October 2024
08.10.2024
SIEMENS CERT
SSA-999588 V1.6 (Last Update: 2024-10-08): Multiple Vulnerabilities in User Management Component (UMC) Before V2.11.2
Title
SSA-999588 V1.6 (Last Update: 2024-10-08): Multiple Vulnerabilities in User Management Component (UMC) Before V2.11.2
Published
Oct. 8, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-999588.html
Summary
Siemens User Management Component (UMC) before V2.11.2 is affected by multiple vulnerabilities where the most severe could lead to a restart of the UMC server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends ...
08.10.2024
SIEMENS CERT
SSA-962515 V1.3 (Last Update: 2024-10-08): Out of Bounds Read Vulnerability in Industrial Products
Title
SSA-962515 V1.3 (Last Update: 2024-10-08): Out of Bounds Read Vulnerability in Industrial Products
Published
Oct. 8, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-962515.html
Summary
Several industrial products contain an out of bounds read vulnerability that could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel, leading to denial of service condition. Siemens has released new versions for several affected products and recommends to update to the ...
08.10.2024
SIEMENS CERT
SSA-698820 V1.3 (Last Update: 2024-10-08): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices
Title
SSA-698820 V1.3 (Last Update: 2024-10-08): Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices
Published
Oct. 8, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-698820.html
Summary
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens recommends to consult and implement the workarounds provided in Fortinet’s upstream security notifications.
08.10.2024
SIEMENS CERT
SSA-455250 V1.4 (Last Update: 2024-10-08): Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Dev...
Title
SSA-455250 V1.4 (Last Update: 2024-10-08): Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.2-h3
Published
Oct. 8, 2024, 2 a.m.
URL
https://cert-portal.siemens.com/productcert/html/ssa-455250.html
Summary
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version of Palo Alto Networks Virtual NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Customers are advised to ...
03.10.2024
US CERT (ICS)
TEM Opera Plus FM Family Transmitter
Title
TEM Opera Plus FM Family Transmitter
Published
Oct. 3, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-277-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: TEM Equipment: Opera Plus FM Family Transmitter Vulnerabilities: Missing Authentication for Critical Function, Cross-Site Request Forgery (CSRF) 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to perform remote code ...
02.10.2024
BOSCH PSIRT
Multiple vulnerabilites in libexpat affecting PRC7000
Title
Multiple vulnerabilites in libexpat affecting PRC7000
Published
Oct. 2, 2024, 2 a.m.
URL
https://psirt.bosch.com/security-advisories/bosch-sa-200802.html
Summary

BOSCH-SA-200802: Multiple vulnerabilities were discovered in the open source library \"libexpat\", affecting the XML parser functionality. These vulnerabilities allow for integer overflows and invalid negative values for buffer sizes. As this may affect the \"Import\" and \"Restore\" functionality - which use libexpat to parse XML files - of the device, ...

01.10.2024
US CERT (ICS)
Mitsubishi Electric MELSEC iQ-F FX5-OPC
Title
Mitsubishi Electric MELSEC iQ-F FX5-OPC
Published
Oct. 1, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: MELSEC iQ-F FX5-OPC Vulnerability: NULL Pointer Dereference 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to cause a Denial-of-Service (DoS) condition on the product by getting a legitimate ...
01.10.2024
US CERT (ICS)
Optigo Networks ONS-S8 Spectra Aggregation Switch
Title
Optigo Networks ONS-S8 Spectra Aggregation Switch
Published
Oct. 1, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Optigo Networks Equipment: ONS-S8 - Spectra Aggregation Switch Vulnerabilities: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), Weak Authentication 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an ...
01.10.2024
BOSCH PSIRT
Sensitive information disclosure in Bosch Configuration Manager
Title
Sensitive information disclosure in Bosch Configuration Manager
Published
Oct. 1, 2024, 2 a.m.
URL
https://psirt.bosch.com/security-advisories/bosch-sa-981803-bt.html
Summary

BOSCH-SA-981803-BT: A vulnerability was discovered during internal testing of the Bosch Configuration Manager, which may temporarily store sensitive information of the configured system.

