xylem records

7 published records for vendor xylem.

Researcher profile

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

7 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
41Plan	CVE-2020-25176No exploit	Rockwell Automation ISaGRAF5 Runtime Relative Path Traversalschneider-electric · easergy t300 firmware · CWE-23 pre-auth RCE Path traversal	Critical9.8	—	6.4%	Mar 18, 2022
40Plan	CVE-2021-41063No exploit	SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackexylem · aanderaa geoview · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	2.0%	Dec 8, 2021
36Monitor	CVE-2020-25178No exploit	Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Informationschneider-electric · easergy t300 firmware · CWE-319 Pre-auth Weak crypto	High8.8	—	1.7%	Mar 18, 2022
35Monitor	CVE-2021-42833No exploit	Use of hardcoded credentials impacting AquaView versions 1.60, 7.x, 8.xxylem · aquaview · CWE-798 Hard-coded credentials	High8.8	—	0.2%	Feb 7, 2022
26Monitor	CVE-2020-25180No exploit	Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Keyschneider-electric · easergy t300 firmware · CWE-321 Pre-auth Hard-coded credentials	Medium6.5	—	1.2%	Mar 18, 2022
26Monitor	CVE-2020-25182No exploit	Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Elementschneider-electric · easergy t300 firmware · CWE-427 RCE	Medium6.7	—	0.4%	Mar 18, 2022
22Monitor	CVE-2020-25184No exploit	Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentialsschneider-electric · easergy t300 firmware · CWE-256	Medium5.5	—	0.4%	Mar 18, 2022

CVE-2020-25176
41Plan
Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal
CriticalCVSS 9.8No exploitEPSS 6%
- pre-auth RCE
- Path traversal
schneider-electric · easergy t300 firmwareMar 18, 2022
CVE-2021-41063
40Plan
SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attacke
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- SQL injection
xylem · aanderaa geoviewDec 8, 2021
CVE-2020-25178
36Monitor
Rockwell Automation ISaGRAF5 Runtime Cleartext Transmission of Sensitive Information
HighCVSS 8.8No exploitEPSS 2%
- Pre-auth
- Weak crypto
schneider-electric · easergy t300 firmwareMar 18, 2022
CVE-2021-42833
35Monitor
Use of hardcoded credentials impacting AquaView versions 1.60, 7.x, 8.x
HighCVSS 8.8No exploitEPSS 0%
- Hard-coded credentials
xylem · aquaviewFeb 7, 2022
CVE-2020-25180
26Monitor
Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
- Hard-coded credentials
schneider-electric · easergy t300 firmwareMar 18, 2022
CVE-2020-25182
26Monitor
Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element
MediumCVSS 6.7No exploitEPSS 0%
- RCE
schneider-electric · easergy t300 firmwareMar 18, 2022
CVE-2020-25184
22Monitor
Rockwell Automation ISaGRAF5 Runtime Unprotected Storage of Credentials
MediumCVSS 5.5No exploitEPSS 0%
schneider-electric · easergy t300 firmwareMar 18, 2022