deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-13087
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Coinstar (CSTR), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/MyAdvancedToken/MyAdvancedToken.md; https://github.com/VenusADLab/EtherTokens/blob/master/MyAdvancedToken/MyAdvancedToken.md
CVE: CVE-2018-13088
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Futures Pease (FP), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/TokenERC20/TokenERC20.md; https://github.com/VenusADLab/EtherTokens/blob/master/TokenERC20/TokenERC20.md
CVE: CVE-2018-13089
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Universal Coin (UCOIN), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/UCoinToken/UCoinToken.md; https://github.com/VenusADLab/EtherTokens/blob/master/UCoinToken/UCoinToken.md
CVE: CVE-2018-13090
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for YiTongCoin (YTC), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/YiTongCoin/YiTongCoin.md; https://github.com/VenusADLab/EtherTokens/blob/master/YiTongCoin/YiTongCoin.md
CVE: CVE-2018-13091
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for sumocoin (SUMO), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/sumocoin/sumocoin.md; https://github.com/VenusADLab/EtherTokens/blob/master/sumocoin/sumocoin.md
CVE: CVE-2018-13092
Published: 2018-07-03
Description: The mintToken function of a smart contract implementation for Reimburse Token (REIM), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/VenusADLab/EtherTokens/blob/master/ReimburseToken/ReimburseToken.md; https://github.com/VenusADLab/EtherTokens/blob/master/ReimburseToken/ReimburseToken.md
CVE: CVE-2018-8868
Published: 2018-07-03
Description: Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains debug code meant to test the functionality of the monitor's communication interfaces, including the interface between the monitor and implantable cardiac device. An attacker with physical access to the device can exploit other vulnerabilities to access this debug functionality. This debug functionality provides the ability to read and write arbitrary memory values to implantable cardiac devices via inductive or short range wireless protocols. An attacker with close physical proximity to a target implantable cardiac device can use this debug functionality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-749
References: https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-6-28-18.html; https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01; https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01
CVE: CVE-2018-8870
Published: 2018-07-03
Description: Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove the case of the device, connect to the debug port, and use the password to gain privileged access to the operating system.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-259, CWE-798
References: https://global.medtronic.com/xg-en/product-security/security-bulletins/mycarelink-6-28-18.html; https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01; https://ics-cert.us-cert.gov/advisories/ICSMA-18-179-01
CVE: CVE-2018-13093
Published: 2018-07-03
Description: An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during allocation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2019:2029; https://access.redhat.com/errata/RHSA-2019:2043; https://bugzilla.kernel.org/show_bug.cgi?id=199367
CVE: CVE-2018-13094
Published: 2018-07-03
Description: An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2019:0831; https://access.redhat.com/errata/RHSA-2019:2029; https://access.redhat.com/errata/RHSA-2019:2043
CVE: CVE-2018-13095
Published: 2018-07-03
Description: An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2019:1350; https://access.redhat.com/errata/RHSA-2019:2029; https://access.redhat.com/errata/RHSA-2019:2043
CVE: CVE-2018-13096
Published: 2018-07-03
Description: An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted f2fs image.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html; http://packetstormsecurity.com/files/151420/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; https://bugzilla.kernel.org/show_bug.cgi?id=200167
CVE: CVE-2018-13097
Published: 2018-07-03
Description: An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds read or a divide-by-zero error for an incorrect user_block_count in a corrupted f2fs image, leading to a denial of service (BUG).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html; http://packetstormsecurity.com/files/151420/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; https://bugzilla.kernel.org/show_bug.cgi?id=200171
CVE: CVE-2018-13098
Published: 2018-07-03
Description: An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3. A denial of service (slab out-of-bounds read and BUG) can occur for a modified f2fs filesystem image in which FI_EXTRA_ATTR is set in an inode.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html; https://bugzilla.kernel.org/show_bug.cgi?id=200173; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=76d56d4ab4f2a9e4f085c7d77172194ddaccf7d2
CVE: CVE-2018-13099
Published: 2018-07-03
Description: An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. A denial of service (out-of-bounds memory access and BUG) can occur for a modified f2fs filesystem image in which an inline inode contains an invalid reserved blkaddr.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html; http://packetstormsecurity.com/files/151420/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; http://www.securityfocus.com/bid/104680
CVE: CVE-2018-13100
Published: 2018-07-03
Description: An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly validate secs_per_zone in a corrupted f2fs image, as demonstrated by a divide-by-zero error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00033.html; http://packetstormsecurity.com/files/151420/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; http://www.securityfocus.com/bid/104679
CVE: CVE-2018-12255
Published: 2018-07-03
Description: An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://development.invoiceplane.com/browse/IP-707; https://github.com/V33RU/Invoice-Plane-XSS; https://development.invoiceplane.com/browse/IP-707
CVE: CVE-2018-13065
Published: 2018-07-03
Description: ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configured
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/SpiderLabs/ModSecurity/issues/1829; https://hackings8n.blogspot.com/2018/07/cve-2018-13065-modsecurity-300-has-xss.html; https://www.exploit-db.com/exploits/44970/
CVE: CVE-2018-13101
Published: 2018-07-03
Description: KioskSimpleService.exe in RedSwimmer KioskSimple 1.4.7.0 suffers from a privilege escalation vulnerability in the WCF endpoint. The exposed methods allow read and write access to the Windows registry and control of services. These methods may be abused to achieve privilege escalation via execution of attacker controlled binaries.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/VerSprite/research/blob/master/advisories/VS-2018-026.md; https://github.com/VerSprite/research/blob/master/advisories/VS-2018-026.md
CVE: CVE-2018-11746
Published: 2018-07-03
Description: In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.
