CVE-2015-0996

LowCVSS 2.1/10Last modified Jun 17, 2026

Description

Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.

Metrics

CVSS 2.0 2.1/10AV:L/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Mar 29, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-09975.0Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMICVE-2015-09983.3Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit clearCVE-2015-09992.1Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartexCVE-2015-10006.8Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCCVE-2015-10000009.8Remote file upload vulnerability in mailcwp v1.99 wordpress pluginCVE-2015-10000019.8Remote file upload vulnerability in fast-image-adder v1.1 Wordpress pluginCVE-2015-10000028.2Open Proxy in filedownload v1.4 wordpress pluginCVE-2015-10000039.8Blind SQL Injection in filedownload v1.4 wordpress pluginCVE-2015-10000046.1XSS in filedownload v1.4 wordpress pluginCVE-2015-10000057.5Remote file download vulnerability in candidate-application-form v1.0 wordpress pluginCVE-2015-10000067.5Remote file download vulnerability in recent-backups v0.7 wordpress pluginCVE-2015-10000077.5Remote file download vulnerability in wptf-image-gallery v1.03