rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-7772 
The vulnerability exists within processing of applets which are exposed on the web service in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query to determine whether a user is logged in is subject to SQL injection on the loginSeed parameter, which can be embedded in the HTTP cookie of the request.
Problem types: description: SQL Injection Remote Code Execution
Affected products: vendor: Schneider Electric SE
product: U.Motion
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7773 
The vulnerability exists within processing of nfcserver.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the sessionid input parameter.
Problem types: description: SQL Injection Remote Code Execution
Affected products: vendor: Schneider Electric SE
product: U.Motion
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7774 
The vulnerability exists within processing of localize.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the username input parameter.
Problem types: description: SQL Injection Remote Code Execution
Affected products: vendor: Schneider Electric SE
product: U.Motion
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7776 
The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attacker that contains sensitive data.
Problem types: description: Remote Code Execution
Affected products: vendor: Schneider Electric SE
product: U.Motion
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7777 
The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target server.
Problem types: description: Samba Remote Code Execution
Affected products: vendor: Schneider Electric SE
product: U.Motion
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7778 
In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12_v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users.
Problem types: description: Cookie Modification Privilege Escalation
Affected products: vendor: Schneider Electric SE
product: Evlink Charging Station
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7779 
In Schneider Electric Wiser for KNX V2.1.0 and prior, homeLYnk V2.0.1 and prior; and spaceLYnk V2.1.0 and prior, weak and unprotected FTP access could allow an attacker unauthorized access.
Problem types: description: Weak and unprotected FTP access
Affected products: vendor: Schneider Electric SE
product: Wiser for KNX
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7780 
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, a buffer overflow vulnerability exist in cgi program "set".
Problem types: description: Buffer Overflow
Affected products: vendor: Schneider Electric SE
product: Pelco Sarix Professional V1
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7781 
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, by sending a specially crafted request an authenticated user can view password in clear text and results in privilege escalation.
Problem types: description: Authenticated password disclosure and privilege escalation
Affected products: vendor: Schneider Electric SE
product: Pelco Sarix Professional V1
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7782 
In Schneider Electric Pelco Sarix Professional 1st generation cameras with firmware versions prior to 3.29.69, authenticated users can view passwords in clear text.
Problem types: description: Authenticated password disclosure
Affected products: vendor: Schneider Electric SE
product: Pelco Sarix Professional V1
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7783 
Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.
Problem types: description: Out-Of-Band Remote Arbitrary Data Retrieval
Affected products: vendor: Schneider Electric SE
product: SoMachine Basic
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7784 
In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data of an input string is evaluated as a command by the application. In this way, the attacker could execute code, read the stack, or cause a segmentation fault in the running application.
Problem types: description: Print Format Vulnerability
Affected products: vendor: Schneider Electric SE
product: U.motion Builder
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7785 
In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass.
Problem types: description: Remote Command Injection
Affected products: vendor: Schneider Electric SE
product: U.motion Builder
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7786 
In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability exists which could allow injection of malicious scripts.
Problem types: description: Cross Site Scripting
Affected products: vendor: Schneider Electric SE
product: U.motion Builder
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7787 
In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTTP GET request.
Problem types: description: Improper Input Validation
Affected products: vendor: Schneider Electric SE
product: U.motion Builder
Published: 2018-07-03T14:00:00.000Z
CVE-2018-7788 
A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which could cause a Denial Of Service when using a Telnet connection.
Problem types: cwe_id: CWE-255
description: CWE-255: Credentials Management
Affected products: vendor: n/a
product: Modicon Quantum with firmware versions prior to V2.40.
Published: 2019-05-22T19:50:21.000Z
CVE-2018-7789 
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to remotely reboot Modicon M221 using crafted programing protocol frames.
Problem types: description: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Schneider Electric SE
product: Modicon M221, all references, all versions prior to firmware V1.6.2.0
Published: 2018-08-29T20:00:00.000Z
CVE-2018-7790 
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to replay authentication sequences. If an attacker exploits this vulnerability and connects to a Modicon M221, the attacker can upload the original program from the PLC.
Problem types: description: Information Management Error
Affected products: vendor: Schneider Electric SE
product: Modicon M221, all references, all versions prior to firmware V1.6.2.0
Published: 2018-08-29T21:00:00.000Z
CVE-2018-7791 
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to overwrite the original password with their password. If an attacker exploits this vulnerability and overwrite the password, the attacker can upload the original program from the PLC.
Problem types: description: Permissions, Privileges, and Access Control
Affected products: vendor: Schneider Electric SE
product: Modicon M221, all references, all versions prior to firmware V1.6.2.0
Published: 2018-08-29T21:00:00.000Z
CVE-2018-7792 
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to decode the password using rainbow table.
