U.motion Builder

CVEs (26)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2018-7787	Schneider Electric U.motion Builder	Med	0.35	5.3	0.01		Jul 3, 2018	In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTTP GET request.
CVE-2017-9960	Schneider Electric U.motion Builder	Med	0.35	5.3	0.01		Sep 26, 2017	An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system response to error provides more information than should be available to an unauthenticated user.
CVE-2018-7776	Schneider Electric U.motion Builder	Med	0.28	4.3	0.01		Jul 3, 2018	The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attacker that contains sensitive data.
CVE-2018-7764	Schneider Electric U.motion Builder	Med	0.28	4.3	0.01		Jul 3, 2018	The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal vulnerability in the processing of the 's' parameter of the applet.
CVE-2018-7763	Schneider Electric U.motion Builder	Med	0.28	4.3	0.01		Jul 3, 2018	The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The 'css' parameter contains a directory traversal vulnerability.
CVE-2018-7841	U.motion U.motion Builder Software Version 1.3.4		0.19	—	0.72	KEV	May 22, 2019	A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

CVE-2018-7787MedJul 3, 2018
Schneider Electric
U.motion Builder
risk 0.35cvss 5.3epss 0.01
In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTTP GET request.
CVE-2017-9960MedSep 26, 2017
Schneider Electric
U.motion Builder
risk 0.35cvss 5.3epss 0.01
An information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system response to error provides more information than should be available to an unauthenticated user.
CVE-2018-7776MedJul 3, 2018
Schneider Electric
U.motion Builder
risk 0.28cvss 4.3epss 0.01
The vulnerability exists within error.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. System information is returned to the attacker that contains sensitive data.
CVE-2018-7764MedJul 3, 2018
Schneider Electric
U.motion Builder
risk 0.28cvss 4.3epss 0.01
The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal vulnerability in the processing of the 's' parameter of the applet.
CVE-2018-7763MedJul 3, 2018
Schneider Electric
U.motion Builder
risk 0.28cvss 4.3epss 0.01
The vulnerability exists within css.inc.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The 'css' parameter contains a directory traversal vulnerability.
CVE-2018-7841KEVMay 22, 2019
U.motion
U.motion Builder Software Version 1.3.4
risk 0.19cvss —epss 0.72
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Page 2 of 2