September 2024
30.09.2024
US CERT
Iranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations
Title
Iranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations
Published
Sept. 30, 2024, 6:28 p.m.
URL
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-290a
Summary
Summary The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Communications Security Establishment Canada (CSE), the Australian Federal Police (AFP), and Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) are releasing this joint Cybersecurity Advisory to warn network defenders ...
26.09.2024
US CERT (ICS)
goTenna Pro X and Pro X2 (Update A)
Title
goTenna Pro X and Pro X2 (Update A)
Published
Sept. 26, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Low attack complexity Vendor: goTenna Equipment: Pro series Vulnerabilities: Weak Password Requirements, Insecure Storage of Sensitive Information, Missing Support for Integrity Check, Cleartext Transmission of Sensitive Information, Improper Restriction of Communication Channel to Intended Endpoints, Use of Cryptographically Weak Pseudo-Random Number ...
26.09.2024
US CERT (ICS)
goTenna Pro ATAK Plugin
Title
goTenna Pro ATAK Plugin
Published
Sept. 26, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION: Low attack complexity Vendor: goTenna Equipment: Pro ATAK Plugin Vulnerabilities: Weak Password Requirements, Insecure Storage of Sensitive Information, Missing Support for Integrity Check, Cleartext Transmission of Sensitive Information, Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Weak Authentication, Insertion of Sensitive ...
26.09.2024
US CERT (ICS)
Advantech ADAM-5630
Title
Advantech ADAM-5630
Published
Sept. 26, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.5 ATTENTION: Low attack complexity Vendor: Advantech Equipment: ADAM-5630 Vulnerabilities: Use of Persistent Cookies Containing Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to hijack a legitimate user's session, perform cross-site request forgery, or cause a denial-of-service ...
26.09.2024
US CERT (ICS)
Advantech ADAM-5550
Title
Advantech ADAM-5550
Published
Sept. 26, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Low attack complexity Vendor: Advantech Equipment: ADAM-5550 Vulnerabilities: Weak Encoding for Password, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow a remote attacker to intercept the easily decodable credentials of a legitimate user to gain full access ...
26.09.2024
US CERT (ICS)
goTenna Pro X and Pro X2
Title
goTenna Pro X and Pro X2
Published
Sept. 26, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Low attack complexity Vendor: goTenna Equipment: Pro series Vulnerabilities: Weak Password Requirements, Insecure Storage of Sensitive Information, Missing Support for Integrity Check, Cleartext Transmission of Sensitive Information, Improper Restriction of Communication Channel to Intended Endpoints, Use of Cryptographically Weak Pseudo-Random Number ...
26.09.2024
US CERT (ICS)
Atelmo Atemio AM 520 HD Full HD Satellite Receiver
Title
Atelmo Atemio AM 520 HD Full HD Satellite Receiver
Published
Sept. 26, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Atelmo Equipment: Atemio AM 520 HD Full HD Satellite Receiver Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthorized attacker to execute system commands with elevated ...
24.09.2024
US CERT (ICS)
Moxa MXview One
Title
Moxa MXview One
Published
Sept. 24, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Moxa Equipment: MXview One, MXview One Central Manager Series Vulnerabilities: Cleartext Storage In A File or On Disk, Path Traversal, Time-of-Check Time-of-Use Race Condition 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker ...
24.09.2024
US CERT (ICS)
OPW Fuel Management Systems SiteSentinel
Title
OPW Fuel Management Systems SiteSentinel
Published
Sept. 24, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-01
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: OPW Fuel Managements Systems Equipment: SiteSentinel Vulnerability: Missing Authentication For Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to bypass authentication and obtain full administrative privileges to the server. 3. ...
24.09.2024
US CERT (ICS)
Alisonic Sibylla
Title
Alisonic Sibylla
Published
Sept. 24, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-02
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Alisonic Equipment: Sibylla Vulnerability: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 2. RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker obtaining device information from the database, dumping ...
24.09.2024
US CERT (ICS)
Franklin Fueling Systems TS-550 EVO
Title
Franklin Fueling Systems TS-550 EVO
Published
Sept. 24, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Franklin Fueling Systems Equipment: TS-550 EVO Automatic Tank Gauge Vulnerability: Absolute Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability allow an attacker to gain administrative access over the affected device. 3. TECHNICAL DETAILS 3.1 ...
24.09.2024
US CERT (ICS)
OMNTEC Proteus Tank Monitoring
Title
OMNTEC Proteus Tank Monitoring
Published
Sept. 24, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-06
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: OMNTEC Mfg., Inc. Equipment: Proteus Tank Monitoring Vulnerability: Missing Authentication for Critical Function 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform administrative actions without proper authentication. 3. TECHNICAL DETAILS 3.1 ...
24.09.2024
US CERT (ICS)
Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE
Title
Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE
Published
Sept. 24, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Dover Fueling Solutions (DFS) Equipment: ProGauge MAGLINK LX CONSOLE Vulnerabilities: Command Injection, Improper Privilege Management, Use of Hard-coded Password, Cross-site Scripting, Authentication Bypass Using an Alternate Path or Channel 2. RISK EVALUATION Successful exploitation of these ...
19.09.2024
US CERT
CISA Adds One Known Exploited Vulnerability to Catalog
Title
CISA Adds One Known Exploited Vulnerability to Catalog
Published
Sept. 19, 2024, 5:28 p.m.
URL
https://www.cisa.gov/news-events/alerts/2024/09/19/cisa-adds-one-known-exploited-vulnerability-catalog
Summary
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive ...
19.09.2024
US CERT (ICS)
IDEC CORPORATION WindLDR and WindO/I-NV4
Title
IDEC CORPORATION WindLDR and WindO/I-NV4
Published
Sept. 19, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-03
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: IDEC Corporation Equipment: WindLDR, WindO/I-NV4 Vulnerability: Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of WindLDR ...
19.09.2024
US CERT (ICS)
Kastle Systems Access Control System
Title
Kastle Systems Access Control System
Published
Sept. 19, 2024, 2 p.m.
URL
https://www.cisa.gov/news-events/ics-advisories/icsa-24-263-05
Summary
View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Kastle Systems Equipment: Access Control System Vulnerabilities: Use of Hard-coded Credentials, Cleartext Storage of Sensitive Information 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information on the affected product. ...

Last Updates

BOSCH PSIRT
10.06.2025
SIEMENS CERT
17.06.2025
US CERT
12.06.2025
US CERT (ICS)
17.06.2025

By Source

Archive

2025
2024
2023
2022
2021
2020
2019
2018
2017

Feeds