Problem types: description: Permissions, Privileges, and Access Control
Affected products: vendor: Schneider Electric SE
product: Modicon M221, all references, all versions prior to firmware V1.6.2.0
Published: 2018-08-29T21:00:00.000Z
CVE-2018-7793 
A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro DCS Control Core Services 9.4 (CCS 9.4) and FoxView 10.5.) which could cause unauthorized disclosure, modification, or disruption in service when the password is modified without permission.
Problem types: description: Credential Management
Affected products: vendor: Schneider Electric SE
product: FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro DCS Control Core Services 9.4 (CCS 9.4) and FoxView 10.5.)
Published: 2018-12-24T16:00:00.000Z
CVE-2018-7794 
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) which could cause a Denial of Service when reading data with invalid index using Modbus TCP.
Problem types: cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Schneider Electric SE
product: Modicon M580, Modicon M340, Modicon Quantum,  Modicon Premium (see security notification for specific versions)
Published: 2020-01-06T22:57:09.000Z
CVE-2018-7795 
A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.
Problem types: description: Cross Protocol Injection
Affected products: vendor: Schneider Electric SE
product: PowerLogic - PM5560 prior to FW version 2.5.4
Published: 2018-08-29T20:00:00.000Z
CVE-2018-7796 
A Buffer Error vulnerability exists in PowerSuite 2, all released versions (VW3A8104 & Patches), which could cause an overflow in the memcpy function, leading to corruption of data and program instability.
Problem types: description: Buffer Error
Affected products: vendor: Schneider Electric SE
product: PowerSuite 2, All released versions (VW3A8104 & Patches)
Published: 2018-12-24T16:00:00.000Z
CVE-2018-7797 
A URL redirection vulnerability exists in Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxure Energy Expert 1.3 (formerly Power Manager), EcoStruxure Power SCADA Operation (PSO) 8.2 Advanced Reports and Dashboards Module, EcoStruxure Power Monitoring Expert (PME) v9.0, EcoStruxure Energy Expert v2.0, and EcoStruxure Power SCADA Operation (PSO) 9.0 Advanced Reports and Dashboards Module which could cause a phishing attack when redirected to a malicious site.
Problem types: description: URL redirection
Affected products: vendor: Schneider Electric SE
product: Power Monitoring Expert, Energy Expert (formerly Power Manager) - EcoStruxure&#xaa; Power Monitoring Expert (PME) v8.2 (all editions), EcoStruxure&#xaa; Energy Expert 1.3 (formerly Power Manager), EcoStruxure&#xaa; Power SCADA Operation (PSO) 8.2 Advanced Reports and Dashboards Module, EcoStruxure&#xaa; Power Monitoring Expert (PME) v9.0, EcoStruxure&#xaa; Energy Expert v2.0, and EcoStruxure&#xaa;Power SCADA Operation (PSO) 9.0 Advanced Reports and Dashboards Module
Published: 2018-12-17T22:00:00.000Z
CVE-2018-7798 
A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration (IP address, mask and gateway) when remotely connected to the device.
Problem types: description: Insufficient Verification of Data Authenticity
Affected products: vendor: Schneider Electric SE
product: Modicon M221, All Versions
Published: 2018-11-02T17:00:00.000Z
CVE-2018-7799 
A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attacker to execute arbitrary code on the targeted system when placing a specific DLL file.
Problem types: description: DLL hijacking vulnerability
Affected products: vendor: Schneider Electric SE
product: Schneider Electric Software Update (SESU), all versions prior to V2.2.0
Published: 2018-11-02T17:00:00.000Z
CVE-2018-7800 
A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device.
Problem types: description: Hard-coded Credentials
Affected products: vendor: Schneider Electric SE
product: EVLink Parking v3.2.0-12_v1 and earlier
Published: 2018-12-24T16:00:00.000Z
CVE-2018-7801 
A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when a remote code execution is performed.
Problem types: description: Code Injection
Affected products: vendor: Schneider Electric SE
product: EVLink Parking v3.2.0-12_v1 and earlier
Published: 2018-12-24T16:00:00.000Z
CVE-2018-7802 
A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full privileges.
Problem types: description: SQL Injection v
Affected products: vendor: Schneider Electric SE
product: EVLink Parking v3.2.0-12_v1 and earlier
Published: 2018-12-24T16:00:00.000Z
CVE-2018-7803 
A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TriStation Emulator V1.2.0, which could cause the emulator to crash when sending a specially crafted packet. The emulator is used infrequently for application logic testing. It is susceptible to an attack only while running in off-line mode. This vulnerability does not exist in Triconex hardware products and therefore has no effect on the operating safety functions in a plant.
Problem types: description: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: n/a
product: Triconex TriStation Emulator V1.2.0
Published: 2019-05-22T20:08:29.000Z
CVE-2018-7804 
A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user clicking on a specially crafted link can be redirected to a URL of the attacker's choosing.
