Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-37175 State: PUBLISHED Published: 2021-09-14T10:47:43 Last Updated: 2024-08-04T01:16:02.802Z Vendors: Siemens Products: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX1511, RUGGEDCOM ROX RX1512, RUGGEDCOM ROX RX1524, RUGGEDCOM ROX RX1536, RUGGEDCOM ROX RX5000 Problem Types: CWE-280 Description: A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions
M ROX RX1501 (All versions < V2.14.1), RUGGEDCOM ROX RX1510 (All versions < V2.14.1), RUGGEDCOM ROX RX1511 (All versions < V2.14.1), RUGGEDCOM ROX RX1512 (All versions < V2.14.1), RUGGEDCOM ROX RX1524 (All versions < V2.14.1), RUGGEDCOM ROX RX1536 (All versions < V2.14.1), RUGGEDCOM ROX RX5000 (All versions < V2.14.1). The affected devices do not properly handle permissions to traverse the file system. If exploited, an attacker could gain access to an overview of the complete file system on the affected devices. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-150692.pdf
CVE ID: CVE-2021-37176 State: PUBLISHED Published: 2021-09-14T10:47:44 Last Updated: 2024-08-04T01:16:03.578Z Vendors: Siemens Products: Simcenter Femap V2020.2, Simcenter Femap V2021.1 Problem Types: CWE-125 Description: A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). The femap.exe application lacks proper validation of user-supplied data when parsing modfem files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14260) Additional Analyst Notes: - CVE Program Container: Referenc
ation in the context of the current process. (ZDI-CAN-14260) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-997732.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-1073/
CVE ID: CVE-2021-37177 State: PUBLISHED Published: 2021-09-14T10:47:45.000Z Last Updated: 2025-04-23T19:28:31.544Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-471 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The status provided by the syslog clients managed by the affected software can be manipulated by an unauthenticated attacker in the same network of the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-334944.pdf
CVE ID: CVE-2021-37178 State: PUBLISHED Published: 2021-08-10T10:35:34 Last Updated: 2024-08-04T01:16:02.862Z Vendors: Siemens Products: Solid Edge SE2021 Problem Types: CWE-611 Description: A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). An XML external entity injection vulnerability in the underlying XML parser could cause the affected application to disclose arbitrary files to remote attackers by loading a specially crafted xml file. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf
CVE ID: CVE-2021-37179 State: PUBLISHED Published: 2021-08-10T10:35:35 Last Updated: 2024-08-04T01:16:03.915Z Vendors: Siemens Products: Solid Edge SE2021 Problem Types: CWE-416 Description: A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library in affected application lacks proper validation while parsing user-supplied OBJ files that could lead to a use-after-free condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13777) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf - https://www.zeroday
VE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-1114/
CVE ID: CVE-2021-37180 State: PUBLISHED Published: 2021-08-10T10:35:36 Last Updated: 2024-08-04T01:16:03.774Z Vendors: Siemens Products: Solid Edge SE2021 Problem Types: CWE-824 Description: A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library lacks proper validation while parsing user-supplied OBJ files that could cause an out of bounds access to an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13775) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf - https://www.zerodayi
E Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-818688.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-1113/
CVE ID: CVE-2021-37181 State: PUBLISHED Published: 2021-09-14T10:47:46 Last Updated: 2024-08-04T01:16:03.922Z Vendors: Siemens Products: Cerberus DMS V4.0, Cerberus DMS V4.1, Cerberus DMS V4.2, Cerberus DMS V5.0, Desigo CC Compact V4.0, Desigo CC Compact V4.1, Desigo CC Compact V4.2, Desigo CC Compact V5.0, Desigo CC V4.0, Desigo CC V4.1, Desigo CC V4.2, Desigo CC V5.0 Problem Types: CWE-502 Description: A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), Cerberus DMS V5.0 (All versions < v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All
