Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-0935 State: PUBLISHED Published: 2015-05-25T19:00:00 Last Updated: 2024-08-06T04:26:11.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/978652 - http://www.securityfocus.com/bid/74460 - https://www.exploit-db.com/exploits/39958/
CVE ID: CVE-2015-0936 State: PUBLISHED Published: 2017-06-01T16:00:00 Last Updated: 2024-08-06T04:26:11.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131259/Ceragon-FibeAir-IP-10-SSH-Private-Key-Exposure.html - https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwjs47SGp47UAhVF5iYKHYGLDQkQFggoMAE&url=https%3A%2F%2Fwww.rapid7.com%2Fdb%2Fmodules%
ce=web&cd=2&cad=rja&uact=8&ved=0ahUKEwjs47SGp47UAhVF5iYKHYGLDQkQFggoMAE&url=https%3A%2F%2Fwww.rapid7.com%2Fdb%2Fmodules%2Fexploit%2Flinux%2Fssh%2Fceragon_fibeair_known_privkey&usg=AFQjCNFZiZcWj47cpqPX-AbfpsW0DL4yYw - https://gist.github.com/todb-r7/5d86ecc8118f9eeecc15 - http://packetstormsecurity.com/files/131260/Ceragon-FibeAir-IP-10-SSH-Private-Key-Exposure.html - http://www.securityfocus.com/bid/73696 - http://seclists.org/fulldisclosure/2015/Apr/3
CVE ID: CVE-2015-0937 State: PUBLISHED Published: 2015-04-17T01:00:00 Last Updated: 2024-08-06T04:26:11.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bto.bluecoat.com/security-advisory/sa94 - http://www.kb.cert.org/vuls/id/274244
CVE ID: CVE-2015-0938 State: PUBLISHED Published: 2015-04-17T01:00:00 Last Updated: 2024-08-06T04:26:11.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to bypass intended access restrictions, and list or read arbitrary documents, by providing matching keywords in conjunction with a crafted parameter. Additional Analyst Notes: - CVE Program Container: References: - https://bto.bluecoat.com/security-advisory/sa94 - http://www.kb.cert.org/vuls/id/274244
CVE ID: CVE-2015-0941 State: PUBLISHED Published: 2015-03-22T01:00:00 Last Updated: 2024-08-06T04:26:11.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/894897
CVE ID: CVE-2015-0942 State: REJECTED Published: 2015-08-31T14:08:00 Last Updated: 2015-08-31T12:57:04 Description: No description available.
CVE ID: CVE-2015-0943 State: PUBLISHED Published: 2015-08-31T14:08:00 Last Updated: 2024-08-06T04:26:11.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Jul/120 - https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haa
p://seclists.org/fulldisclosure/2015/Jul/120 - https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html
CVE ID: CVE-2015-0949 State: PUBLISHED Published: 2020-01-30T20:45:19 Last Updated: 2024-08-06T04:26:11.454Z Vendors: Dell, HP Products: Latitude E6430, EliteBook 850 G1 Problem Types: Other Description: The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Boot protection mechanism and gain privileges by leveraging write access to physical memory. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/631788
CVE ID: CVE-2015-0950 State: PUBLISHED Published: 2015-04-05T01:00:00 Last Updated: 2024-08-06T04:26:11.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.x-cart.com/5-1-11-released.html - http://www.kb.cert.org/vuls/id/924124
CVE ID: CVE-2015-0951 State: PUBLISHED Published: 2015-04-05T01:00:00 Last Updated: 2024-08-06T04:26:11.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified (1) update or (2) remove request. Additional Analyst Notes: - CVE Program Container: References: - https://blog.x-cart.com/5-1-11-released.html - http://www.kb.cert.org/vuls/id/924124
CVE ID: CVE-2015-0955 State: REJECTED Published: 2017-06-27T20:00:00 Last Updated: 2017-06-30T13:57:01 Description: No description available.
