Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ase-summary-2021?applicable_category=Windows&applicable_version=3.7&deployment_date=2021-11-26&id=1386541 - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Chrome%20OS&applicable_version=1.10.1&deployment_date=2023-03-10&id=1447771 - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Android&applicable_version=1.10.2&deployment_date=2023-03-09&id=1447706 - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=iOS&applicable_version=1.9.3&deployment_date=2023-03-03&id=1447071 - https://help.zscaler.com/client-connector/client-connector-
icable_version=1.9.3&deployment_date=2023-03-03&id=1447071 - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.4&deployment_date=2022-10-31&id=1420246 - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=macOS&applicable_version=3.9&deployment_date=2023-01-25&id=1443546
CVE ID: CVE-2023-28801 State: PUBLISHED Published: 2023-08-31T13:53:11.266Z Last Updated: 2024-10-01T17:51:21.271Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Zscaler Products: ZIA Admin Portal Problem Types: CWE-347 Description: An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/zia/release-upgrade-summary-2023
CVE ID: CVE-2023-28802 State: PUBLISHED Published: 2023-11-21T10:51:50.755Z Last Updated: 2024-12-02T20:51:20.463Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Zscaler Products: Client Connector Problem Types: CWE-354 Description: An Improper Validation of Integrity Check Value in Zscaler Client Connector on Windows allows an authenticated user to disable ZIA/ZPA by interrupting the service restart from Zscaler Diagnostics. This issue affects Client Connector: before 4.2.0.149. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applic
P Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=Windows&applicable_version=4.2
CVE ID: CVE-2023-28803 State: PUBLISHED Published: 2023-10-23T13:32:17.505Z Last Updated: 2024-09-11T14:31:41.067Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Zscaler Products: Client Connector Problem Types: CWE-290 Description: An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023
CVE ID: CVE-2023-28804 State: PUBLISHED Published: 2023-10-23T13:33:19.903Z Last Updated: 2024-10-17T15:09:55.800Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Zscaler Products: Client Connector Problem Types: CWE-347 Description: An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023
CVE ID: CVE-2023-28805 State: PUBLISHED Published: 2023-10-23T13:33:57.278Z Last Updated: 2025-02-27T20:39:25.528Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: Zscaler Products: Client Connector Problem Types: CWE-78 Description: An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0.105 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023
CVE ID: CVE-2023-28806 State: PUBLISHED Published: 2024-08-06T15:41:01.883Z Last Updated: 2024-08-06T17:30:31.651Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Zscaler Products: Client Connector Problem Types: CWE-347 Description: An Improper Validation of signature in Zscaler Client Connector on Windows allows an authenticated user to disable anti-tampering. This issue affects Client Connector on Windows <4.2.0.190. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023?applicable_category=windows&applicable_version=4.2.0.190
CVE ID: CVE-2023-28807 State: PUBLISHED Published: 2024-01-31T19:16:59.806Z Last Updated: 2025-06-17T21:29:19.136Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Zscaler Products: ZIA Problem Types: CWE-295 Description: In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello's Server Name Indication (SNI) enables attackers to evade network security controls by hiding their communications within legitimate traffic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.zscaler.com/zia/configuring-advanced-settings#domain-fronting - https://help.zscaler.com/zia/configuring-advanced-sett
p.zscaler.com/zia/configuring-advanced-settings#domain-fronting - https://help.zscaler.com/zia/configuring-advanced-settings#dns-optimization
CVE ID: CVE-2023-28808 State: PUBLISHED Published: 2023-04-11T00:00:00.000Z Last Updated: 2025-02-07T19:35:13.163Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: hikvision Products: DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D, DS-A71024/48R-CVS,DS-A72024/48R-CVS Problem Types: CWE-284 Description: Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://w
he affected devices. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/
CVE ID: CVE-2023-28809 State: PUBLISHED Published: 2023-06-15T00:00:00 Last Updated: 2024-12-18T16:24:05.385Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: hikvision Products: DS-K1T804AXX, DS-K1T341AXX, DS-K1T671XXX, DS-K1T343XXX, DS-K1T341C, DS-K1T320XXX Problem Types: CWE-284 Description: Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user. Add
valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/ - http://packetstormsecurity.com/files/174506/Hikvision-Access-Control-Session-Hijacking.html