< v5.0 QU1), Desigo CC Compact V4.0 (All versions), Desigo CC Compact V4.1 (All versions), Desigo CC Compact V4.2 (All versions), Desigo CC Compact V5.0 (All versions < V5.0 QU1), Desigo CC V4.0 (All versions), Desigo CC V4.1 (All versions), Desigo CC V4.2 (All versions), Desigo CC V5.0 (All versions < V5.0 QU1). The application deserialises untrusted data without sufficient validations, that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system. The CCOM communication component used for Windows App / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability. Additional Analyst Notes: - CVE
p / Click-Once and IE Web / XBAP client connectivity are affected by the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-453715.pdf
CVE ID: CVE-2021-37182 State: PUBLISHED Published: 2022-06-14T09:21:24 Last Updated: 2024-08-04T01:16:03.731Z Vendors: Siemens Products: SCALANCE XM408-4C, SCALANCE XM408-4C (L3 int.), SCALANCE XM408-8C, SCALANCE XM408-8C (L3 int.), SCALANCE XM416-4C, SCALANCE XM416-4C (L3 int.), SCALANCE XR524-8C, 1x230V, SCALANCE XR524-8C, 1x230V (L3 int.), SCALANCE XR524-8C, 24V, SCALANCE XR524-8C, 24V (L3 int.), SCALANCE XR524-8C, 2x230V, SCALANCE XR524-8C, 2x230V (L3 int.), SCALANCE XR526-8C, 1x230V, SCALANCE XR526-8C, 1x230V (L3 int.), SCALANCE XR526-8C, 24V, SCALANCE XR526-8C, 24V (L3 int.), SCALANCE XR526-8C, 2x230V, SCALANCE XR526-8C, 2x230V (L3 int.), SCALANCE XR528-6M, SCALANCE XR528-6M (2HR2), SC
3 int.), SCALANCE XR526-8C, 2x230V, SCALANCE XR526-8C, 2x230V (L3 int.), SCALANCE XR528-6M, SCALANCE XR528-6M (2HR2), SCALANCE XR528-6M (2HR2, L3 int.), SCALANCE XR528-6M (L3 int.), SCALANCE XR552-12M, SCALANCE XR552-12M (2HR2), SCALANCE XR552-12M (2HR2, L3 int.) Problem Types: CWE-354 Description: A vulnerability has been identified in SCALANCE XM408-4C (All versions < V6.5), SCALANCE XM408-4C (L3 int.) (All versions < V6.5), SCALANCE XM408-8C (All versions < V6.5), SCALANCE XM408-8C (L3 int.) (All versions < V6.5), SCALANCE XM416-4C (All versions < V6.5), SCALANCE XM416-4C (L3 int.) (All versions < V6.5), SCALANCE XR524-8C, 1x230V (All versions < V6.5), SCALANCE XR524-8C, 1x230V (L3 int.)
C (L3 int.) (All versions < V6.5), SCALANCE XR524-8C, 1x230V (All versions < V6.5), SCALANCE XR524-8C, 1x230V (L3 int.) (All versions < V6.5), SCALANCE XR524-8C, 24V (All versions < V6.5), SCALANCE XR524-8C, 24V (L3 int.) (All versions < V6.5), SCALANCE XR524-8C, 2x230V (All versions < V6.5), SCALANCE XR524-8C, 2x230V (L3 int.) (All versions < V6.5), SCALANCE XR526-8C, 1x230V (All versions < V6.5), SCALANCE XR526-8C, 1x230V (L3 int.) (All versions < V6.5), SCALANCE XR526-8C, 24V (All versions < V6.5), SCALANCE XR526-8C, 24V (L3 int.) (All versions < V6.5), SCALANCE XR526-8C, 2x230V (All versions < V6.5), SCALANCE XR526-8C, 2x230V (L3 int.) (All versions < V6.5), SCALANCE XR528-6M (All versio
, 2x230V (All versions < V6.5), SCALANCE XR526-8C, 2x230V (L3 int.) (All versions < V6.5), SCALANCE XR528-6M (All versions < V6.5), SCALANCE XR528-6M (2HR2) (All versions < V6.5), SCALANCE XR528-6M (2HR2, L3 int.) (All versions < V6.5), SCALANCE XR528-6M (L3 int.) (All versions < V6.5), SCALANCE XR552-12M (All versions < V6.5), SCALANCE XR552-12M (2HR2) (All versions < V6.5), SCALANCE XR552-12M (2HR2) (All versions < V6.5), SCALANCE XR552-12M (2HR2, L3 int.) (All versions < V6.5). The OSPF protocol implementation in affected devices fails to verify the checksum and length fields in the OSPF LS Update messages. An unauthenticated remote attacker could exploit this vulnerability to cause inter
ields in the OSPF LS Update messages. An unauthenticated remote attacker could exploit this vulnerability to cause interruptions in the network by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-145224.pdf
CVE ID: CVE-2021-37183 State: PUBLISHED Published: 2021-09-14T10:47:47.000Z Last Updated: 2025-04-23T19:28:21.026Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-284 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software allows sending send-to-sleep notifications to the managed devices. An unauthenticated attacker in the same network of the affected system can abuse these notifications to cause a Denial-of-Service condition in the managed devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-334
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-334944.pdf
