deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-7830
Published: 2019-05-22
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]9 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]5 and earlier, and 2[PII_REDACTED]3 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/108320; https://helpx.adobe.com/security/products/acrobat/apsb19-18.html; https://www.zerodayinitiative.com/advisories/ZDI-19-514/
CVE: CVE-2019-7831
Published: 2019-05-22
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]9 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]5 and earlier, and 2[PII_REDACTED]3 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/108320; https://helpx.adobe.com/security/products/acrobat/apsb19-18.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0796
CVE: CVE-2019-7832
Published: 2019-05-22
Description: Adobe Acrobat and Reader versions , 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]3 and earlier, 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]8 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb19-41.html; https://helpx.adobe.com/security/products/acrobat/apsb19-41.html
CVE: CVE-2019-7833
Published: 2019-05-22
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]9 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]5 and earlier, and 2[PII_REDACTED]3 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/108320; https://helpx.adobe.com/security/products/acrobat/apsb19-18.html; http://www.securityfocus.com/bid/108320
CVE: CVE-2019-8442
Published: 2019-05-22
Description: The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/108460; https://jira.atlassian.com/browse/JRASERVER-69241; http://www.securityfocus.com/bid/108460
CVE: CVE-2019-8443
Published: 2019-05-22
Description: The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/108458; https://jira.atlassian.com/browse/JRASERVER-69240; http://www.securityfocus.com/bid/108458
CVE: CVE-2017-9809
Published: 2019-05-22
Description: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://ox.com; https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html; http://ox.com
CVE: CVE-2018-12886
Published: 2019-05-22
Description: stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.
CVSS Score: 8.1 (HIGH)
CWE: CWE-209
References: https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup; https://www.gnu.org/software/gcc/gcc-8/changes.html; https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup
CVE: CVE-2019-7834
Published: 2019-05-22
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]9 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]5 and earlier, and 2[PII_REDACTED]3 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/108461; https://helpx.adobe.com/security/products/acrobat/apsb19-18.html; http://www.securityfocus.com/bid/108461
CVE: CVE-2019-7835
Published: 2019-05-22
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]9 and earlier, 2[PII_REDACTED]0 and earlier version, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]5 and earlier, and 2[PII_REDACTED]3 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/108320; https://helpx.adobe.com/security/products/acrobat/apsb19-18.html; http://www.securityfocus.com/bid/108320
CVE: CVE-2019-7836
Published: 2019-05-22
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]9 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]5 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/108326; https://helpx.adobe.com/security/products/acrobat/apsb19-18.html; http://www.securityfocus.com/bid/108326
CVE: CVE-2019-7837
Published: 2019-05-22
Description: Adobe Flash Player versions 32.0.0.171 and earlier, 32.0.0.171 and earlier, and 32.0.0.171 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/108312; https://access.redhat.com/errata/RHSA-2019:1234; https://helpx.adobe.com/security/products/flash-player/apsb19-26.html
CVE: CVE-2019-7841
Published: 2019-05-22
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]9 and earlier, 2[PII_REDACTED]0 and earlier, 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]5 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/108326; https://helpx.adobe.com/security/products/acrobat/apsb19-18.html; http://www.securityfocus.com/bid/108326
CVE: CVE-2019-7842
Published: 2019-05-22
Description: Adobe Media Encoder version 13.0.2 has a use-after-free vulnerability. Successful exploitation could lead to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/108317; https://helpx.adobe.com/security/products/media-encoder/apsb19-29.html; https://www.zerodayinitiative.com/advisories/ZDI-19-477/
CVE: CVE-2019-7844
Published: 2019-05-22
Description: Adobe Media Encoder version 13.0.2 has an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/108318; https://helpx.adobe.com/security/products/media-encoder/apsb19-29.html; https://www.zerodayinitiative.com/advisories/ZDI-19-476/
CVE: CVE-2017-5863
Published: 2019-05-22
Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html
CVE: CVE-2017-5864
Published: 2019-05-22
Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.8.4/release-notes/release-notes.html
CVE: CVE-2017-5871
Published: 2019-05-22
Description: Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information (remote).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: https://sysdream.com/news/lab/2017-11-20-cve-2017-5871-odoo-url-redirection-to-distrusted-site-open-redirect/; https://www.odoo.com; https://sysdream.com/news/lab/2017-11-20-cve-2017-5871-odoo-url-redirection-to-distrusted-site-open-redirect/
CVE: CVE-2017-5984
Published: 2019-05-22
Description: In libavcodec in Libav 9.21, ff_h264_execute_ref_pic_marking() has a heap-based buffer over-read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.libav.org/show_bug.cgi?id=1019; https://patches.libav.org/patch/62534/; https://bugzilla.libav.org/show_bug.cgi?id=1019
CVE: CVE-2017-6912
Published: 2019-05-22
Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.10.0/release-notes/release-notes.html
CVE: CVE-2017-8340
Published: 2019-05-22
Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Incorrect Access Control.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.10.0/release-notes/release-notes.html
CVE: CVE-2017-8341
Published: 2019-05-22
Description: Open-Xchange GmbH OX App Suite 7.8.3 and earlier is affected by: Content Spoofing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://open-xchange.com; http://ox.com; https://documentation.open-xchange.com/7.10.0/release-notes/release-notes.html
CVE: CVE-2017-8777
Published: 2019-05-22
Description: Open-Xchange GmbH OX Cloud Plugins 1.4.0 and earlier is affected by: Missing Authorization.
