Summary
SINEC NMS before V2.0 SP1 is affected by multiple vulnerabilities.
Siemens has released an update for SINEC NMS and recommends to update to the latest version.
Vulnerabilities 62
-
Critical 9.8
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…
-
Critical 9.8
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an att…
-
Critical 9.8
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition f…
-
High 8.8
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly r…
-
High 8.8
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This …
-
High 8.8
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the poli…
-
High 8.8
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…
-
High 8.8
A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application is vulnerable to S…
-
High 8.8
A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application allows users to up…
-
High 8.0
A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application incorrectly neutra…
-
High 7.7
An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH c…
-
High 7.7
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This …
-
High 7.5CVE-2022-4450 EPSS 29%
Double free after calling PEM_read_bio_ex
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to…
-
High 7.5
Use-after-free following BIO_new_NDEF
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.…
-
High 7.5
Invalid pointer dereference in d2i_PKCS7 functions
An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denia…
-
High 7.5
NULL dereference validating DSA public key
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys suppl…
-
High 7.5
NULL dereference during PKCS7 data verification
A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available t…
-
High 7.5
Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.
-
High 7.5
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's pub…
-
High 7.5CVE-2023-28709 EPSS 48%
Apache Tomcat: Fix for CVE-2023-24998 is incomplete
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string p…
-
High 7.5
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outs…
-
High 7.5
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--al…
-
High 7.5
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the exper…
-
High 7.5
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using…
-
High 7.5
llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…
-
High 7.5
0-byte UDP payload DoS in c-ares
c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously i…
-
High 7.5
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.…
-
High 7.5
Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of p…
-
High 7.5
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl…
-
High 7.5
Postgresql: extension script @substitutions@ within quoting allow sql injection
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non…
-
High 7.4
X.400 address type confusion in X.509 GeneralName
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…
-
High 7.3CVE-2023-34035 Public exploit
Spring Security's authorization rules can be misconfigured when using multiple servlets
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s Dispatche…
-
High 7.2
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could per…
-
Medium 6.5CVE-2023-2650 EPSS 75%
Possible DoS translating ASN.1 object identifiers
Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …
-
Medium 6.1CVE-2023-41080 Public exploit
Apache Tomcat: Open redirect with FORM authentication
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 thr…
-
Medium 5.9
Timing Oracle in RSA Decryption
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …
-
Medium 5.9
Input buffer over-read in AES-XTS implementation on 64 bit ARM
Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform ca…
-
Medium 5.9
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in …
-
Medium 5.9
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously…
-
Medium 5.9
A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for res…
-
Medium 5.9
An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard pat…
-
Medium 5.9
Insufficient randomness in generation of DNS query IDs in c-ares
c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable outp…
-
Medium 5.4
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applie…
-
Medium 5.3
An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously …
-
Medium 5.3
AES-SIV implementation ignores empty associated data entries
Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data …
-
Medium 5.3
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when th…
-
Medium 5.3
`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. T…
-
Medium 5.3
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when th…
-
Medium 5.3
Excessive time spent checking DH keys and parameters
Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…
-
Medium 5.3
Excessive time spent checking DH q parameter value
Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…
-
Medium 4.9
X.509 Name Constraints Read Buffer Overflow
A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for t…
-
Medium 4.9
RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and trigge…
-
Medium 4.1
Buffer Underwrite in ares_inet_net_pton()
c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes wh…
-
Low 3.7
AutoTools does not set CARES_RANDOM_FILE during cross compilation
c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow …
-
Low 3.1
Postgresql: merge fails to enforce update or select row security policies
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user coul…
-
Unscored —
A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing wa…
-
Unscored —
A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows …
-
Unscored —
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect te…
-
Unscored —
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, t…
-
Unscored —
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerab…
-
Unscored —
coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers o…
-
Unscored —
This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of …
Revision history
-
#2
Added missing acknowledgment for CVE-2024-23811
-
#1
Publication Date
References
-
SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-943925.html
-
SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-943925.pdf
-
SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-943925.txt
-
ICS Advisory ICSA-24-046-15 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-15
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B