.cgi?id=1034482 - https://blogs.gentoo.org/ago/2017/04/17/libcroco-heap-overflow-and-undefined-behavior/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00043.html
CVE ID: CVE-2017-7962 State: PUBLISHED Published: 2017-04-19T15:00:00 Last Updated: 2024-08-05T16:19:29.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iwgif_read_image function in imagew-gif.c in libimageworsener.a in ImageWorsener 1.3.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/04/17/imageworsener-divide-by-zero-in-iwgif_record_pixel-imagew-gif-c/ - https://security.gentoo.org/glsa/201706-06 - https://github.com/jsummers/imageworsener/commit/ca3356eb49fee03e2eaf6b6aff826988c1122d93 - https://github
a/201706-06 - https://github.com/jsummers/imageworsener/commit/ca3356eb49fee03e2eaf6b6aff826988c1122d93 - https://github.com/jsummers/imageworsener/issues/15
CVE ID: CVE-2017-7963 State: PUBLISHED Published: 2017-04-19T15:00:00Z Last Updated: 2024-09-17T00:41:50.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior. Additional Analyst Notes:
ker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=74308
CVE ID: CVE-2017-7964 State: PUBLISHED Published: 2017-04-19T16:00:00Z Last Updated: 2024-09-16T17:14:45.081Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for remote attackers to conduct DNS hijacking attacks by reconfiguring the built-in dnshijacker process. Additional Analyst Notes: - CVE Program Container: References: - https://www.oxy-gen.mobi/blog.html
CVE ID: CVE-2017-7965 State: PUBLISHED Published: 2017-06-07T19:00:00 Last Updated: 2024-08-05T16:19:29.459Z Vendors: Schneider Electric SE Products: SoMachine HVAC Programming Software Problem Types: Buffer Overflow Description: A buffer overflow vulnerability exists in Programming Software executable AlTracePrint.exe, in Schneider Electric's SoMachine HVAC v2.1.0 for Modicon M171/M172 Controller. Additional Analyst Notes: - CVE Program Container: References: - http://www.schneider-electric.com/en/download/document/SEVD-2017-125-01/ - http://www.securityfocus.com/bid/98449
CVE ID: CVE-2017-7966 State: PUBLISHED Published: 2017-06-07T19:00:00 Last Updated: 2024-08-05T16:19:29.779Z Vendors: Schneider Electric SE Products: SoMachine HVAC Programming Software Problem Types: DLL Hijacking Description: A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on the targeted system. The vulnerability exists due to the improper loading of a DLL. Additional Analyst Notes: - CVE Program Container: References: - http://www.schneider-electric.com/en/download/document/SEVD-2017-125-02/ - http://www.securityfocus.com/bid/98446
CVE ID: CVE-2017-7967 State: PUBLISHED Published: 2017-05-09T17:00:00 Last Updated: 2024-08-05T16:19:29.398Z Vendors: Schneider Electric SE Products: VAMPSET Problem Types: Memory Corruption Description: All versions of VAMPSET software produced by Schneider Electric, prior to V2.2.189, are susceptible to a memory corruption vulnerability when a corrupted vf2 file is used. This vulnerability causes the software to halt or not start when trying to open the corrupted file. This vulnerability occurs when fill settings are intentionally malformed and is opened in a standalone state, without connection to a protection relay. This attack is not considered to be remotely exploitable. This vulnerabi
tate, without connection to a protection relay. This attack is not considered to be remotely exploitable. This vulnerability has no effect on the operation of the protection relay to which VAMPSET is connected. As Windows operating system remains operational and VAMPSET responds, it is able to be shut down through its normal closing protocol. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97124 - http://www.schneider-electric.com/en/download/document/SEVD-2017-061-01/
CVE ID: CVE-2017-7968 State: PUBLISHED Published: 2017-05-19T15:00:00 Last Updated: 2024-08-05T16:19:29.522Z Vendors: n/a Products: Schneider Electric Wonderware InduSoft Web Studio Problem Types: CWE-276 Description: An Incorrect Default Permissions issue was discovered in Schneider Electric Wonderware InduSoft Web Studio v8.0 Patch 3 and prior versions. Upon installation, Wonderware InduSoft Web Studio creates a new directory and two files, which are placed in the system's path and can be manipulated by non-administrators. This could allow an authenticated user to escalate his or her privileges. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/a
e his or her privileges. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-138-02 - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-090-02 - http://www.securityfocus.com/bid/98544
CVE ID: CVE-2017-7969 State: PUBLISHED Published: 2017-09-25T19:00:00Z Last Updated: 2024-09-17T01:30:49.504Z Vendors: Schneider Electric SE Products: PowerSCADA Anywhere, Citect Anywhere Problem Types: Cross Site Request Forgery Description: A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack. Additional Analyst
der to get a legitimate user to click on or access a malicious link/site containing the CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99913 - https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere - http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/
CVE ID: CVE-2017-7970 State: PUBLISHED Published: 2017-09-25T19:00:00Z Last Updated: 2024-09-17T02:56:33.769Z Vendors: Schneider Electric SE Products: PowerSCADA Anywhere, Citect Anywhere Problem Types: Information Exposure Description: A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to specify Arbitrary Server Target Nodes in connection requests to the Secure Gateway and Server components. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99913 - https://www.citect.schneider-electric.com/safety-an
am Container: References: - http://www.securityfocus.com/bid/99913 - https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere - http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/
CVE ID: CVE-2017-7971 State: PUBLISHED Published: 2017-09-25T19:00:00Z Last Updated: 2024-09-16T22:15:34.585Z Vendors: Schneider Electric SE Products: PowerSCADA Anywhere, Citect Anywhere Problem Types: Improper Validaiton of Certificate Expiration Description: A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the use of outdated cipher suites and improper verification of peer SSL Certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99913 - https://www.citect.schneider-electric.com/safety-and-security-
r: References: - http://www.securityfocus.com/bid/99913 - https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere - http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/
CVE ID: CVE-2017-7972 State: PUBLISHED Published: 2017-09-25T19:00:00Z Last Updated: 2024-09-16T17:59:07.360Z Vendors: Schneider Electric SE Products: PowerSCADA Anywhere, Citect Anywhere Problem Types: Escaping PowerSCADA Application Description: A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to escape out of remote PowerSCADA Anywhere applications and launch other processes. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99913 - https://www.citect.schneider-electric.com/safety-and-security-ce
References: - http://www.securityfocus.com/bid/99913 - https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhere - http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/