CVSS Score: 7.2 (HIGH)
CWE: CWE-285
References: http://open-xchange.com; http://ox.com; https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_4137_1.2.2_2017-05-12.pdf
CVE: CVE-2017-9808
Published: 2019-05-22
Description: OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://ox.com; https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html; http://ox.com
CVE: CVE-2018-7788
Published: 2019-05-22
Description: A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which could cause a Denial Of Service when using a Telnet connection.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-08/; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-08/
CVE: CVE-2018-7816
Published: 2019-05-22
Description: A Permissions, Privileges, and Access Control vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to delete an arbitrary file.
CVSS Score: 6.5 (MEDIUM)
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/; https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/
CVE: CVE-2018-7821
Published: 2019-05-22
Description: An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle time impact when flooding the M221 ethernet interface while the Ethernet/IP adapter is activated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01/; https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01/
CVE: CVE-2018-7822
Published: 2019-05-22
Description: An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause unauthorized access to SoMachine Basic resource files when logged on the system hosting SoMachine Basic.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01/; https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01/
CVE: CVE-2018-7823
Published: 2019-05-22
Description: A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause remote launch of SoMachine Basic when sending crafted ethernet message.
CVSS Score: 5.3 (MEDIUM)
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01/; https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01/
CVE: CVE-2018-7824
Published: 2019-05-22
Description: An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users with SYSTEM privilege or other important user files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-610, CWE-610
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-099-01/; https://www.schneider-electric.com/en/download/document/SEVD-2019-099-01/
CVE: CVE-2018-7825
Published: 2019-05-22
Description: A Command Injection vulnerability exists in the web-based GUI of the 1st Gen PelcoSarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/; https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/
CVE: CVE-2018-7826
Published: 2019-05-22
Description: A Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/; https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/
CVE: CVE-2018-7827
Published: 2019-05-22
Description: A Cross-Site Scripting (XSS) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which a remote attacker can execute arbitrary HTML and script code in a user’s browser session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/; https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/
CVE: CVE-2018-7828
Published: 2019-05-22
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user clicks a specially crafted malicious link while logged into the camera.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/; https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/
CVE: CVE-2018-7829
Published: 2019-05-22
Description: An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which allows an attacker to execute arbitrary system commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-943
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/; https://www.schneider-electric.com/en/download/document/SEVD-2019-045-03/
CVE: CVE-2018-7834
Published: 2019-05-22
Description: A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a specially crafted URL with an embedded script to a user that would then be executed within the context of that user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-07/; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-07/
CVE: CVE-2018-7840
Published: 2019-05-22
Description: A Uncontrolled Search Path Element (CWE-427) vulnerability exists in VideoXpert OpsCenter versions prior to 3.1 which could allow an attacker to cause the system to call an incorrect DLL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-01; https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-01
CVE: CVE-2018-7841
Published: 2019-05-22
Description: A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/152862/Schneider-Electric-U.Motion-Builder-1.3.4-Command-Injection.html; http://seclists.org/fulldisclosure/2019/May/26; https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-071-02
CVE: CVE-2018-7842
Published: 2019-05-22
Description: A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0741; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7843
Published: 2019-05-22
Description: A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading memory blocks with an invalid data size or with an invalid data offset in the controller over Modbus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0738; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7845
Published: 2019-05-22
Description: A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of unexpected data from the controller when reading specific memory blocks in the controller over Modbus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0745; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7846
Published: 2019-05-22
Description: A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0735; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7847
Published: 2019-05-22
Description: A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service or potential code execution by overwriting configuration settings of the controller over Modbus.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0742; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0743
CVE: CVE-2018-7848
Published: 2019-05-22
Description: A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading files from the controller over Modbus
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0740; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7849
Published: 2019-05-22
Description: A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a possible Denial of Service due to improper data integrity check when sending files the controller over Modbus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0737; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7850
Published: 2019-05-22
Description: A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause invalid information displayed in Unity Pro software.
CVSS Score: 5.3 (MEDIUM)
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0743; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2018-7851
Published: 2019-05-22
Description: CWE-119: Buffer errors vulnerability exists in Modicon M580 with firmware prior to V2.50, Modicon M340 with firmware prior to V3.01, BMxCRA312xx with firmware prior to V2.40, All firmware versions of Modicon Premium and 140CRA312xxx when sending a specially crafted Modbus packet, which could cause a denial of service to the device that would force a restart to restore availability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-10/; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-10/
CVE: CVE-2018-7852
Published: 2019-05-22
Description: A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when an invalid private command parameter is sent to the controller over Modbus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0763; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
CVE: CVE-2019-6812
Published: 2019-05-22
Description: A CWE-798 use of hardcoded credentials vulnerability exists in BMX-NOR-0200H with firmware versions prior to V1.7 IR 19 which could cause a confidentiality issue when using FTP protocol.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798, CWE-798
References: https://security.cse.iitk.ac.in/responsible-disclosure; https://www.schneider-electric.com/en/download/document/SEVD-2019-134-06/; https://security.cse.iitk.ac.in/responsible-disclosure