874 results · Feed
-
HighSSA-173615 4 CVEs
SSA-173615: Multiple PAR and ASM File Parsing Vulnerabilities in Solid Edge
Siemens has released version SE2021MP5 for Solid Edge to fix multiple heap based buffer overflow vulnerabilities that could be triggered when the application read files in PAR or ASM file formats. If a user is tricked to open a malicious file with the affecte…
-
HighSSA-645530 1 CVE
SSA-645530: TIFF File Parsing Vulnerability in JT2Go and Teamcenter Visualization before V13.1.0.3
Siemens has released version V13.1.0.3 for JT2Go and Teamcenter Visualization to fix a vulnerability that could be triggered when the products read files in TIFF file format. If a user is tricked to opening of a malicious file with the affected products, this…
-
High
SSA-574442: Multiple PAR and DFT File Parsing Vulnerabilities in Solid Edge
Siemens has released a new version for Solid Edge to fix multiple vulnerabilities that could be triggered when the application reads files in different file formats (PAR, DFT extensions). If a user is tricked to open a malicious file with the affected applica…
first Apr 13, 2021 -
Medium max 9.8
SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products
SIMATIC HMI Products are affected by two vulnerabilities that could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Siemens has released updates for the affected products and recommends to upd…
first Sep 8, 2020 -
HighSSA-522654 1 CVE
SSA-522654: Privilege Escalation Vulnerability in Mendix SAML Module
The latest update of Mendix SAML module fixes a privilege escalation vulnerability. Mendix has released an update for the Mendix SAML module and recommends to update to the latest version.
-
HighSSA-419820 1 CVE
SSA-419820: Denial-of-Service Vulnerability in TIM 1531 IRC
The latest update for TIM 1531 IRC fixes a vulnerability that could allow a remote attacker to cause a denial-of-service under certain circumstances. Siemens has released an update for the TIM 1531 IRC and recommends to update to the latest version.
-
HighSSA-208356 2 CVEs
SSA-208356: DFT File Parsing Vulnerabilities in Solid Edge
Siemens has released a new version for Solid Edge to fix two vulnerabilities that could be triggered when the application read files in DFT file format. If a user is tricked to opening of a malicious file with the affected products, this could lead to applica…
-
HighSSA-200951 2 CVEs
SSA-200951: Multiple Vulnerabilities in Third-Party Component libcurl of TIM Devices
SIMATIC TIM 1531 IRC devices are vulnerable to multiple vulnerabilities in the third party component libcurl that could allow an attacker to extract sensitive information and pass a revoked certificate as valid. Siemens has released an update for SIMATIC TIM …
-
HighSSA-133038 2 CVEs
SSA-133038: Multiple Modfem File Parsing Vulnerabilities in Simcenter Femap
Siemens Simcenter Femap is affected by two vulnerabilities that could be triggered when the application reads modfem files. If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and potentially also to arbitr…
-
HighSSA-119468 5 CVEs
SSA-119468: Luxion KeyShot Vulnerabilities in Solid Edge
The Solid Edge installation package includes a specific version of the third-party product KeyShot from Luxion, which may not contain the latest security fixes provided by Luxion. Siemens recommends to update KeyShot according to the information in the Luxion…
-
HighSSA-695540 5 CVEs
SSA-695540: ASM and PAR File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.1.0.2
Siemens has released version V13.1.0.2 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read files in ASM and PAR file formats. If a user is tricked to opening of a malicious file with the affect…
-
High
SSA-663999: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.1.0.1
Siemens has released version V13.1.0.1 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read files in different file formats (BMP, TIFF, CGM, TGA, PCT, HPG, PLT, RAS, PAR, ASM, DXF, DWG). If a us…
first Feb 9, 2021 -
High
SSA-622830: Multiple File Parsing Vulnerabilities in JT2Go and Teamcenter Visualization before V13.1.0
Siemens has released version V13.1.0 for JT2Go and Teamcenter Visualization to fix multiple vulnerabilities that could be triggered when the products read files in different file formats (JT, XML, CG4, CGM, PDF, RGB, SGI, TGA, PAR, PCX). If a user is tricked …
first Jan 12, 2021 -
HighSSA-983548 3 CVEs
SSA-983548: Multiple SPP File Parsing Vulnerabilities in Tecnomatix Plant Simulation
Siemens Tecnomatix Plant Simulation has released an update for version V16.0 that fixes multiple vulnerabilities that could be triggered when the application reads SPP files. If a user is tricked to open a malicious file using the affected application, this c…
-
CriticalSSA-940818 10 CVEs
SSA-940818: UltraVNC Vulnerabilities in SIMATIC HMIs/WinCC Products
UltraVNC vulnerabilities in the affected products listed below could allow remote code execution, information disclosure and Denial-of-Service attacks under certain conditions. Siemens has released updates for the affected products and recommends to update to…
-
MediumSSA-919955 1 CVE
SSA-919955: Information Disclosure Vulnerability in Mendix Database Replication Module
The latest update of Mendix Database Replication module fixes a infomation disclosure vulnerability. Mendix has released an update for the Mendix Database Replication module and recommends to update to the latest version.
-
MediumSSA-854248 1 CVE
SSA-854248: Information Disclosure Vulnerability in Mendix Excel Importer Module
The latest update of Mendix Excel Importer module fixes an infomation disclosure vulnerability. Mendix has released an update for the Mendix Excel Importer module and recommends to update to the latest version.
