deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-3750
Published: 2017-06-29
Description: On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3749.
CVSS Score: 6.4 (MEDIUM)
References: https://support.lenovo.com/us/en/product_security/LEN-15823; https://support.lenovo.com/us/en/product_security/LEN-15823
CVE: CVE-2017-2844
Published: 2017-06-29
Description: In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/99184; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0346; http://www.securityfocus.com/bid/99184
CVE: CVE-2017-2845
Published: 2017-06-29
Description: An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SMTP configuration tests resulting in command execution
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/99184; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0347; http://www.securityfocus.com/bid/99184
CVE: CVE-2017-2846
Published: 2017-06-29
Description: In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/99184; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0348; http://www.securityfocus.com/bid/99184
CVE: CVE-2017-2847
Published: 2017-06-29
Description: In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/99184; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0349; http://www.securityfocus.com/bid/99184
CVE: CVE-2017-2848
Published: 2017-06-29
Description: In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/99184; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0350; http://www.securityfocus.com/bid/99184
CVE: CVE-2017-2849
Published: 2017-06-29
Description: In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during NTP server configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/99184; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0351; http://www.securityfocus.com/bid/99184
CVE: CVE-2017-2850
Published: 2017-06-29
Description: In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot restrictions in the FTP server. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/99184; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0352; http://www.securityfocus.com/bid/99184
CVE: CVE-2017-2851
Published: 2017-06-29
Description: In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can cause a buffer overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-120
References: http://www.securityfocus.com/bid/99190; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0353; http://www.securityfocus.com/bid/99190
CVE: CVE-2017-4997
Published: 2017-06-29
Description: EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/540783/30/0/threaded; http://www.securityfocus.com/bid/99169; http://www.securityfocus.com/archive/1/540783/30/0/threaded
CVE: CVE-2017-10678
Published: 2017-06-29
Description: Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/99383; https://github.com/Piwigo/Piwigo/commit/03a8329b89c0d196ecdb54227a8113f24555ffc0; https://github.com/Piwigo/Piwigo/issues/721
CVE: CVE-2017-10679
Published: 2017-06-29
Description: Piwigo through 2.9.1 allows remote attackers to obtain sensitive information about the descriptive name of a permalink by examining the redirect URL that is returned in a request for the permalink ID number of a private album. The permalink ID numbers are easily guessed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/99380; https://github.com/Piwigo/Piwigo/issues/721; https://github.com/Piwigo/Piwigo/issues/723
CVE: CVE-2017-10680
Published: 2017-06-29
Description: Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to change a private album to public via a crafted request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/99349; https://github.com/Piwigo/Piwigo/commit/03a8329b89c0d196ecdb54227a8113f24555ffc0; https://github.com/Piwigo/Piwigo/issues/721
CVE: CVE-2017-10681
Published: 2017-06-29
Description: Cross-site request forgery (CSRF) vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to unlock albums via a crafted request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/99362; https://github.com/Piwigo/Piwigo/commit/03a8329b89c0d196ecdb54227a8113f24555ffc0; https://github.com/Piwigo/Piwigo/issues/721
CVE: CVE-2017-10682
Published: 2017-06-29
Description: SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/99357; https://github.com/Piwigo/Piwigo/commit/3dd[PII_REDACTED]a199564e63fffd0a9754010b9e0; https://github.com/Piwigo/Piwigo/issues/724
CVE: CVE-2017-10683
Published: 2017-06-29
Description: In mpg123 1.25.0, there is a heap-based buffer over-read in the convert_latin1 function in libmpg123/id3.c. A crafted input will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1465819; https://bugzilla.redhat.com/show_bug.cgi?id=1465819
CVE: CVE-2017-10684
Published: 2017-06-29
Description: In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1464687; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2017-10685
Published: 2017-06-29
Description: In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: https://bugzilla.redhat.com/show_bug.cgi?id=1464692; https://security.gentoo.org/glsa/201804-13; https://bugzilla.redhat.com/show_bug.cgi?id=1464692
CVE: CVE-2017-10686
