4,108 results · Feed
-
Critical max 9.8ICSA-23-026-06 2 CVEs
Rockwell Automation products using GoAhead Web Server
Successful exploitation of these vulnerabilities could have a high impact on the confidentiality, integrity, and availability of the vulnerable devices.
-
Low max 3.9ICSA-23-026-07 1 CVE
Landis+Gyr E850
Successful exploitation of this vulnerability could cause a denial-of-service condition for the end user that the cookie was modified for.
-
High max 7.3ICSA-23-024-01 2 CVEs
XINJE XD
Successful exploitation of these vulnerabilities could allow an attacker to write arbitrary project files to a programmable logic controller (PLC) and gain code execution privileges.
-
Critical max 9.8
Contec CONPROSYS HMI System (CHS)
Successful exploitation of these vulnerabilities could allow a remote attacker to send specially crafted requests and cause a loss of sensitive information.
first Dec 13, 2022 -
High max 7.5ICSA-23-019-01 2 CVEs
Hitachi Energy PCU400
Successful exploitation of these vulnerabilities could result in a denial-of-service condition on both the logging function of the device and its associated server.
-
Critical max 9.8
Delta Electronics InfraSuite Device Master
Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to remotely execute code, cause a denial-of-service condition by remotely deleting files or changing group privileges, or remotely read and write files, all with local ad…
first Oct 25, 2022 -
Critical max 9.8ICSA-23-017-01 5 CVEs
GE Digital Proficy Historian
Successful exploitation of these vulnerabilities could crash the device after access, cause a buffer overflow condition, and allow remote code execution.
-
Critical max 10.0ICSA-23-012-01 9 CVEs
Sewio RTLS Studio
Successful exploitation of these vulnerabilities could allow an attacker to obtain unauthorized access to the server, alter information, create a denial-of-service condition, gain escalated privileges, and execute arbitrary code.
-
High max 8.2ICSA-23-012-02 2 CVEs
RONDS Equipment Predictive Maintenance Solution
Successful exploitation of these vulnerabilities could allow an unauthorized user to leak login credentials and download files. In some circumstances, an unauthorized user can use login credentials to achieve remote code execution.
-
Critical max 10.0ICSA-23-012-03 5 CVEs
InHand Networks InRouter
Successful exploitation of these vulnerabilities could allow a message queuing telemetry transport (MQTT) command injection, unauthorized disclosure of sensitive device information, and remote code execution. If properly chained, these vulnerabilities could r…
-
High max 7.5ICSA-23-012-04 1 CVE
Panasonic Sanyo CCTV Network Camera
Successful exploitation of this vulnerability could allow attackers to perform actions via HTTP without validity checks.
-
Critical max 9.8ICSA-23-012-05 2 CVEs
SAUTER Controls Nova 200 - 220 Series (PLC 6)
Successful exploitation of these vulnerabilities could allow unauthorized visibility to sensitive information and remote code execution.
-
High max 7.8ICSA-23-012-06 1 CVE
Johnson Controls Metasys
Successful exploitation of this vulnerability could result in exposed credentials in plain text to unauthenticated users.
-
Medium max 5.7ICSA-23-012-07 1 CVE
Hitachi Energy Lumada APM
Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to any Power BI reports installed or manipulate asset issue comments on assets.
-
Medium max 5.3
Siemens SIMATIC S7 (Update B)
SIMATIC S7 CPU families are affected by a vulnerability that could allow remote attackers to perform a denial of service attack by sending a specially crafted HTTP request to the web server of an affected device. Siemens has released updates for several affec…
first Feb 11, 2020 -
Medium max 5.4
Siemens SIMATIC WinCC OA Ultralight Client
SIMATIC WinCC OA contains an argument injection vulnerability that could allow an authenticated remote attacker to inject arbitrary parameters, when starting the Ultralight Client via the web interface (e.g., open attacker chosen panels with the attacker's cr…
first Dec 13, 2022 -
High max 8.1
Siemens Mendix Workflow Commons
The Mendix Workflow Commons module improperly handles access control for some module entities. This could allow authenticated remote attackers to read or delete sensitive information. Mendix has released updates for several version lines of the Mendix Workflo…
first Dec 13, 2022 -
High max 7.5ICSA-23-010-01 1 CVE
Black Box KVM
Successful exploitation of this vulnerability could allow an attacker to read sensitive data on the built-in web servers of the affected devices.