CVE ID: CVE-2015-0961 State: PUBLISHED Published: 2015-05-25T22:00:00 Last Updated: 2024-08-06T04:26:11.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/534407 - https://techlib.barracuda.com/BWF/UpdateSSLCerts - https://www.barracuda.com/support/techalerts - https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspectio
://www.barracuda.com/support/techalerts - https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/
CVE ID: CVE-2015-0962 State: PUBLISHED Published: 2015-05-25T22:00:00 Last Updated: 2024-08-06T04:26:11.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/534407 - https://techlib.barracuda.com/BWF/UpdateSSLCerts - https://www.barracuda.com/support/techaler
.cert.org/vuls/id/534407 - https://techlib.barracuda.com/BWF/UpdateSSLCerts - https://www.barracuda.com/support/techalerts - https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/
CVE ID: CVE-2015-0967 State: PUBLISHED Published: 2015-04-18T01:00:00 Last Updated: 2024-08-06T04:26:11.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/697316
CVE ID: CVE-2015-0968 State: PUBLISHED Published: 2015-04-18T01:00:00 Last Updated: 2024-08-06T04:26:11.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 8.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and the image/jpeg content type, a different vulnerability than CVE-2013-3590. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/697316
CVE ID: CVE-2015-0969 State: PUBLISHED Published: 2015-04-18T01:00:00 Last Updated: 2024-08-06T04:26:11.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/697316
CVE ID: CVE-2015-0970 State: PUBLISHED Published: 2015-04-18T01:00:00 Last Updated: 2024-08-06T04:26:11.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/697316
CVE ID: CVE-2015-0971 State: PUBLISHED Published: 2015-05-14T14:00:00 Last Updated: 2024-08-06T04:26:11.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates. Additional Analyst Notes: - CVE Program Container: References: - http://suricata-ids.org/2015/05/06/suricata-2-0-8-available/ - http://www.debian.org/security/2015/dsa-3254
CVE ID: CVE-2015-0972 State: PUBLISHED Published: 2015-06-23T16:00:00 Last Updated: 2024-08-06T04:26:11.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attackers to modify test metadata or cause a denial of service (test disruption) by leveraging knowledge of this password. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/626420
CVE ID: CVE-2015-0973 State: PUBLISHED Published: 2015-01-18T18:00:00.000Z Last Updated: 2025-06-09T15:25:54.990Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html - https://support.apple.com/HT206167 - http://sourceforge.net/p/png-mng/mailman/message/33173461/ - http://www
0004.html - https://support.apple.com/HT206167 - http://sourceforge.net/p/png-mng/mailman/message/33173461/ - http://www.openwall.com/lists/oss-security/2015/01/10/1 - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://www.openwall.com/lists/oss-security/2015/01/10/3 - http://secunia.com/advisories/62725 - http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt - https://security.netapp.com/advisory/ntap-20240719-0005/
CVE ID: CVE-2015-0974 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T04:26:11.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to reference a malicious mms_dll_r.dll or mediaplayerdll.dll. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129808/ZTE-Datacard-MF19-Privilege-Escalation-DLL-Hijacking.html
CVE ID: CVE-2015-0976 State: PUBLISHED Published: 2015-04-03T10:00:00 Last Updated: 2024-08-06T04:26:11.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Inductive Automation Ignition 7.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE ID: CVE-2015-0977 State: PUBLISHED Published: 2015-02-27T02:00:00 Last Updated: 2024-08-06T04:26:11.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Network Vision IntraVue before 2.3.0a14 on Windows allows remote attackers to execute arbitrary OS commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-057-01
CVE ID: CVE-2015-0978 State: PUBLISHED Published: 2015-03-14T01:00:00 Last Updated: 2024-08-06T04:26:11.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Elipse E3 4.5.232 through 4.6.161 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory. NOTE: this may overlap CVE-2015-2264. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-069-04A
CVE ID: CVE-2015-0979 State: PUBLISHED Published: 2015-03-14T01:00:00 Last Updated: 2024-08-06T04:26:11.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03
CVE ID: CVE-2015-0980 State: PUBLISHED Published: 2015-03-14T01:00:00 Last Updated: 2024-08-06T04:26:11.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03
CVE ID: CVE-2015-0981 State: PUBLISHED Published: 2015-03-14T01:00:00 Last Updated: 2024-08-06T04:26:11.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03
CVE ID: CVE-2015-0982 State: PUBLISHED Published: 2015-03-14T01:00:00 Last Updated: 2024-08-06T04:26:11.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in an unspecified DLL in Schneider Electric Pelco DS-NVs before 7.8.90 allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://download.schneider-electric.com/files?p_File_Id=755516404&p_File_Name=SEVD-2015-065-01+Pelco+DS-NVs+Video+Mgmt+SW.pdf - https://ics-cert.us-cert.gov/advisories/ICSA-15-071-01
CVE ID: CVE-2015-0983 State: REJECTED Published: 2017-03-16T15:00:00 Last Updated: 2017-03-16T14:57:01 Description: No description available.