Published: 2017-06-29
Description: In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. The related heap is allocated in the token() function and freed in the detoken() function (called by pp_getline()) - it is used again at multiple positions later that could cause multiple damages. For example, it causes a corrupted double-linked list in detoken(), a double free or corruption in delete_Token(), and an out-of-bounds write in detoken(). It has a high possibility to lead to a remote code execution attack.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.nasm.us/show_bug.cgi?id=3392414; https://security.gentoo.org/glsa/201903-19; https://usn.ubuntu.com/3694-1/
CVE: CVE-2017-10687
Published: 2017-06-29
Description: In LibSass 3.4.5, there is a heap-based buffer over-read in the function json_mkstream() in sass_context.cpp. A crafted input will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1466411; https://bugzilla.redhat.com/show_bug.cgi?id=1466411
CVE: CVE-2017-10688
Published: 2017-06-29
Description: In LibTIFF 4.0.8, there is a assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted input will lead to a remote denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://bugzilla.maptools.org/show_bug.cgi?id=2712; http://www.debian.org/security/2017/dsa-3903; http://www.securityfocus.com/bid/99359
CVE: CVE-2016-9358
Published: 2017-06-30
Description: A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Cam v132, IPM3 Dual Cam v139, IPM3 Single Cam v132, P520, P574, SensorX13 QC flow line, SensorX23 QC Master, SensorX23 QC Slave, Speed Batcher, T374, T377, V36, V36B, and V36C; M3210 terminal associated with the same systems as the M3000 terminal identified above; M3000 desktop software associated with the same systems as the M3000 terminal identified above; MAC4 controller associated with the same systems as the M3000 terminal identified above; SensorX23 X-ray machine; SensorX25 X-ray machine; and MWS2 weighing system. The end user does not have the ability to change system passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: http://www.securityfocus.com/bid/97388; https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02; http://www.securityfocus.com/bid/97388
CVE: CVE-2017-6017
Published: 2017-06-30
Description: A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP341000, BMXP342000, BMXP3420102, BMXP3420102CL, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H. A remote attacker could send a specially crafted set of packets to the PLC causing it to freeze, requiring the operator to physically press the reset button on the PLC in order to recover.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://www.securityfocus.com/bid/96414; https://ics-cert.us-cert.gov/advisories/ICSA-17-054-03; https://www.schneider-electric.com/en/download/document/SEVD-2017-048-02/
CVE: CVE-2017-6018
Published: 2017-06-30
Description: An open redirect issue was discovered in B. Braun Medical SpaceCom module, which is integrated into the SpaceStation docking station: SpaceStation with SpaceCom module (integrated as part number 8713142U), software versions prior to Version 012U000040, and SpaceStation (part number 8713140U) with installed SpaceCom module (part number 8713160U), software versions prior to Version 012U000040. The web server of the affected product accepts untrusted input which could allow attackers to redirect the request to an unintended URL contained within untrusted input.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-02; https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-02
CVE: CVE-2017-6022
Published: 2017-06-30
Description: A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Version 1.0.51 and prior versions. They use hard-coded passwords to access the BD Kiestra Database, which could be leveraged to compromise the confidentiality of limited PHI/PII information stored in the BD Kiestra Database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: http://www.securityfocus.com/bid/97057; https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-01; http://www.securityfocus.com/bid/97057
CVE: CVE-2017-6026
Published: 2017-06-30
Description: A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-330, CWE-330
References: http://www.securityfocus.com/bid/97254; https://ics-cert.us-cert.gov/advisories/ICSA-17-089-02; https://www.exploit-db.com/exploits/45918/
CVE: CVE-2017-6028
Published: 2017-06-30
Description: An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials could then be used to log into the web application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522, CWE-522
References: http://www.securityfocus.com/bid/97254; https://ics-cert.us-cert.gov/advisories/ICSA-17-089-02; http://www.securityfocus.com/bid/97254
CVE: CVE-2017-6030
Published: 2017-06-30
Description: A Predictable Value Range from Previous Values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The affected products generate insufficiently random TCP initial sequence numbers that may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-343, CWE-331
