Most recent entries from all

certfr-2018-avi-172 — De multiples vulnérabilités ont été découvertes dans SCADA les produits Schneider Electric. Elles permettent à un attaq…

certfr-2018-avi-172

cnvd-2018-07817

EUVD-2026-180927

fkie_cve-2018-7764

The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal vulnerability in the processing of the 's' parameter of the applet.

GHSA-83v7-6jhf-qmq9

gsd-2018-7764

ICSA-17-180-02 — Schneider Electric U.motion Builder (Update A)

Unauthenticated users can use calls to various paths in order to perform arbitrary SQL statements against the underlying database.CVE-2017-7973 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability exists within processing of track_import_export.php. The underlying SQLite database query is subject to SQL injection on the object_id input parameter.CVE-2018-7765 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The vulnerability exists within processing of track_getdata.php. The underlying SQLite database query is subject to SQL injection on the id input parameter.CVE-2018-7766 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerability exists within processing of editobject.php. The underlying SQLite database query is subject to SQL injection on the type input parameter.CVE-2018-7767 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerability exists within processing of loadtemplate.php. The underlying SQLite database query is subject to SQL injection on the tpl input parameter.CVE-2018-7768 has been assigned to this vulnerability. A CVSS v3…

SEVD-2018-095-01 — Security Notification - U.motion Builder software

Schneider Electric is aware of an exploit that targets Schneider Electric’s U.motion Builder software. It is imperative customers cease using U.motion Builder software and remove it from their systems immediately.