182 results · Clear filters · Feed
-
Medium
SSA-201384: Predictable UDP Port Number Vulnerability (NAME:WRECK) in the DNS Module of Nucleus RTOS
Security researchers discovered and disclosed 9 vulnerabilities in several DNS implementations, also known as “NAME:WRECK” vulnerabilities. The vulnerability described in this advisory is from this set. The DNS client of of the networking component (Nucleus N…
first Apr 13, 2021 -
Medium max 6.6SSA-784507 1 CVE
SSA-784507: Apache Log4j Vulnerability (CVE-2021-44832) via JDBC Appender - Impact to Siemens Products
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) contain a vulnerability (CVE-2021-44832) that could allow an attacker with permission to modify the logging configuration file to execute arbitrary code, when t…
-
MediumSSA-199605 1 CVE
SSA-199605: Arbitrary File Download Vulnerability in SIMATIC eaSie PCS 7 Skill Package
SIMATIC eaSie PCS 7 Skill Package contains a path traversal vulnerability that could allow an authenticated remote attacker to read arbitrary files for the application server. Siemens has released an update for the SIMATIC eaSie PCS 7 Skill Package and recomm…
-
MediumSSA-133772 1 CVE
SSA-133772: Zip Path Traversal Vulnerability in Teamcenter Active Workspace
A zip path traversal vulnerability in Teamcenter Active Workspace could allow an attacker to achieve remote code execution. Siemens has released updates for the affected products and recommends to update to the latest versions.
-
MediumSSA-779699 2 CVEs
SSA-779699: Two Incorrect Authorization Vulnerabilities in Mendix
Applications built with affected versions of Mendix Studio Pro do not properly control read or write access for certain client actions. This could allow authenticated attackers to manipulate the content of System.FileDocument objects or to retrieve the change…
-
MediumSSA-338732 1 CVE
SSA-338732: Information Disclosure Vulnerability in Mendix
Applications built with affected versions of Mendix Studio Pro do not prevent file documents from being cached when files are opened or downloaded using a browser. This could allow a local attacker to read those documents by exploring the browser cache. Mendi…
-
MediumSSA-145157 3 CVEs
SSA-145157: Multiple Vulnerabilities in SIMATIC RTLS Locating Manager before V2.12
SIMATIC RTLS Locating Manager before V2.12 contains multiple vulnerabilities that could allow an attacker to read sensitive data or trigger a denial-of-service condition of the application service. Siemens has released an update for the SIMATIC RTLS Locating …
-
Medium
SSA-865327: Incorrect Authorization Vulnerability in Industrial Products
The latest updates for the below mentioned products fix a vulnerability that allows an unauthenticated attacker to read PLC variables from affected devices without proper authentication under certain circumstances. Siemens has released updates for some of the…
first Aug 10, 2021 -
MediumSSA-835377 1 CVE
SSA-835377: Missing Authentication Vulnerability in SINEMA Server
The latest update for SINEMA Server fixes a vulnerability that could allow an unauthenticated attacker to obtain encoded system configuration backup files under certain conditions. Siemens has released an update for the SINEMA Server and recommends to update …
-
MediumSSA-413407 1 CVE
SSA-413407: Path Traversal Vulnerability in Teamcenter Active Workspace
Teamcenter Active Workspace contains a path traversal vulnerability that could lead to access control violations. Siemens has released updates for the affected products and recommends to update to the latest versions.
-
MediumSSA-158827 1 CVE
SSA-158827: Denial-of-Service Vulnerability in Automation License Manager
A vulnerability was identified in the Automation License Manager software that could be triggered by sending specially crafted packets to port 4410/tcp of an affected system. This could cause a denial-of-service preventing legitimate users from using the syst…
-
MediumSSA-622535 3 CVEs
SSA-622535: Multiple Vulnerabilities in Teamcenter Active Workspace
Multiple vulnerabilities affecting Teamcenter Active Workspace could lead to sensitive information disclosure and reflected cross site scripting. Siemens has released updates for the affected products and recommends to update to the latest versions.
-
MediumSSA-448291 1 CVE
SSA-448291: Denial-of-Service Vulnerability in ARP Protocol of RWG Universal Controllers
A Denial-of-Service vulnerability was found affecting the ARP protocol on RWG Universal Controller devices. Siemens has released updates for the affected products and recommends to update to the latest versions.
-
MediumSSA-352521 1 CVE
SSA-352521: Access Check Bypass Vulnerability in Mendix
An incorrect authorization check in Mendix applications could allow an attacker to bypass write permissions to attributes of objects under certain circumstances. Mendix has released an update for Mendix and recommends to update to the latest version.
-
MediumSSA-209268 3 CVEs
SSA-209268: Multiple JT File Parsing Vulnerabilities in JT Utilities before V13.0.2.0
Siemens has released version V13.0.2.0 for JT Utilities to fix multiple vulnerabilities that could be triggered when reading JT files. Siemens recommends to update to the latest version, which contains solutions to all the vulnerabilities listed in this advisor…
-
Medium max 9.8
SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products
SIMATIC HMI Products are affected by two vulnerabilities that could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Siemens has released updates for the affected products and recommends to upd…
first Sep 8, 2020 -
MediumSSA-919955 1 CVE
SSA-919955: Information Disclosure Vulnerability in Mendix Database Replication Module
The latest update of Mendix Database Replication module fixes a infomation disclosure vulnerability. Mendix has released an update for the Mendix Database Replication module and recommends to update to the latest version.
-
MediumSSA-854248 1 CVE
SSA-854248: Information Disclosure Vulnerability in Mendix Excel Importer Module
The latest update of Mendix Excel Importer module fixes an infomation disclosure vulnerability. Mendix has released an update for the Mendix Excel Importer module and recommends to update to the latest version.
-
Medium
SSA-794542: Insecure Folder Permissions in SIMARIS Configuration
The installation of SIMARIS configuration causes insecure folder permissions that could allow vertical privilege escalation. Siemens has released an update for SIMARIS and recommends to update to the latest version.
first Feb 9, 2021 -
Medium
SSA-646763: DNSpooq - Dnsmasq Vulnerabilities in SCALANCE and RUGGEDCOM Devices
Security researchers discovered and disclosed seven vulnerabilities in the open-source DNS component "dnsmasq", also known as "DNSpooq" vulnerabilities (CVE-2020-25681 through CVE-2020-25687). Three vulnerabilities (CVE-2020-25684 through CVE-2020-25686) affe…
first Jan 19, 2021 -
MediumSSA-594364 1 CVE
SSA-594364: Denial-of-Service Vulnerability in SNMP Implementation of WinCC Runtime
A denial-of-service vulnerability in WinCC Runtime could allow an unauthenticated attacker with network access to cause a denial-of-service condition in the SNMP service by sending crafted SNMP packets to port 161/udp. Siemens has released updates for the aff…
-
Medium
SSA-541017: Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SIRIUS 3RW5 Modbus TCP and SENTRON PAC / 3VA Devices
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as "AMNESIA:33" vulnerabilities. This advisory describes the impact of one of these vulnerabilities (CVE-2020-13988) to Siem…
first Dec 8, 2020