CVSS Score: 8.6 (HIGH)
CWE: CWE-522
References: https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E; https://puppet.com/security/cve/CVE-2018-11746; https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE: CVE-2018-4851
Published: 2018-07-03
Description: A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could cause a Denial-of-Service condition by sending certain packets to the device, causing potential reboots of the device. The core functionality of the device could be impacted. The time serving functionality recovers when time synchronization with GPS devices or other NTP servers are completed.
CVSS Score: 8.2 (HIGH)
CWE: CWE-399, CWE-20
References: http://www.securityfocus.com/bid/104672; https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf; http://www.securityfocus.com/bid/104672
CVE: CVE-2018-4852
Published: 2018-07-03
Description: A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device could potentially circumvent the authentication mechanism if he/she is able to obtain certain knowledge specific to the attacked device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: http://www.securityfocus.com/bid/104672; https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf; http://www.securityfocus.com/bid/104672
CVE: CVE-2018-4853
Published: 2018-07-03
Description: A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to port 69/udp could modify the firmware of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: http://www.securityfocus.com/bid/104672; https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf; http://www.securityfocus.com/bid/104672
CVE: CVE-2018-4854
Published: 2018-07-03
Description: A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to port 69/udp could modify the administrative client stored on the device. If a legitimate user downloads and executes the modified client from the affected device, then he/she could obtain code execution on the client system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-306
References: http://www.securityfocus.com/bid/104672; https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf; http://www.securityfocus.com/bid/104672
CVE: CVE-2018-4855
Published: 2018-07-03
Description: A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). Unencrypted storage of passwords in the client configuration files and during network transmission could allow an attacker in a privileged position to obtain access passwords.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-311, CWE-311
References: http://www.securityfocus.com/bid/104672; https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf; http://www.securityfocus.com/bid/104672
CVE: CVE-2018-4856
Published: 2018-07-03
Description: A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with administrative access to the device's management interface could lock out legitimate users. Manual interaction is required to restore the access of legitimate users.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/104672; https://cert-portal.siemens.com/productcert/pdf/ssa-197012.pdf; http://www.securityfocus.com/bid/104672
CVE: CVE-2018-7763
Published: 2018-07-03
Description: The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The 'css' parameter contains a directory traversal vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7764
Published: 2018-07-03
Description: The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal vulnerability in the processing of the 's' parameter of the applet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7765
Published: 2018-07-03
Description: The vulnerability exists within processing of track_import_export.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the object_id input parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://seclists.org/fulldisclosure/2019/May/26; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; http://seclists.org/fulldisclosure/2019/May/26
CVE: CVE-2018-7766
Published: 2018-07-03
Description: The vulnerability exists within processing of track_getdata.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the id input parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7767
Published: 2018-07-03
Description: The vulnerability exists within processing of editobject.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the type input parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7768
Published: 2018-07-03
Description: The vulnerability exists within processing of loadtemplate.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the tpl input parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7769
Published: 2018-07-03
Description: The vulnerability exists within processing of xmlserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the id input parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7770
Published: 2018-07-03
Description: The vulnerability exists within processing of sendmail.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The applet allows callers to select arbitrary files to send to an arbitrary email address.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7771
Published: 2018-07-03
Description: The vulnerability exists within processing of editscript.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A directory traversal vulnerability allows a caller with standard user privileges to write arbitrary php files anywhere in the web service directory tree.
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7772
Published: 2018-07-03
Description: The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query to determine whether a user is logged in is subject to SQL injection on the loginSeed parameter, which can be embedded in the HTTP cookie of the request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7773
Published: 2018-07-03
Description: The vulnerability exists within processing of nfcserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the sessionid input parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7774
Published: 2018-07-03
Description: The vulnerability exists within processing of localize.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the username input parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7775
Published: 2018-07-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-9960.  Reason: This candidate is a duplicate of CVE-2017-9960.  Notes: All CVE users should reference CVE-2017-9960 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2018-7776
Published: 2018-07-03
Description: The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attacker that contains sensitive data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/
CVE: CVE-2018-7777
Published: 2018-07-03
Description: The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/156184/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html; https://www.schneider-electric.com/en/download/document/SEVD-2018-095-01/; http://packetstormsecurity.com/files/156184/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html
CVE: CVE-2018-7778
Published: 2018-07-03
Description: In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12_v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-109-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-109-01/
CVE: CVE-2018-7779
Published: 2018-07-03
Description: In Schneider Electric Wiser for KNX V2.1.0 and prior, homeLYnk V2.0.1 and prior; and spaceLYnk V2.1.0 and prior, weak and unprotected FTP access could allow an attacker unauthorized access.
CVSS Score: 7.5 (HIGH)
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-109-02/; https://www.schneider-electric.com/en/download/document/SEVD-2018-109-02/
CVE: CVE-2018-7780
Published: 2018-07-03
Description: In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerability exist in cgi program "set".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-114-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-114-01/
CVE: CVE-2018-7781
Published: 2018-07-03
Description: In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authenticated user can view password in clear text and results in privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-311
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-114-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-114-01/
CVE: CVE-2018-7782
Published: 2018-07-03
Description: In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear text.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-114-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-114-01/