-
Critical max 9.3ICSA-23-012-09 1 CVE
Siemens Mendix SAML Module
The Mendix SAML module is affected by a reflected cross-site scripting (XSS) vulnerability that could allow an attacker to extract sensitive information by tricking users into accessing a malicious link. Apps are only vulnerable in certain cases when non-defa…
-
High max 7.8ICSA-23-012-11 1 CVE
Siemens Solid Edge before V2023 MP1
Solid Edge is affected by memory corruption vulnerability that could be triggered when the application read files in different file formats such as PAR, ASM, DFT. If a user is tricked to open a malicious file with the affected applications, an attacker could …
-
Critical max 9.9ICSA-23-017-03 12 CVEs
Siemens SINEC INS
Siemens has released a new version for SINEC INS that fixes multiple vulnerabilities that could allow an attacker to read and write arbitrary files from the file system of the affected component and to ultimately execute arbitrary code on the device. In addit…
-
High max 8.3ICSA-23-005-01 5 CVEs
Hitachi Energy UNEM
Successful exploitation of these vulnerabilities could allow an unauthorized user to obtain sensitive information and gain access to the network elements managed by the UNEM and could cause availability issue on affected UNEM products.
-
High max 8.3ICSA-23-005-02 5 CVEs
Hitachi Energy FOXMAN-UN
Successful exploitation of these vulnerabilities could allow an unauthorized user to obtain sensitive information and gain access to the network elements managed by the FOXMAN-UN, and could cause an availability issue on affected FOXMAN-UN products.
-
High max 9.8ICSA-23-005-03 3 CVEs
Hitachi Energy Lumada Asset Performance Management
Successful exploitation of these vulnerabilities could cause a denial-of-service condition or unauthorized remote arbitrary code execution.
-
Medium max 6.5
Prosys OPC UA Simulation Server (Update A)
Successful exploitation of this vulnerability could allow an attacker to obtain credentials and gain access to system data.
first Dec 15, 2022 -
High max 7.5ICSA-22-356-01 1 CVE
Priva TopControl Suite
Successful exploitation of this vulnerability could allow an attacker to obtain login credentials and access the product remotely.
-
High max 7.8ICSA-22-356-02 1 CVE
Rockwell Automation Studio 5000 Logix Emulate
Successful exploitation of this vulnerability could allow a malicious user to perform remote code execution, potentially impacting the confidentiality, integrity, and availability of the software.
-
High max 7.8ICSA-22-356-04 1 CVE
Omron CX-Programmer
Successful exploitation of this vulnerability could allow arbitrary code execution or loss of sensitive information if a user opens a specially crafted CX-P file.
-
High max 7.8ICSA-22-354-01 2 CVEs
Fuji Electric Tellus Lite V-Simulator
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code.
-
High max 8.6ICSA-22-354-02 1 CVE
Rockwell Automation GuardLogix and ControlLogix controllers
Successful exploitation of this vulnerability could potentially lead to degradation in availability of the controller and/or a possible major nonrecoverable fault.
-
High max 7.5ICSA-22-354-04 2 CVEs
Rockwell Automation MicroLogix 1100 and 1400
Successful exploitation of these vulnerabilities could create a denial-of-service condition or allow for remote code execution.
-
High max 7.2ICSA-22-354-05 1 CVE
Delta 4G Router DX-3021
Successful exploitation of this vulnerability could allow a remote unauthenticated user to add files, delete files, or change file permissions.
-
Medium
Siemens SCALANCE X Switches (Update A)
Two cross-site scripting (XSS) vulnerabilities were identified in the web server of several SCALANCE X switches. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Jun 12, 2018 -
High
Siemens SCALANCE X Switches (Update B)
Several SCALANCE X switches are affected by an Authentication Bypass vulnerability. The vulnerability allows an unauthenticated attacker to violate access-control rules. The vulnerability can be exploited by sending a GET request to a specific uniform resourc…
first Jan 14, 2020 -
Medium
Siemens SCALANCE X Switches (Update B)
Several SCALANCE X switches contain a vulnerability that could allow an attacker to perform administrative actions if the victim is tricked into clicking on a website controlled by the attacker. The attack only works if the victim has an authenticated session…
first Feb 11, 2020 -
High
Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update J)
Several industrial products as listed below contain a local privilege escalation vulnerability that could allow a local attacker to execute arbitrary code with SYTEM privileges. Siemens has released updates for the affected products and recommends to update t…
first Jun 9, 2020 -
Critical
Siemens SCALANCE X Switches (Update B)
SCALANCE X devices might not generate a unique random key after factory reset, and use a private key shipped with the firmware. Siemens has released updates for the affected products and recommends to update to the latest versions.
first Jan 12, 2021 -
High
Siemens Industrial PCs and CNC devices
Intel has published information on vulnerabilities in Intel products in November 2020. This advisory lists the Siemens IPC related products, that are affected by these vulnerabilities. In this advisory we take a representative CVE from each advisory: - “Intel…
first May 11, 2021 -
High max 9.8
Siemens Mendix SAML Module
The Mendix SAML module insufficiently protects from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. Mendix has provided fix releases for the Mendix SAML module and recommends to…
first Sep 13, 2022 -
Medium max 6.1ICSA-22-346-05 1 CVE
Siemens PLM Help Server
The Siemens PLM Help Server V4.2 for documentation contains a reflected cross-site scripting vulnerability. This product has reached end of life, and security vulnerabilities are no longer patched. Siemens has released a new version of Documentation Server t…