CVE ID: CVE-2015-0984 State: PUBLISHED Published: 2015-03-31T01:00:00 Last Updated: 2024-08-06T04:26:11.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root, and consequently obtain administrative login access, via a crafted pathname. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-
pathname. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-076-02 - http://seclists.org/fulldisclosure/2015/Apr/79 - https://www.outpost24.com/hacking-industrial-control-systems-case-study-falcon/
CVE ID: CVE-2015-0985 State: PUBLISHED Published: 2015-03-31T01:00:00 Last Updated: 2024-08-06T04:26:11.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that modify the default user's password via a GET request. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-076-01
CVE ID: CVE-2015-0986 State: PUBLISHED Published: 2015-05-26T15:00:00 Last Updated: 2024-08-06T04:26:11.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) get command. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-097-01 - http://www.zerodayinitiative.com/advisories/ZDI-15-392 - http://www.securityfocus.com/bid/73960 - http://www.moxa.com/support/download.aspx?d_id=2114
CVE ID: CVE-2015-0987 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T04:26:11.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01
CVE ID: CVE-2015-0988 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T04:26:11.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: Omron CX-One CX-Programmer before 9.6 uses a reversible format for password storage in project source-code files, which makes it easier for local users to obtain sensitive information by reading a file. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01
CVE ID: CVE-2015-0989 State: PUBLISHED Published: 2015-06-28T10:00:00 Last Updated: 2024-08-06T04:26:11.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-176-02
CVE ID: CVE-2015-0990 State: PUBLISHED Published: 2015-04-03T10:00:00 Last Updated: 2024-08-06T04:26:11.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-090-02
CVE ID: CVE-2015-0991 State: PUBLISHED Published: 2015-04-03T10:00:00 Last Updated: 2024-08-06T04:26:11.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE ID: CVE-2015-0992 State: PUBLISHED Published: 2015-04-03T10:00:00 Last Updated: 2024-08-06T04:26:11.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE ID: CVE-2015-0993 State: PUBLISHED Published: 2015-04-03T10:00:00 Last Updated: 2024-08-06T04:26:11.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE ID: CVE-2015-0994 State: PUBLISHED Published: 2015-04-03T10:00:00 Last Updated: 2024-08-06T04:26:11.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force protection mechanism by using different session ID values in a series of HTTP requests. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE ID: CVE-2015-0995 State: PUBLISHED Published: 2015-04-03T10:00:00 Last Updated: 2024-08-06T04:26:11.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inductive Automation Ignition 7.7.2 uses MD5 password hashes, which makes it easier for context-dependent attackers to obtain access via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01
CVE ID: CVE-2015-0996 State: PUBLISHED Published: 2015-03-29T10:00:00 Last Updated: 2024-08-06T04:26:11.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password. Additional Analyst Notes: - CVE Program Container: References: - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 - https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01
wnload.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 - https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02
CVE ID: CVE-2015-0997 State: PUBLISHED Published: 2015-03-29T10:00:00 Last Updated: 2024-08-06T04:26:11.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack. Additional Analyst Notes: - CVE Program Container: References: - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 - https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 - http://download.schneider-electric.com/files
SEVD-2015-054-01 - https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02