-
Medium
SSA-794542: Insecure Folder Permissions in SIMARIS Configuration
The installation of SIMARIS configuration causes insecure folder permissions that could allow vertical privilege escalation. Siemens has released an update for SIMARIS and recommends to update to the latest version.
first Feb 9, 2021 -
HighSSA-676775 1 CVE
SSA-676775: Denial-of-Service Vulnerability in SIMATIC NET CP 343-1 Devices
A vulnerability in SIMATIC CP343-1 devices could allow an attacker to cause a Denial-of-Service condition on TCP port 102 of the affected devices by sending specially crafted packets. Siemens recommends specific countermeasures for products where updates are …
-
Medium
SSA-646763: DNSpooq - Dnsmasq Vulnerabilities in SCALANCE and RUGGEDCOM Devices
Security researchers discovered and disclosed seven vulnerabilities in the open-source DNS component "dnsmasq", also known as "DNSpooq" vulnerabilities (CVE-2020-25681 through CVE-2020-25687). Three vulnerabilities (CVE-2020-25684 through CVE-2020-25686) affe…
first Jan 19, 2021 -
MediumSSA-594364 1 CVE
SSA-594364: Denial-of-Service Vulnerability in SNMP Implementation of WinCC Runtime
A denial-of-service vulnerability in WinCC Runtime could allow an unauthenticated attacker with network access to cause a denial-of-service condition in the SNMP service by sending crafted SNMP packets to port 161/udp. Siemens has released updates for the aff…
-
Critical
SSA-478893: TightVNC Vulnerabilities in Industrial Products (Revoked)
Multiple TightVNC (V1.x) vulnerabilities could allow remote code execution and Denial-of-Service attacks under certain conditions. Siemens has previously released this advisory containing a set of products that were considered to be affected. Through Siemens'…
first Dec 8, 2020 -
HighSSA-116379 1 CVE
SSA-116379: Denial-of-Service Vulnerability in OSPF Packet Handling of SCALANCE XM-400 and XR-500 Devices
SCALANCE XM-400 and XR-500 devices contain a vulnerability in the OSPF protocol implementation that could allow an unauthenticated remote attacker to create a permanent denial-of-service condition. Siemens has released updates for the affected products and re…
-
HighSSA-875726 1 CVE
SSA-875726: Privilege Escalation Vulnerability in Mendix
The latest updates for Mendix fix a vulnerability in Mendix Applications that could allow malicious authorized users to escalate their privileges. Mendix has released an update for Mendix and recommends to update to the latest version.
-
High max 6.5
SSA-979775: Stack Overflow Vulnerability in SCALANCE and RUGGEDCOM Devices
Several firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the passive listening feature that could allow an attacker to cause a reboot or, under specific circumstances, attain remote code execution of the …
first Mar 9, 2021 -
CriticalSSA-853866 1 CVE
SSA-853866: User Credentials Disclosure Vulnerability in Siveillance Video Open Network Bridge (ONVIF)
Siemens has released hotfixes for Siveillance Video Open Network Bridge (ONVIF) which fix a security vulnerability related to unsecure storage of ONVIF user credentials. The vulnerability could allow an authenticated remote attacker to retrieve and decrypt al…
-
CriticalSSA-788287 1 CVE
SSA-788287: Disclosure of Private Data
Due to SmartClient Installation technology (ClickOnce) a customer/integrator needs to create a customer specific Smartclient installer. The mentioned products delivered a trusted but yet expired codesigning certificate. An attacker could have exploited the vu…
-
High
SSA-715184: Multiple File Parsing Vulnerabilities in Solid Edge
Siemens has released new versions for Solid Edge to fix multiple vulnerabilities that could be triggered when the application reads files in different file formats (PAR, DFT, XML extensions). If a user is tricked to open a malicious file with the affected app…
first Mar 9, 2021 -
High
SSA-689942: Denial-of-Service and DLL Hijacking Vulnerabilities in Multiple SIMATIC Software Products
Multiple SIMATIC Software products are affected by two vulnerabilities that could allow an attacker to manipulate project files that may lead to Remote Code Execution or Denial-of-Service attacks. Siemens has released updates to some of the affected products …
first Jun 9, 2020 -
High
SSA-591405: Web Vulnerabilities in SCALANCE S-600 Family
The firmware for SCALANCE S-600 family devices contains multiple web vulnerabilities. The vulnerabilities could allow an remote attacker to conduct Denial-of-Service attacks or perform Cross-Site Scripting attacks. Siemens has released updates for the affecte…
first Feb 11, 2020 -
Medium
SSA-541017: Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SIRIUS 3RW5 Modbus TCP and SENTRON PAC / 3VA Devices
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as "AMNESIA:33" vulnerabilities. This advisory describes the impact of one of these vulnerabilities (CVE-2020-13988) to Siem…
first Dec 8, 2020 -
High
SSA-296266: Denial-of-Service Vulnerability in SCALANCE and RUGGEDCOM Devices
Some firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the SSH authentication that could allow an attacker to cause a Denial-of-Service under certain conditions. Siemens has released updates for the affect…
first Mar 9, 2021 -
High max 7.5SSA-292794 2 CVEs
SSA-292794: Multiple Denial-of-Service Vulnerabilities in SINEMA Remote Connect Server
The latest update for SINEMA Remote Connect Server fixes two Denial-of-Service vulnerabilities in the underlying third-party XML parser. Siemens has released updates for the affected product and recommends to update to the latest versions.
-
HighSSA-163226 1 CVE
SSA-163226: CELL File Parsing Vulnerability in Tecnomatix RobotExpert
Siemens Tecnomatix RobotExpert version V16.1 fixes a vulnerability that could be triggered when the application reads CELL files. If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and potentially also to …