CVE ID: CVE-2021-37184 State: PUBLISHED Published: 2021-09-14T10:47:48 Last Updated: 2024-08-04T01:16:02.802Z Vendors: Siemens Products: Industrial Edge Management Problem Types: CWE-639 Description: A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could change the the password of any user in the system under certain circumstances. With this an attacker could impersonate any valid user on an affected system. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-692317.pdf
CVE ID: CVE-2021-37185 State: PUBLISHED Published: 2022-02-09T15:16:44.000Z Last Updated: 2025-04-18T18:33:19.110Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-1500 Software Controller, SIMATIC S7-PLCSIM Advanced, SIPLUS TIM 1531 IRC, TIM 1531 IRC Problem Types: CWE-672 Description: A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4),
2 Description: A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V21.9 < V21.9.4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions >= V4.5.0 < V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.9.2 < V2.9.4), SIMATIC S7-1500 Software Controller (All versions >= V21.9 < V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions >= V4.0 < V4.0 SP1), SIPLUS TIM 1531 IRC (All versions < V2.3.6), TIM 1531 IRC (All versions < V2.3.6). An unauthenticated attacker could cause a denial-of-service c
versions < V2.3.6), TIM 1531 IRC (All versions < V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-838121.pdf
CVE ID: CVE-2021-37186 State: PUBLISHED Published: 2021-09-14T10:47:49 Last Updated: 2024-08-04T01:16:03.873Z Vendors: Siemens Products: LOGO! CMR2020, LOGO! CMR2040, SIMATIC RTU3010C, SIMATIC RTU3030C, SIMATIC RTU3031C, SIMATIC RTU3041C Problem Types: CWE-330 Description: A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versions < V4.0.9), SIMATIC RTU3030C (All versions < V4.0.9), SIMATIC RTU3031C (All versions < V4.0.9), SIMATIC RTU3041C (All versions < V4.0.9). The underlying TCP/IP stack does not properly calculate the random numbers used as ISN (Initial Sequence Numbers). An adjacent attacker with netw
ck does not properly calculate the random numbers used as ISN (Initial Sequence Numbers). An adjacent attacker with network access to the LAN interface could interfere with traffic, spoof the connection and gain access to sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-316383.pdf
CVE ID: CVE-2021-37187 State: PUBLISHED Published: 2021-12-10T12:24:20 Last Updated: 2024-08-04T01:16:03.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file (with reversible passwords) from the device, which allows decoding of other users' passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.digi.com/search/results?q=transport - https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
CVE ID: CVE-2021-37188 State: PUBLISHED Published: 2021-12-10T12:46:43 Last Updated: 2024-08-04T01:16:02.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firmware (because the bootloader does not verify that it is authentic), changing the behavior of the gateway. Additional Analyst Notes: - CVE Program Container: References: - https://www.digi.com/search/results?q=transport - https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
CVE ID: CVE-2021-37189 State: PUBLISHED Published: 2021-12-10T12:47:50 Last Updated: 2024-08-04T01:16:03.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session. Additional Analyst Notes: - CVE Program Container: References: - https://www.digi.com/search/results?q=transport - https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/main/2021-04.txt
CVE ID: CVE-2021-37190 State: PUBLISHED Published: 2021-09-14T10:47:50.000Z Last Updated: 2025-04-23T19:28:10.985Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-200 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerability that could allow an attacker to retrieve VPN connection for a known user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-334944.pdf
CVE ID: CVE-2021-37191 State: PUBLISHED Published: 2021-09-14T10:47:50.000Z Last Updated: 2025-04-23T19:28:04.964Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-799 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could brute force the usernames from the affected software. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-334944.pdf