CVE ID: CVE-2023-28810 State: PUBLISHED Published: 2023-06-15T00:00:00 Last Updated: 2024-12-12T21:10:28.899Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: hikvision Products: DS-K1T804AXX, DS-K1T341AXX, DS-K1T671XXX, DS-K1T343XXX, DS-K1T341C, DS-K1T320XXX, DS-KH63 Series,DS-KH85 Series, DS-KH9310-WTE1(B),DS-KH9510-WTE1(B) Problem Types: CWE-284 Description: Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the same local network. Additional Analyst Notes: - CVE Program Con
ific data packets to the vulnerable interface within the same local network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/
CVE ID: CVE-2023-28811 State: PUBLISHED Published: 2023-11-23T06:42:01.522Z Last Updated: 2024-08-02T13:51:38.312Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Hikvision Products: iDS-EXXHUH, DS-EXXHGH, iDS-EXXHQH, DVR-EXXHUH, DVR-EXXHGH, DVR-EXXHQH, iDS-72XXHQH-M(C), iDS-72XXHUH-M(C), iDS-72XXHQH-M(E), iDS-72XXHUH-M(E), iDS-72XXHTH-M(C), HW-HWD-72XXMH-G4, HW-HWD-62XXMH-G4, HL-DVR-216Q-K2(E), DS-71XXHGH-M(C), DS-72XXHGH-M(C), DS-71XXHGH-K(S), DS-72XXHGH-K(S), HL-DVR-1XXG-K(S), HL-DVR-2XXG-K(S), HL-DVR-1XXG-M(C), HL-DVR-2XXG-M(C), HW-HWD-51XXH(S), HW-HWD-51XXH-G, HW-HWD-51XXMH-G, iDS-71xxHQH-M(C), iDS-71xxHQH-M(E), iDS-72xxHQH-M/E(C), iDS-72xxHQH-M/E(E), HL-
XXH(S), HW-HWD-51XXH-G, HW-HWD-51XXMH-G, iDS-71xxHQH-M(C), iDS-71xxHQH-M(E), iDS-72xxHQH-M/E(C), iDS-72xxHQH-M/E(E), HL-DVR-2XXQ-M(C), HL-DVR-2XXQ-M(E), HW-HWD-61XXMH-G4, HW-HWD-61XXMH-G4(E), iDS-71xxHUH-M(C), iDS-72xxHUH-M/E(C), iDS-71xxHUH-M(E), iDS-72xxHUH-M/E(E), HL-DVR-2XXU-M(C), HL-DVR-2XXU-M(E), HW-HWD-71XXMH-G4, HW-HWD-71XXMH-G4(E), NVR-2xxMH-C(D), NVR-1xxMH-C(D), HW-HWN-42xxMH(D), HW-HWN-41xxMH(D), DS-71xxNI-Q1(C), DS-71xxNI-Q1(D), HL-NVR-1xxMH-D(C), HL-NVR-1xxMH-D(D), HW-HWN-21xxMH(C), HW-HWN-21xxMH(D), DS-76xxNI-Q1(C), DS-76xxNI-Q2(C), DS-76xxNI-K1(C), HW-HWN-41xxMH(C), HW-HWN-42xxMH(C), HL-NVR-1xxMH-C(C), HL-NVR-2xxMH-C(C), DS-77xxNI-I4(B) Description: There is a buffer overflow
xMH(C), HW-HWN-42xxMH(C), HL-NVR-1xxMH-C(C), HL-NVR-2xxMH-C(C), DS-77xxNI-I4(B) Description: There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device. Additional Analyst Notes: - CVE Program Container: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/buffer-overflow-vulnerability-in-hikvision-nvr-dvr-devices/
CVE ID: CVE-2023-28812 State: PUBLISHED Published: 2023-11-23T08:35:01.739Z Last Updated: 2024-12-02T19:42:18.930Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Hikvision Products: LocalServiceComponents Description: There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers installed with this plug-in, which could lead to arbitrary code execution or cause process exception of the plug-in. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-
r: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-web-browser-plug-in-locals/
CVE ID: CVE-2023-28813 State: PUBLISHED Published: 2023-11-23T08:37:35.720Z Last Updated: 2024-08-02T13:51:38.639Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) Vendors: Hikvision Products: LocalServiceComponents Description: An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files. Additional Analyst Notes: - CVE Program Container: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-web-browser-plug-in-locals/
CVE ID: CVE-2023-28814 State: PUBLISHED Published: 2025-10-17T11:07:06.801Z Last Updated: 2025-10-17T13:04:24.853Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hikvision Products: iSecure Center Description: Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded, attackers may upload malicious files to the server. iSecure Center is software released for China's domestic market only, with no overseas release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/2023-0
: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/2023-03/
CVE ID: CVE-2023-28815 State: PUBLISHED Published: 2025-10-17T11:07:26.306Z Last Updated: 2025-10-17T12:10:16.930Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hikvision Products: iSecure Center Description: Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability. Attackers may exploit this to gain platform privileges and execute arbitrary commands on the system.iSecure Center is software released for China's domestic market only, with no overseas release. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/cn/support/Cybersecurit
ease. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/2023-04/
CVE ID: CVE-2023-28818 State: PUBLISHED Published: 2023-03-24T00:00:00.000Z Last Updated: 2025-02-19T21:20:19.702Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:N/C:N/I:L/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors. Additional Analyst Notes: - CVE Program Container: - CI
ver, which might then be downloaded and installed on collectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veritas.com/content/support/en_US/security/VTS23-002
