Bulletins | CERT@VDE

SSA-414513 V1.1 (Last Update: 2022-06-14): Information Disclosure Vulnerability in Mendix

Titel

SSA-414513 V1.1 (Last Update: 2022-06-14): Information Disclosure Vulnerability in Mendix

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-414513.pdf

Text

An information disclosure vulnerability in Mendix applications was discovered. The vulnerability could allow to read sensitive data. Siemens has released updates for several Mendix Applications and recommends to update to the latest versions. Siemens is preparing further updates and recommends countermeasures for products where updates are not, or not yet ...

SSA-401167 V1.0: Cross-site scripting Vulnerability in Teamcenter Active Workspace

Titel

SSA-401167 V1.0: Cross-site scripting Vulnerability in Teamcenter Active Workspace

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-401167.pdf

Text

Teamcenter Active Workspace is affected by a cross site scripting vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-388239 V1.0: Default Password Leakage affecting the Component Shared HIS used in Spectrum Power Systems

Titel

SSA-388239 V1.0: Default Password Leakage affecting the Component Shared HIS used in Spectrum Power Systems

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-388239.pdf

Text

Siemens has been made aware of a default password leakage in the internet affecting the component Shared HIS (SHHIS) used in Spectrum Power systems. The products listed below are affected by this default password leakage. This could allow an attacker to access the component Shared HIS of those products with ...

SSA-363107 V1.1 (Last Update: 2022-06-14): An Improper Initialization Vulnerability Affects SIMATIC WinCC Kiosk Mode

Titel

SSA-363107 V1.1 (Last Update: 2022-06-14): An Improper Initialization Vulnerability Affects SIMATIC WinCC Kiosk Mode

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-363107.pdf

Text

A vulnerability was found in SIMATIC WinCC that could allow authenticated attackers to escape the Kiosk Mode. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

SSA-330556 V1.0: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034)

Titel

SSA-330556 V1.0: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034)

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-330556.pdf

Text

The products listed below contain a local privilege escalation vulnerability (CVE-2021-4034) found on polkit’s pkexec utility, that could allow an unprivileged user to gain administrative rights. Siemens has released updates for the affected products and recommends to update to the latest versions.

SSA-324955 V1.8 (Last Update: 2022-06-14): SAD DNS Attack in Linux Based Products

Titel

SSA-324955 V1.8 (Last Update: 2022-06-14): SAD DNS Attack in Linux Based Products

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-324955.pdf

Text

A vulnerability made public under the name SAD DNS affects Domain Name System resolvers due to a vulnerability in the Linux kernel when handling ICMP packets. The Siemens products which are affected are listed below. For more information please see https://www.saddns.net/. Siemens has released updates for several affected products and ...

SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization

Titel

SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf

Text

Siemens has released updates for JT2Go, Solid Edge and Teamcenter Visualization to fix multiple file parsing vulnerabilities. If a user is tricked to open a malicious file (crafted as PDF, DXF or PAR) with any of the affected products, this could lead the application to crash or potentially lead to ...

SSA-254054 V1.2 (Last Update: 2022-06-14): Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impac...

Titel

SSA-254054 V1.2 (Last Update: 2022-06-14): Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf

Text

A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as “Spring4Shell” or “SpringShell”. Siemens is currently investigating to determine which products are affected and is continuously updating this advisory as ...

SSA-244969 V1.5 (Last Update: 2022-06-14): OpenSSL Vulnerability in Industrial Products

Titel

SSA-244969 V1.5 (Last Update: 2022-06-14): OpenSSL Vulnerability in Industrial Products

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf

Text

OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1l and 1.0.2 < 1.0.2za that allows an attacker to cause a denial of service (DoS) or to disclose private memory content. Siemens has released updates for several affected products and recommends to update to ...

SSA-220589 V1.0: Hard Coded Default Credential Vulnerability in Teamcenter

Titel

SSA-220589 V1.0: Hard Coded Default Credential Vulnerability in Teamcenter

Veröffentlicht

14. Juni 2022 02:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-220589.pdf

Text

Siemens has released updates for Teamcenter that fixes a security vulnerability related to unsecure storage of user credentials. This vulnerability affects Java EE Server Manager HTML Adaptor. This service is not installed by default and currently also obsoleted. Siemens has released updates for the affected products and recommends to update ...

Mittwoch, 08.06.2022

00:00

US CERT

AA22-158A: People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices

Titel

AA22-158A: People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices

Veröffentlicht

8. Juni 2022 00:00

URL

https://us-cert.cisa.gov/ncas/alerts/aa22-158a

Text

Original release date: June 7, 2022SummaryBest Practices • Apply patches as soon as possible • Disable unnecessary ports and protocols • Replace end-of-life infrastructure • Implement a centralized patch management system This joint Cybersecurity Advisory describes the ways in which People’s Republic of China (PRC) state-sponsored cyber actors continue to ...

Dienstag, 07.06.2022

16:00

Mitsubishi Electric MELSEC and MELIPC Series (Update C)

Titel

Mitsubishi Electric MELSEC and MELIPC Series (Update C)

Veröffentlicht

7. Juni 2022 16:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-21-334-02

Text

This updated advisory is a follow up to the advisory update titled ICSA-21-334-02 Mitsubishi Electric MELSEC and MELIPC Series (Update B) that was published April 26, 2022, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for Uncontrolled Resource Consumption, Improper Handling of Length Parameter Inconsistency, and Improper Input ...

Freitag, 03.06.2022

21:00

Vulnerabilities Affecting Dominion Voting Systems ImageCast X

Titel

Vulnerabilities Affecting Dominion Voting Systems ImageCast X

Veröffentlicht

3. Juni 2022 21:00

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-154-01

Text

This advisory contains mitigations for Improper Verification of Cryptographic Signature, Mutable Attestation of Measurement Reporting Data, Hidden Functionality, Improper Protection of Alternate Path, Path Traversal: ''../filedir', Execution with Unnecessary Privileges, Authentication Bypass Spoofing, Incorrect Privilege Assignment, and Origin Validation Error vulnerabilities in versions of Dominion Voting Systems Democracy Suite ImageCast ...

Donnerstag, 02.06.2022

16:05

Carrier LenelS2 HID Mercury access panels

Titel

Carrier LenelS2 HID Mercury access panels

Veröffentlicht

2. Juni 2022 16:05

URL

https://us-cert.cisa.gov/ics/advisories/icsa-22-153-01

Text

This advisory contains mitigations for Protection Mechanism Failure, Forced Browsing, Classic Buffer Overflow, Path Traversal, and OS Command Injection vulnerabilities in Carrier HID Mercury access panels sold by LenlS2.

16:00