Devices of the SIPROTEC 5 family contain a vulnerability related to secure client-initiated renegotiation. This could allow an unauthenticated attacker to cause a denial of service condition for the duration of the attack. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet ...
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious TIF, CGM or PDF files. If a user is tricked to open a malicious TIF, CGM or PDF file with the affected products, this could lead the application to ...
SCALANCE X devices might not generate a unique random key after factory reset, and use a private key shipped with the firmware. Siemens has released updates for the affected products and recommends to update to the latest versions.
A vulnerability in the third party component SISCO MMS-EASE could allow attackers to cause a denial of service condition with SIPROTEC 5 devices. Siemens has released updates for the affected products and recommends to update to the latest versions.
Parasolid is affected by out of bounds read/write vulnerabilities that could be triggered when the application reads files in X_B format. If a user is tricked to open a malicious file with the affected applications, an attacker could leverage the vulnerability to perform remote code execution in the context of ...
The Siemens PLM Help Server V4.2 for documentation contains a reflected cross-site scripting vulnerability. This product has reached end of life, and security vulnerabilities are no longer patched. Siemens has released a new version of Documentation Server that resolves this vulnerability. See the chapter “Additional Information” below for more details.
The web server login page of affected products does not apply proper origin checking. This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.. Siemens has released updates for several affected products and recommends to update to the latest versions. ...
The products listed below do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific ...
The SSH server on RUGGEDCOM ROS devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device. Siemens has released updates for several affected products ...
Several SCALANCE X switches are affected by an Authentication Bypass vulnerability. The vulnerability allows an unauthenticated attacker to violate access-control rules. The vulnerability can be exploited by sending a GET request to a specific uniform resource locator on the web configuration interface of the device. The security vulnerability could be ...
The Mendix Email Connector module improperly handles access control for some module entities. This could allow authenticated remote attackers to read and manipulate sensitive information. Mendix has released an update for the Mendix Email Connector module and recommends to update to the latest version.