Most recent entries from all

bdu:2021-01790

2026-10-04T08:23:05.512215+00:00

bdu:2021-01790

certfr-2020-avi-726 — De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permetten…

2026-10-04T08:23:05.512251+00:00

certfr-2020-avi-726

cnvd-2021-29455

2026-10-04T08:23:05.512272+00:00

cnvd-2021-29455

EUVD-2026-37982

2026-10-04T08:23:05.512285+00:00

EUVD-2026-37982

fkie_cve-2020-7570

2026-10-04T08:23:05.512297+00:00

A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users.

GHSA-95w2-x8cx-c96f

2026-10-04T08:23:05.512326+00:00

gsd-2020-7570

2026-10-04T08:23:05.512343+00:00

gsd-2020-7570

ICSA-21-063-02 — ICSA-21-063-02_Schneider Electric EcoStruxure Building Operation (EBO)

2026-10-04T08:23:05.512353+00:00

An unrestricted upload of a file with dangerous type vulnerability could allow an authenticated remote user to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution.CVE-2020-7569 has been assigned to this vulnerability. A CVSS v3 base score of 4.6 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L). An improper neutralization of an input during webpage generation vulnerability could allow an authenticated remote user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a stored cross-site scripting attack against other WebReport users.CVE-2020-7570 has been assigned to this vulnerability. A CVSS v3 base score of 6.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L). Multiple improper neutralizations of an input during webpage generation vulnerabilities could allow a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a reflected cross-site scripting attack against other WebReport users.CVE-2020-7571 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). An improper restriction of XML external entity reference vulnerability could allow an authenticated remote user to inject arbitrary XML code and obtain disclosure of confidential data, cause…

SEVD-2020-315-04 — EcoStruxure Building Operation (EBO)

2026-10-04T08:23:05.512400+00:00

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Building Operation (EBO) product offerings. More information on the product line can be found at the following link: https://www.se.com/ww/en/product-range-presentation/62111-ecostruxure%E2%84%A2- building-operation/?parent-subcategory-id=1210&filter=business-2-building-automation-andcontrol#tabs-top Failure to apply the mitigations/remediations provided below may risk various types of attacks and cause various types of impact (see information below for each vulnerability).