High 2 exploited CVEs ICSA-24-165-04 37 CVEs

Siemens ST7 ScadaConnect

Published Jun 11, 2024 · Updated Jun 11, 2024

Vendor: Siemens Product: ST7 ScadaConnect (6NH7997-5DA10-0AA0)

Summary

Siemens has released a new version for ST7 ScadaConnect and recommends to update to the latest version.

Vulnerabilities 37

High 7.5

CVE-2023-38180 Exploited EPSS 14%

.NET and Visual Studio Denial of Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Aug 8, 2023
KEV Aug 9, 2023
High 7.5

CVE-2023-44487 Exploited Public exploit EPSS 100%

HTTP/2 Stream Cancellation Attack

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL

Oct 10, 2023
KEV Oct 10, 2023
High 8.2

CVE-2023-36038

ASP.NET Core Denial of Service Vulnerability

ASP.NET Core Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2

Nov 14, 2023
High 8.1

CVE-2023-33127

.NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine NuGet

Jul 11, 2023
High 8.1

CVE-2023-33170

ASP.NET and Visual Studio Security Feature Bypass Vulnerability

ASP.NET and Visual Studio Security Feature Bypass Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Jul 11, 2023
High 7.8

CVE-2022-40304

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, …

libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine

Nov 23, 2022
High 7.8

CVE-2023-21808

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Feb 14, 2023
High 7.8

CVE-2023-24895

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Jun 14, 2023
High 7.8

CVE-2023-24897

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Jun 14, 2023
High 7.8

CVE-2023-28260

.NET DLL Hijacking Remote Code Execution Vulnerability

.NET DLL Hijacking Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 .NET 6.0 Ubuntu Alpine NuGet

Apr 11, 2023
High 7.8

CVE-2023-35390

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Aug 8, 2023
High 7.8

CVE-2023-36792

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36793

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36794

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36796

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Sep 12, 2023
High 7.6

CVE-2023-36049

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine NuGet

Nov 14, 2023
High 7.5

CVE-2022-40303 EPSS 41%

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE pa…

libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine

Nov 22, 2022
High 7.5

CVE-2023-0464 Public exploit

Excessive Resource Usage Verifying X.509 Policy Constraints

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Mar 22, 2023
High 7.5

CVE-2023-24936

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jun 14, 2023
High 7.5

CVE-2023-29331

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Jun 14, 2023
High 7.5

CVE-2023-36435

Microsoft QUIC Denial of Service Vulnerability

Microsoft QUIC Denial of Service Vulnerability

Microsoft Windows Server 2022 Windows 11 version 22H2 Windows 11 version 21H2 Windows Alpine NuGet

Oct 10, 2023
High 7.5

CVE-2023-38171 EPSS 71%

Microsoft QUIC Denial of Service Vulnerability

Microsoft QUIC Denial of Service Vulnerability

Microsoft Windows Server 2022 Windows 11 version 22H2 Windows 11 version 21H2 Windows Alpine NuGet

Oct 10, 2023
High 7.5

CVE-2023-38178

.NET Core and Visual Studio Denial of Service Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 .NET 6.0 Ubuntu Alpine NuGet

Aug 8, 2023
High 7.3

CVE-2023-33126

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine NuGet

Jun 13, 2023
High 7.3

CVE-2023-33128

.NET and Visual Studio Remote Code Execution Vulnerability

.NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Jun 13, 2023
High 7.3

CVE-2023-33135

.NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine

Jun 13, 2023
Medium 6.5

CVE-2023-28484

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequentl…

libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine

Apr 24, 2023
Medium 6.5

CVE-2023-29469

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictCom…

qt5-qtwebengine libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine

Apr 24, 2023
Medium 6.5

CVE-2023-32032

.NET and Visual Studio Elevation of Privilege Vulnerability

.NET and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine

Jun 13, 2023
Medium 6.5

CVE-2023-36799

.NET Core and Visual Studio Denial of Service Vulnerability

.NET Core and Visual Studio Denial of Service Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Sep 12, 2023
Medium 6.2

CVE-2023-35391

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Alpine NuGet

Aug 8, 2023
Medium 6.2

CVE-2023-36558

ASP.NET Core Security Feature Bypass Vulnerability

ASP.NET Core Security Feature Bypass Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.4 Microsoft Visual Studio 2022 version 17.2 Ubuntu Alpine NuGet

Nov 14, 2023
Medium 5.3

CVE-2023-0465

Invalid certificate policies in leaf certificates are silently ignored

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate pol…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Mar 28, 2023
Medium 5.3

CVE-2023-0466

Certificate policy check not enabled

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or in…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine

Mar 28, 2023
Medium 5.3

CVE-2023-3446

Excessive time spent checking DH keys and parameters

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 19, 2023
Medium 5.3

CVE-2023-5678

Excessive time spent in DH check / generation with large Q parameter value

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Nov 6, 2023
Unscored —

CVE-2023-39615

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libx…

libxml2 Debian

Aug 29, 2023

Revision history

2024-06-11 #1
Publication Date

References

SSA-341067: Multiple vulnerabilities in third-party components in ST7 ScadaConnect before V1.1 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-341067.html
SSA-341067: Multiple vulnerabilities in third-party components in ST7 ScadaConnect before V1.1 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-341067.pdf
SSA-341067: Multiple vulnerabilities in third-party components in ST7 ScadaConnect before V1.1 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-341067.txt
ICS Advisory ICSA-24-165-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-04
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B