CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 104395 | CVE-2017-7575 | Candidate | Schneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a x00x01x00x00x00x05x01x5ax00x03x00 request to the Modbus port (502/tcp). Subsequently the application may be arbitrarily downloaded, modified, and uploaded. | Assigned (20170406) | None (candidate not yet proposed) | View | |
| 104394 | CVE-2017-7574 | Candidate | Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product. | Assigned (20170406) | None (candidate not yet proposed) | View | |
| 104393 | CVE-2017-7573 | Candidate | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. | Assigned (20170406) | None (candidate not yet proposed) | View | |
| 104392 | CVE-2017-7572 | Candidate | The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use). With this authorization method, the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status, by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester. | Assigned (20170406) | None (candidate not yet proposed) | View | |
| 104391 | CVE-2017-7571 | Candidate | public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges. | Assigned (20170406) | None (candidate not yet proposed) | View |
Page 65 of 20943, showing 5 records out of 104715 total, starting on record 321, ending on 325
