High SSA-556635 47 CVEs

SSA-556635: Multiple Vulnerabilities in Telecontrol Server Basic before V3.1.2.0

Published Apr 9, 2024 · Updated Apr 9, 2024

Vendor: Siemens Product: TeleControl Server Basic V3

Summary

Siemens has released a new version for Telecontrol Server Basic that fixes multiple vulnerabilities.

Vulnerabilities 47

High 8.8

CVE-2023-21705

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Feb 14, 2023
High 8.8

CVE-2023-21713

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Feb 14, 2023
High 8.8

CVE-2023-36560

ASP.NET Security Feature Bypass Vulnerability

ASP.NET Security Feature Bypass Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2

Nov 14, 2023
High 8.8

CVE-2023-36899 Public exploit EPSS 77%

ASP.NET Elevation of Privilege Vulnerability

ASP.NET Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2

Aug 8, 2023
High 8.8

CVE-2023-38169

Microsoft SQL OLE DB Remote Code Execution Vulnerability

Microsoft SQL OLE DB Remote Code Execution Vulnerability

Microsoft Microsoft OLE DB Driver 19 for SQL Server Microsoft OLE DB Driver 18 for SQL Server Microsoft ODBC Driver 17 for SQL Server on Windows Linux Windows macOS

Aug 8, 2023
High 8.2

CVE-2022-43513

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All…

Siemens Automation License Manager V5 TeleControl Server Basic V3 Automation License Manager V6 ICS / OT

Jan 10, 2023
High 7.8

CVE-2022-40304

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, …

libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine

Nov 23, 2022
High 7.8

CVE-2022-44725

OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. T…

Nov 17, 2022
High 7.8

CVE-2023-21528

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Feb 14, 2023
High 7.8

CVE-2023-21704

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Feb 14, 2023
High 7.8

CVE-2023-21718

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Feb 14, 2023
High 7.8

CVE-2023-29349

Microsoft ODBC and OLE DB Remote Code Execution Vulnerability

Microsoft ODBC and OLE DB Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2022 version 17.4 Linux Windows macOS

Jun 16, 2023
High 7.8

CVE-2023-29356

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2022 version 17.4 Linux Windows macOS

Jun 16, 2023
High 7.8

CVE-2023-32025

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2022 version 17.4 Linux Windows macOS

Jun 16, 2023
High 7.8

CVE-2023-32026

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2022 version 17.4 Linux Windows macOS

Jun 16, 2023
High 7.8

CVE-2023-32027

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2022 version 17.4 Linux Windows macOS

Jun 16, 2023
High 7.8

CVE-2023-32028

Microsoft SQL OLE DB Remote Code Execution Vulnerability

Microsoft SQL OLE DB Remote Code Execution Vulnerability

Microsoft Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Microsoft Visual Studio 2022 version 17.4

Jun 16, 2023
High 7.8

CVE-2023-36417

Microsoft SQL OLE DB Remote Code Execution Vulnerability

Microsoft SQL OLE DB Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft OLE DB Driver 19 for SQL Server

Oct 10, 2023
High 7.8

CVE-2023-36420

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft ODBC Driver 17 for SQL Server on Linux Linux Windows macOS

Oct 10, 2023
High 7.8

CVE-2023-36730

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft ODBC Driver 18 for SQL Server on MacOS Linux Windows macOS

Oct 10, 2023
High 7.8

CVE-2023-36785

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft ODBC Driver 18 for SQL Server on MacOS Linux Windows macOS

Oct 10, 2023
High 7.8

CVE-2023-36788

.NET Framework Remote Code Execution Vulnerability

.NET Framework Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8.1

Sep 12, 2023
High 7.8

CVE-2023-36792

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36793

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36794

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-36796

Visual Studio Remote Code Execution Vulnerability

Visual Studio Remote Code Execution Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Alpine NuGet

Sep 12, 2023
High 7.8

CVE-2023-4807

POLY1305 MAC implementation corrupts XMM registers on Windows

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impac…

OpenSSL OpenSSL kata-containers openssl-fips-provider Azure Linux

Sep 8, 2023
High 7.7

CVE-2022-43514

A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All…

Siemens Automation License Manager V5 TeleControl Server Basic V3 Automation License Manager V6 ICS / OT

Jan 10, 2023
High 7.6

CVE-2023-36049

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet

Nov 14, 2023
High 7.5

CVE-2022-40303 EPSS 41%

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE pa…

libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine

Nov 22, 2022
High 7.5

CVE-2022-4450 EPSS 29%

Double free after calling PEM_read_bio_ex

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io

Feb 8, 2023
High 7.5

CVE-2023-0215

Use-after-free following BIO_new_NDEF

The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io

Feb 8, 2023
High 7.5

CVE-2023-0464 Public exploit

Excessive Resource Usage Verifying X.509 Policy Constraints

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Mar 22, 2023
High 7.4

CVE-2023-0286 Public exploit EPSS 68%

X.400 address type confusion in X.509 GeneralName

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI crates.io

Feb 8, 2023
High 7.4

CVE-2023-36873

.NET Framework Spoofing Vulnerability

.NET Framework Spoofing Vulnerability

Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Microsoft .NET Framework 3.5 AND 4.7.2

Aug 8, 2023
High 7.3

CVE-2022-46908

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the…

sqlite3 sqlite3 sqlite Debian Ubuntu Azure Linux

Dec 12, 2022
High 7.3

CVE-2023-21568

Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability

Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability

Microsoft SQL Server Integration Services for Visual Studio 2022 SQL Server Integration Services for Visual Studio 2019

Feb 14, 2023
High 7.3

CVE-2023-23384

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR)

Apr 11, 2023
Medium 6.5

CVE-2023-28484

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequentl…

libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine

Apr 24, 2023
Medium 6.5

CVE-2023-29469

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictCom…

qt5-qtwebengine libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine

Apr 24, 2023
Medium 5.9

CVE-2022-4304 Public exploit EPSS 24%

Timing Oracle in RSA Decryption

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io

Feb 8, 2023
Medium 5.5

CVE-2023-36728

Microsoft SQL Server Denial of Service Vulnerability

Microsoft SQL Server Denial of Service Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft SQL Server 2017 (GDR) Linux Windows macOS

Oct 10, 2023
Medium 5.3

CVE-2023-0465

Invalid certificate policies in leaf certificates are silently ignored

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate pol…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Mar 28, 2023
Medium 5.3

CVE-2023-0466

Certificate policy check not enabled

The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or in…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine

Mar 28, 2023
Medium 5.3

CVE-2023-3446

Excessive time spent checking DH keys and parameters

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 19, 2023
Medium 5.3

CVE-2023-5678

Excessive time spent in DH check / generation with large Q parameter value

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Nov 6, 2023
Unscored —

CVE-2023-39615

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libx…

libxml2 Debian

Aug 29, 2023

Revision history

2024-04-09 #1
Publication Date

References

SSA-556635: Multiple Vulnerabilities in Telecontrol Server Basic before V3.1.2.0 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-556635.html
SSA-556635: Multiple Vulnerabilities in Telecontrol Server Basic before V3.1.2.0 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-556635.pdf
SSA-556635: Multiple Vulnerabilities in Telecontrol Server Basic before V3.1.2.0 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-556635.txt