901 results · Clear filters · Feed
-
Medium
Schneider Electric Telvent RTU Improper Ethernet Frame Padding Vulnerability
first Dec 12, 2016 -
Mediumfirst Dec 5, 2016
-
Medium max 6.1
Rockwell Automation Allen-Bradley CompactLogix Reflective Cross-Site Scripting Vulnerability (Update A)
first Dec 3, 2016 -
Medium
Rockwell Automation Integrated Architecture Builder Access Violation Memory Error
first Nov 28, 2016 -
Medium max 5.3
Craft CMS stores user-provided content session files
Craft CMS stores user-provided content in session files. A remote, unauthenticated attacker can introduce arbitrary content, including PHP code, into session files with known names and locations. If an attacker can access these files, possibly through another…
-
Medium max 6.8ICSA-25-142-01 1 CVE
Lantronix Device Installer
Successful exploitation of this vulnerability could allow an attacker to gain access to the host machine running the Device Installer software.
-
Medium max 6.8ICSA-25-140-01 1 CVE
ABUP IoT Cloud Platform
Successful exploitation of this vulnerability could allow an attacker to access device profiles for which they are not authorized.
-
Medium max 7.8
Mitsubishi Electric MELSOFT MaiLab and MELSOFT VIXIO (Update A)
Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service condition in the target product.
first Jul 18, 2024 -
Medium max 4.6ICSA-25-135-20 1 CVE
Schneider Electric EcoStruxure Power Build Rapsody
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code.
-
Medium max 5.5ICSA-25-140-05 1 CVE
Siemens Siveillance Video
The installer of Siveillance Video V2024 R1 resets the system configuration password when updating from older versions of Siveillance Video. This could inadvertently remove the password protection from system configuration files, also affecting backup data se…
-
Medium max 4.6
Schneider Electric EcoStruxure Power Build Rapsody
Schneider Electric is aware of a vulnerability in its EcoStruxure Power Build Rapsody software. The EcoStruxure Power Build Rapsody is used to enter or import the single line diagram, to get the extensive bill of material of your switchboard, including all de…
first Jan 14, 2025 -
Medium max 4.6ICSA-25-153-02 1 CVE
Schneider Electric EcoStruxure Power Build Rapsody
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Build Rapsody software. EcoStruxure Power Build Rapsody product is used to enter or import the single line diagram, to get the extensive bill of material of switchboards, including all d…
-
Medium max 6.5ICSA-25-135-03 1 CVE
Siemens BACnet ATEC Devices
BACnet ATEC devices are affected by a denial of service vulnerability that could be triggered by an attacker residing in the same BACnet network by sending a specially crafted MSTP message. A power cycle is required to restore the device's normal operation. S…
-
Medium max 6.5ICSA-25-135-11 4 CVEs
Siemens Polarion
Polarion before V2410 contains multiple vulnerabilities that could allow attackers to extract data, conduct cross-site scripting attacks or find out valid usernames. Siemens strongly recommends to update Polarion to V2410 or later versions, not only to fix th…
-
Medium max 4.7ICSA-25-135-14 1 CVE
Siemens APOGEE PXC and TALON TC Series
APOGEE PXC and TALON TC Series (BACnet) Devices devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially crafted m…
-
Medium max 6.5ICSA-25-135-16 1 CVE
Siemens MS/TP Point Pickup Module
MS/TP Point Pickup Module devices are affected by a denial of service vulnerability that could be triggered by an attacker residing in the same BACnet network by sending a specially crafted MSTP message. A power cycle is required to restore the device's norma…
-
Medium max 9.8
Siemens SIMATIC HMI Products (Update A)
SIMATIC HMI Products are affected by two vulnerabilities that could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Siemens has released updates for the affected products and recommends to upd…
first Sep 8, 2020 -
Medium
Siemens Industrial Products (Update F)
Security researchers published information on a vulnerability known as Crosstalk (INTEL-SA-00320). This vulnerability affects modern Intel processors to a varying degree. Several Siemens Industrial Products contain processors that are affected by the vulnerab…
first Sep 8, 2020 -
Medium
Siemens Embedded TCP/IP Stack Vulnerabilities-AMNESIA:33 (Update C)
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as "AMNESIA:33" vulnerabilities. This advisory describes the impact of one of these vulnerabilities (CVE-2020-13988) to Siem…
first Dec 8, 2020 -
Medium
dnsmasq by Simon Kelley (Update A)
Security researchers discovered and disclosed seven vulnerabilities in the open-source DNS component "dnsmasq", also known as "DNSpooq" vulnerabilities (CVE-2020-25681 through CVE-2020-25687). Three vulnerabilities (CVE-2020-25684 through CVE-2020-25686) affe…
first Jan 19, 2021 -
Medium
Siemens TCP/IP Stack Vulnerabilities-AMNESIA:33 in SENTRON PAC / 3VA Devices (Update C)
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as "AMNESIA:33" vulnerabilities. This advisory describes the impact of two of these vulnerabilities (CVE-2020-13987, CVE-202…
first Mar 9, 2021 -
Medium max 6.5
Siemens SIMOTICS CONNECT 400 (Update A)
SIMOTICS CONNECT 400 is affected by DNS Client vulnerabilities as initially reported in Siemens Security Advisory SSA-705111 (https://cert-portal.siemens.com/productcert/pdf/ssa-705111.pdf) for the DNS Module in Nucleus RTOS. Siemens has released updates for …
first Apr 13, 2021 -
Medium
Siemens Nucleus DNS (Update A)
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerability described in this advisory is from this set. The DNS client of of the networking component (Nucleus N…
first Apr 13, 2021 -
Medium
Siemens Mendix Database Replication Module
The latest update of Mendix Database Replication module fixes a infomation disclosure vulnerability. Mendix has released an update for the Mendix Database Replication module and recommends to update to the latest version.
