High ICSA-22-055-02 3 CVEs

Mitsubishi Electric EcoWebServerIII

Published Feb 24, 2022 · Updated Feb 24, 2022

Vendor: Mitsubishi Electric Product: MES3-255C-CN Product: MES3-255C-DM-CN Product: MES3-255C-DM-EN Product: MES3-255C-EN

Summary

Successful exploitation of these vulnerabilities could allow information to be disclosed, tampered with, or result in a denial-of-service condition.

Vulnerabilities 3

Medium 6.1

CVE-2016-10735 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

twitter-bootstrap3 bootstrap twitter-bootstrap3 twbs/bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems

Jan 9, 2019
Medium 6.1

CVE-2018-14040 Public exploit

Bootstrap vulnerable to Cross-Site Scripting (XSS)

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

reaper twitter-bootstrap3 bootstrap twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2018-14042 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

ceph fluent-bit pytorch bootstrap Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018

Revision history

2022-02-24 #1
ICSA-22-055-02 Mitsubishi Electric EcoWebServerIII

References

ICS Advisory ICSA-22-055-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-055-02
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams_0905.pdf
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B