CVE ID: CVE-2021-37192 State: PUBLISHED Published: 2021-09-14T10:47:51.000Z Last Updated: 2025-04-23T19:27:58.554Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-200 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software has an information disclosure vulnerability that could allow an attacker to retrieve a list of network devices a known user can manage. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-334944.pdf
CVE ID: CVE-2021-37193 State: PUBLISHED Published: 2021-09-14T10:47:52.000Z Last Updated: 2025-04-23T19:27:52.584Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-471 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could manipulate certain parameters and set a valid user of the affected software as invalid (or vice-versa). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-334944.pdf
CVE ID: CVE-2021-37194 State: PUBLISHED Published: 2022-02-09T15:16:48 Last Updated: 2024-08-04T01:16:04.049Z Vendors: Siemens Products: COMOS V10.2, COMOS V10.3, COMOS V10.4 Problem Types: CWE-434 Description: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS allows to upload and store arbitrary files at the webserver. This could allow an attacker to store malicious files. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/pr
ore malicious files. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf
CVE ID: CVE-2021-37195 State: PUBLISHED Published: 2022-01-11T11:27:13 Last Updated: 2024-08-04T01:16:03.965Z Vendors: Siemens Products: COMOS V10.2, COMOS V10.3, COMOS V10.4 Problem Types: CWE-80 Description: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS accepts arbitrary code as attachment to tasks. This could allow an attacker to inject malicious code that is executed when loading the attachment. Additional Analyst Notes: - CVE Program Container: References: - http
code that is executed when loading the attachment. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf
CVE ID: CVE-2021-37196 State: PUBLISHED Published: 2022-01-11T11:27:13 Last Updated: 2024-08-04T01:16:03.964Z Vendors: Siemens Products: COMOS V10.2, COMOS V10.3, COMOS V10.4 Problem Types: CWE-23 Description: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.3 (All versions >= V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS unpacks specially crafted archive files to relative paths. This vulnerability could allow an attacker to store files in any folder accessible b
ed archive files to relative paths. This vulnerability could allow an attacker to store files in any folder accessible by the COMOS Web webservice. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf
CVE ID: CVE-2021-37197 State: PUBLISHED Published: 2022-01-11T11:27:14 Last Updated: 2024-08-04T01:16:02.881Z Vendors: Siemens Products: COMOS V10.2, COMOS V10.3, COMOS V10.4 Problem Types: CWE-89 Description: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS is vulnerable to SQL injections. This could allow an attacker to execute arbitrary SQL statements. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-
s. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf
CVE ID: CVE-2021-37198 State: PUBLISHED Published: 2022-01-11T11:27:15.000Z Last Updated: 2025-05-22T18:33:35.849Z Vendors: Siemens Products: COMOS V10.2, COMOS V10.3, COMOS V10.4 Problem Types: CWE-352 Description: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS uses a flawed implementation of CSRF prevention. An attacker could exploit this vulnerability to perform cross-site request forgery attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric
ity to perform cross-site request forgery attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf
CVE ID: CVE-2021-37199 State: PUBLISHED Published: 2021-10-12T09:49:37 Last Updated: 2024-08-04T01:16:03.969Z Vendors: Siemens Products: SINUMERIK 808D, SINUMERIK 828D Problem Types: CWE-122 Description: A vulnerability has been identified in SINUMERIK 808D (All versions), SINUMERIK 828D (All versions < V4.95). Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-178380.pdf
CVE ID: CVE-2021-37200 State: PUBLISHED Published: 2021-09-14T10:47:53 Last Updated: 2024-08-04T01:16:03.975Z Vendors: Siemens Products: SINEC NMS Problem Types: CWE-22 Description: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). An attacker with access to the webserver of an affected system could download arbitrary files from the underlying filesystem by sending a specially crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-330339.pdf