SIEMENS CERT
09/08/2020
Multiple cross-site scripting (XSS) vulnerabilities were found in the subversion webclient of Polarion. In addition, the webclient doesn’t have any cross-site request forgery (CSRF) protection. An attacker could inject client side script to induce the victim to issue an HTTP request that would lead to a state changing operation. Siemens …
SIEMENS CERT
09/08/2020
A vulnerability has been identified in SIMATIC S7-300 and S7-400 CPU families, which could result in credential disclosure. Siemens recommends countermeasures as there are currently no fixes available.
SIEMENS CERT
09/08/2020
The latest update for SIMATIC RTLS Locating Manager fixes various vulnerabilities that could allow a low-privileged local user to escalate privileges. Siemens recommends to apply the update of the SIMATIC RTLS Locating Manager.
SIEMENS CERT
08/11/2020
The latest update for the below listed products fixes two security vulnerabilities that could allow an attacker to cause a partial Denial-of-Service on the UMC component of the affected devices under certain circumstances, and one vulnerability that could allow an attacker to locally escalate privileges from a user with administrative …
SIEMENS CERT
08/11/2020
The latest update for SICAM A8000 RTUs fixes a vulnerability that could allow attackers with network access to the device’s web server to perform a stored Cross-Site-Scripting attack. Siemens has released an update for SICAM A8000 RTUs and recommends to update as soon as possible.
SIEMENS CERT
08/11/2020
The latest update for Automation License Manager (ALM) fixes a vulnerability that could allow local users to locally escalate privileges and modify files that should be protected against writing. Siemens has released an update for ALM 6 and recommends that customers update to the latest version. Siemens recommends specific countermeasures …
SIEMENS CERT
08/11/2020
An information disclosure vulnerability (CVE-2019-15126, also known as Kr00k) could allow an attacker to read a discrete set of traffic over the air after a Wi-Fi device state change. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available.
SIEMENS CERT
08/11/2020
The extension module Advanced Reporting for Desigo CC and Desigo CC Compact contains a code injection vulnerability, which could be exploited if the extension module is installed on the server and configured. Siemens has released patches for the affected products and recommends specific countermeasures for unpatched systems.