References: http://www.securityfocus.com/bid/97254; https://ics-cert.us-cert.gov/advisories/ICSA-17-089-02; http://www.securityfocus.com/bid/97254
CVE: CVE-2017-6032
Published: 2017-06-30
Description: A Violation of Secure Design Principles issue was discovered in Schneider Electric Modicon Modbus Protocol. The Modicon Modbus protocol has a session-related weakness making it susceptible to brute-force attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-657, CWE-358
References: http://www.securityfocus.com/bid/97562; https://ics-cert.us-cert.gov/advisories/ICSA-17-101-01; http://www.securityfocus.com/bid/97562
CVE: CVE-2017-6034
Published: 2017-06-30
Description: An Authentication Bypass by Capture-Replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294, CWE-287
References: http://www.securityfocus.com/bid/97562; https://ics-cert.us-cert.gov/advisories/ICSA-17-101-01; http://www.securityfocus.com/bid/97562
CVE: CVE-2017-6036
Published: 2017-06-30
Description: A Server-Side Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web server receives a request, but does not sufficiently verify that the request is being sent to the expected destination.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://ics-cert.us-cert.gov/advisories/ICSA-17-026-02A; https://ics-cert.us-cert.gov/advisories/ICSA-17-026-02A
CVE: CVE-2017-6038
Published: 2017-06-30
Description: A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://ics-cert.us-cert.gov/advisories/ICSA-17-026-02A; https://ics-cert.us-cert.gov/advisories/ICSA-17-026-02A
CVE: CVE-2017-6040
Published: 2017-06-30
Description: An Information Exposure issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. Non-sensitive information can be obtained anonymously.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-17-026-02A; https://ics-cert.us-cert.gov/advisories/ICSA-17-026-02A
CVE: CVE-2017-6041
Published: 2017-06-30
Description: An Unrestricted Upload issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Cam v132, IPM3 Dual Cam v139, IPM3 Single Cam v132, P520, P574, SensorX13 QC flow line, SensorX23 QC Master, SensorX23 QC Slave, Speed Batcher, T374, T377, V36, V36B, and V36C; M3210 terminal associated with the same systems as the M3000 terminal identified above; M3000 desktop software associated with the same systems as the M3000 terminal identified above; MAC4 controller associated with the same systems as the M3000 terminal identified above; SensorX23 X-ray machine; SensorX25 X-ray machine; and MWS2 weighing system. This vulnerability allows an attacker to modify the operation and upload firmware changes without detection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://www.securityfocus.com/bid/97388; https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02; http://www.securityfocus.com/bid/97388
CVE: CVE-2017-6042
Published: 2017-06-30
Description: A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a client into making an unintentional request to the web server that will be treated as an authentic request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/98036; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02; http://www.securityfocus.com/bid/98036
CVE: CVE-2017-6044
Published: 2017-06-30
Description: An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Several files and directories can be accessed without authentication, which may allow a remote attacker to perform sensitive functions including arbitrary file upload, file download, and device reboot.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285, CWE-306
References: http://www.securityfocus.com/bid/98036; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02; http://www.securityfocus.com/bid/98036
CVE: CVE-2017-6046
Published: 2017-06-30
Description: An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and AirLink Raven XT, all versions prior to 4.0.11. Sensitive information is insufficiently protected during transmission and vulnerable to sniffing, which could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-200
References: http://www.securityfocus.com/bid/98036; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-02; http://www.securityfocus.com/bid/98036
CVE: CVE-2017-7898
Published: 2017-06-30
Description: An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. There are no penalties for repeatedly entering incorrect passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: http://www.securitytracker.com/id/1038546; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04; http://www.securitytracker.com/id/1038546
CVE: CVE-2017-7899
Published: 2017-06-30
Description: An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. User credentials are sent to the web server using the HTTP GET method, which may result in the credentials being logged. This could make user credentials available for unauthorized retrieval.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-200
References: http://www.securitytracker.com/id/1038546; https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04; http://www.securitytracker.com/id/1038546