first May 11, 2021 -
Medium
Siemens SNMP Implementation of WinCC Runtime
A denial-of-service vulnerability in WinCC Runtime could allow an unauthenticated attacker with network access to cause a denial-of-service condition in the SNMP service by sending crafted SNMP packets to port 161/udp. Siemens has released updates for the aff…
first May 11, 2021 -
Medium
Siemens Mendix Excel Importer Module
The latest update of Mendix Excel Importer module fixes an infomation disclosure vulnerability. Mendix has released an update for the Mendix Excel Importer module and recommends to update to the latest version.
first May 11, 2021 -
Medium
Siemens JT Utilities
Siemens has released version V13.0.2.0 for JT Utilities to fix multiple vulnerabilities that could be triggered when reading JT files. Siemens recommends to update to the latest version, which contains solutions to all the vulnerabilities listed in this advisor…
first Jul 13, 2021 -
Medium
Siemens Teamcenter Active Workspace
Multiple vulnerabilities affecting Teamcenter Active Workspace could lead to sensitive information disclosure and reflected cross site scripting. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Jul 13, 2021 -
Medium
Siemens RWG Universal Controllers
A Denial-of-Service vulnerability was found affecting the ARP protocol on RWG Universal Controller devices. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Jul 13, 2021 -
Medium
Siemens Mendix
An incorrect authorization check in Mendix applications could allow an attacker to bypass write permissions to attributes of objects under certain circumstances. Mendix has released an update for Mendix and recommends to update to the latest version.
first Jul 13, 2021 -
Medium
Siemens Automation License Manager
A vulnerability was identified in the Automation License Manager software that could be triggered by sending specially crafted packets to port 4410/tcp of an affected system. This could cause a denial-of-service preventing legitimate users from using the syst…
first Aug 10, 2021 -
Medium
Siemens SIMATIC and TIM
The latest updates for the below mentioned products fix a vulnerability that allows an unauthenticated attacker to read PLC variables from affected devices without proper authentication under certain circumstances. Siemens has released updates for some of the…
first Aug 10, 2021 -
Medium
Siemens SINEMA Server
The latest update for SINEMA Server fixes a vulnerability that could allow an unauthenticated attacker to obtain encoded system configuration backup files under certain conditions. Siemens has released an update for the SINEMA Server and recommends to update …
first Sep 14, 2021 -
Medium
Siemens LOGO! CMR and SIMATIC RTU 3000 (Update A)
A vulnerability has been identified in the underlying TCP/IP stack of LOGO! CMR and SIMATIC RTU 3000 devices. It could allow an attacker with network access to the LAN interface of an affected device to hijack an ongoing connection or spoof a new one. The WAN…
first Sep 14, 2021 -
Medium
Siemens Teamcenter Active Workspace
Teamcenter Active Workspace contains a path traversal vulnerability that could lead to access control violations. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Sep 14, 2021 -
Medium
Siemens Mendix
Applications built with affected versions of Mendix Studio Pro do not prevent file documents from being cached when files are opened or downloaded using a browser. This could allow a local attacker to read those documents by exploring the browser cache. Mendi…
first Nov 9, 2021 -
Medium
Siemens Mendix Studio Pro
Applications built with affected versions of Mendix Studio Pro do not properly control read or write access for certain client actions. This could allow authenticated attackers to manipulate the content of System.FileDocument objects or to retrieve the change…
first Nov 9, 2021 -
Medium
Siemens SIMATIC RTLS Locating Manager
SIMATIC RTLS Locating Manager before V2.12 contains multiple vulnerabilities that could allow an attacker to read sensitive data or trigger a denial-of-service condition of the application service. Siemens has released an update for the SIMATIC RTLS Locating …
first Nov 9, 2021 -
Medium
Siemens SIMATIC eaSie PCS 7 Skill Package
SIMATIC eaSie PCS 7 Skill Package contains a path traversal vulnerability that could allow an authenticated remote attacker to read arbitrary files for the application server. Siemens has released an update for the SIMATIC eaSie PCS 7 Skill Package and recomm…
first Dec 14, 2021 -
Medium
Siemens Teamcenter Active Workspace
A zip path traversal vulnerability in Teamcenter Active Workspace could allow an attacker to achieve remote code execution. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Dec 14, 2021