Problem types: description: URL Redirection to Untrusted Site
Affected products: vendor: Schneider Electric SE
product: Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
Published: 2018-12-17T22:00:00.000Z
CVE-2018-7806 
Data Center Operation allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could allow for the arbitrary upload of files contained with the zip onto the server file system outside of the intended directory. This is leveraging the more commonly known ZipSlip vulnerability within Java code.
Problem types: description: Path Traversal
Affected products: vendor: Schneider Electric SE
product: Data Center Operation all versions
Published: 2018-11-30T19:00:00.000Z
CVE-2018-7807 
Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the server. A carefully crafted, malicious file could be mistakenly uploaded by an authenticated user via this feature which could contain path traversal file names. As such, it could allow for the arbitrary upload of files contained with the zip onto the server file system outside of the intended directory. This is leveraging the more commonly known ZipSlip vulnerability within Java code.
Problem types: description: Path Traversal
Affected products: vendor: Schneider Electric SE
product: Data Center Expert versions 7.5.0 and earlier
Published: 2018-11-30T19:00:00.000Z
CVE-2018-7809 
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web server.
Problem types: description: Unverified Password Change
Affected products: vendor: Schneider Electric SE
product: Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
Published: 2018-11-30T19:00:00.000Z
CVE-2018-7810 
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browser, potentially impacting the machine the browser is running on.
Problem types: description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Schneider Electric SE
product: Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
Published: 2018-11-30T19:00:00.000Z
CVE-2018-7811 
An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web server
Problem types: description: Unverified Password Change
Affected products: vendor: Schneider Electric SE
product: Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
Published: 2018-11-30T19:00:00.000Z
CVE-2018-7812 
An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where the web server sends different responses in a way that exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Problem types: description: Information Exposure Through Discrepancy
Affected products: vendor: Schneider Electric SE
product: Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200
Published: 2018-12-17T22:00:00.000Z
CVE-2018-7813 
A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pcwin.dll which could cause remote code to be executed when parsing a GD1 file
Problem types: description: Type Confusion
Affected products: vendor: Schneider Electric SE
product: Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0)
Published: 2019-02-06T23:00:00.000Z
CVE-2018-7814 
A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) which could cause remote code to be executed when parsing a GD1 file
Problem types: description: Stack-based Buffer Overflow
Affected products: vendor: Schneider Electric SE
product: Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0)
Published: 2019-02-06T23:00:00.000Z
CVE-2018-7815 
A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3core.dll which could cause remote code to be executed when parsing a GD1 file
Problem types: description: Type Confusion
Affected products: vendor: Schneider Electric SE
product: Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0)
Published: 2019-02-06T23:00:00.000Z
CVE-2018-7816 
A Permissions, Privileges, and Access Control vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to delete an arbitrary file.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: Pelco
product: Pelco Sarix Enhanced and Spectra Enhanced, Pelco Sarix Enhanced 1st generation and Spectra Enhanced PTZ
Published: 2019-05-22T19:30:57.000Z
CVE-2018-7817 
A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafted Zelio Soft project file.
Problem types: cwe_id: CWE-416
description: Use After Free (CWE-416)
Affected products: vendor: Schneider Electric SE
product: Zelio Soft 2 v5.1 and prior versions
Published: 2019-02-06T23:00:00.000Z
CVE-2018-7820 
A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled, and then disabled.
Problem types: cwe_id: CWE-255
description: CWE-255:Credentials Management
Affected products: vendor: Schneider Electric SE
product: APC UPS Network Management Card 2 AOS
Published: 2019-09-17T19:45:32.000Z
CVE-2018-7821 
An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle time impact when flooding the M221 ethernet interface while the Ethernet/IP adapter is activated.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: SoMachine Basic and Modicon M221, SoMachine Basic, all versions Modicon M221, all references, all versions prior to firmware V1.10.0.0
Published: 2019-05-22T19:36:47.000Z
CVE-2018-7822 
An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause unauthorized access to SoMachine Basic resource files when logged on the system hosting SoMachine Basic.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: SoMachine Basic and Modicon M221, SoMachine Basic, all versions Modicon M221, all references, all versions prior to firmware V1.10.0.0
Published: 2019-05-22T19:37:16.000Z
CVE-2018-7823 
A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause remote launch of SoMachine Basic when sending crafted ethernet message.
Problem types: description: Multiple Vulnerabilities
Affected products: vendor: n/a
product: SoMachine Basic and Modicon M221, SoMachine Basic, all versions Modicon M221, all references, all versions prior to firmware V1.10.0.0
Published: 2019-05-22T19:37:45.000Z
CVE-2018-7824 
An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users with SYSTEM privilege or other important user files.
Problem types: cwe_id: CWE-610
description: Externally Controlled Reference to a Resource (CWE-610)
Affected products: vendor: Schneider
product: Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior)
Published: 2019-05-22T19:27:44.000Z