CVE ID: CVE-2023-28819 State: PUBLISHED Published: 2023-04-28T00:00:00 Last Updated: 2024-08-02T13:51:38.701Z Severity: LOW (CVSS 3.5 CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder names. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/concretecms/concretecms/releases - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20 - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-c
y-advisory-2023-04-20 - https://www.concretecms.org/about/project-news/security/2023-11-09-security-blog-about-updated-cves-and-new-release
CVE ID: CVE-2023-28820 State: PUBLISHED Published: 2023-04-28T00:00:00.000Z Last Updated: 2025-01-31T16:09:34.124Z Severity: LOW (CVSS 2 CVSS:3.1/AC:H/AV:N/A:N/C:L/I:N/PR:H/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
CVE ID: CVE-2023-28821 State: PUBLISHED Published: 2023-04-28T00:00:00.000Z Last Updated: 2025-01-30T20:47:58.107Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/concretecms/concretecms/releases - https://www.concretecms.org/about/project-news/security/concrete-cms-security-advisory-2023-04-20
CVE ID: CVE-2023-28823 State: PUBLISHED Published: 2023-08-11T02:37:17.988Z Last Updated: 2024-10-15T19:05:50.922Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) oneAPI Toolkit and component software installers Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/inte
m Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00890.html
CVE ID: CVE-2023-28824 State: PUBLISHED Published: 2023-06-01T00:00:00 Last Updated: 2025-01-09T19:29:17.173Z Vendors: Contec Co., Ltd. Products: CONPROSYS HMI System (CHS) Problem Types: Server-side request forgery Description: Server-side request forgery vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may bypass the database restriction set on the query setting page, and connect to a user unintended database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info
Vulnrichment: References: - https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdf - https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdf - https://jvn.jp/en/vu/JVNVU93372935/
CVE ID: CVE-2023-28826 State: PUBLISHED Published: 2024-03-08T01:35:28.817Z Last Updated: 2025-11-04T18:14:31.574Z Vendors: Apple Products: macOS, iOS and iPadOS Problem Types: An app may be able to access sensitive user data Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS Sonoma 14.1, macOS Ventura 13.6.5. An app may be able to access sensitive user data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/HT214083 - https://support.apple.com/en-us/HT213984 - https://support.apple.com/en-us/HT214082 -
upport.apple.com/en-us/HT214083 - https://support.apple.com/en-us/HT213984 - https://support.apple.com/en-us/HT214082 - https://support.apple.com/en-us/HT214085 - https://support.apple.com/kb/HT213984 - http://seclists.org/fulldisclosure/2024/Mar/22 - http://seclists.org/fulldisclosure/2024/Mar/23
CVE ID: CVE-2023-28827 State: PUBLISHED Published: 2024-09-10T09:33:37.794Z Last Updated: 2024-09-10T15:11:03.085Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CP 1242-7 V2 (incl. SIPLUS variants), SIMATIC CP 1243-1 (incl. SIPLUS variants), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants), SIMATIC CP 1243-7 LTE, SIMATIC CP 1243-8 IRC, SIMATIC HMI Comfort Panels (incl. SIPLUS variants), SIMATIC IPC DiagBase, SIMATIC IPC DiagMonitor, SIMATIC WinCC Runtime Advanced, SIPLUS TIM 1531 IRC, TIM 1531 IRC Problem Types: CWE-476 Description: A vulnerability has been identified in S
Advanced, SIPLUS TIM 1531 IRC, TIM 1531 IRC Problem Types: CWE-476 Description: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-7 LTE (All versions < V3.5.20), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.5.20), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMATIC WinCC Runtime Advanced (All
ions), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMATIC WinCC Runtime Advanced (All versions), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). The web server of the affected devices do not properly handle certain requests, causing a timeout in the watchdog, which could lead to the clean up of pointers. This could allow a remote attacker to cause a denial of service condition in the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-423808.html
CVE ID: CVE-2023-28828 State: PUBLISHED Published: 2023-04-11T09:03:06.681Z Last Updated: 2025-02-07T16:50:02.207Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: Polarion ALM Problem Types: CWE-611 Description: A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-632164.pdf
CVE ID: CVE-2023-28829 State: PUBLISHED Published: 2023-06-13T08:17:07.989Z Last Updated: 2025-01-03T01:52:55.603Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC NET PC Software V14, SIMATIC NET PC Software V15, SIMATIC PCS 7 V8.2, SIMATIC PCS 7 V9.0, SIMATIC PCS 7 V9.1, SIMATIC WinCC, SINAUT Software ST7sc Problem Types: CWE-477 Description: A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Softwar
IMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-508677.pdf