Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-7560 State: PUBLISHED Published: 2020-12-11T00:52:30 Last Updated: 2024-08-04T09:33:19.451Z Vendors: n/a Products: EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions) Problem Types: CWE-123 Description: A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions), that could cause a crash of the software or unexpected code execution when opening a malicious file in EcoStruxure™ Control Expert software. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/down
Control Expert software. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-343-01/
CVE ID: CVE-2020-7561 State: PUBLISHED Published: 2020-11-19T00:00:00 Last Updated: 2024-08-04T09:33:19.875Z Vendors: n/a Products: Easergy T300 with firmware 2.7 and older Problem Types: CWE-284 Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T300 (with firmware 2.7 and older) that could cause a wide range of problems, including information exposure, denial of service, and command execution when access to a resource from an attacker is not restricted or incorrectly restricted. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-06/ - https://us-cert.cisa.gov/ics/advisor
ainer: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-06/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-03
CVE ID: CVE-2020-7562 State: PUBLISHED Published: 2020-11-18T13:54:32 Last Updated: 2024-08-04T09:33:19.944Z Vendors: n/a Products: Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) Problem Types: CWE-125 Description: A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP. Additional Analyst Notes: - CVE Program Container: References: -
ng a specially crafted file on the controller over FTP. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
CVE ID: CVE-2020-7563 State: PUBLISHED Published: 2020-11-18T13:50:57 Last Updated: 2024-08-04T09:33:19.765Z Vendors: n/a Products: Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) Problem Types: CWE-787 Description: A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP. Additional Analyst Notes: - CVE Program Container: Referen
ploading a specially crafted file on the controller over FTP. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
CVE ID: CVE-2020-7564 State: PUBLISHED Published: 2020-11-18T13:51:16 Last Updated: 2024-08-04T09:33:19.905Z Vendors: n/a Products: Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) Problem Types: CWE-120 Description: A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP. Additional
ite access and the execution of commands when uploading a specially crafted file on the controller over FTP. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
CVE ID: CVE-2020-7565 State: PUBLISHED Published: 2020-11-19T21:10:09 Last Updated: 2024-08-04T09:33:19.843Z Vendors: n/a Products: Modicon M221, all references, all versions Problem Types: CWE-326 Description: A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-05/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
CVE ID: CVE-2020-7566 State: PUBLISHED Published: 2020-11-19T21:10:22 Last Updated: 2024-08-04T09:33:19.452Z Vendors: n/a Products: Modicon M221, all references, all versions Problem Types: CWE-334 Description: A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-05/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
CVE ID: CVE-2020-7567 State: PUBLISHED Published: 2020-11-19T21:10:27 Last Updated: 2024-08-04T09:33:19.454Z Vendors: n/a Products: Modicon M221, all references, all versions Problem Types: CWE-311 Description: A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke the encryption keys. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-05/ - https://us-cert.cisa.gov/ics/advisories/ic
References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-05/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
CVE ID: CVE-2020-7568 State: PUBLISHED Published: 2020-11-19T21:10:33 Last Updated: 2024-08-04T09:33:19.638Z Vendors: n/a Products: Modicon M221, all references, all versions Problem Types: CWE-200 Description: A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-05/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-
s: - https://www.se.com/ww/en/download/document/SEVD-2020-315-05/ - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
CVE ID: CVE-2020-7569 State: PUBLISHED Published: 2020-11-19T21:02:16 Last Updated: 2024-08-04T09:33:19.872Z Vendors: n/a Products: EcoStruxure Building Operation WebReports V1.9 - V3.1 Problem Types: CWE-434 Description: A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE ID: CVE-2020-7570 State: PUBLISHED Published: 2020-11-19T21:02:22 Last Updated: 2024-08-04T09:33:19.689Z Vendors: n/a Products: EcoStruxure Building Operation WebReports V1.9 - V3.1 Problem Types: CWE-79 Description: A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users. Additional Analyst Notes: - CVE Program Container: References: - https://w
stored attack against other WebReport users. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE ID: CVE-2020-7571 State: PUBLISHED Published: 2020-11-19T21:02:28 Last Updated: 2024-08-04T09:33:19.782Z Vendors: n/a Products: EcoStruxure Building Operation WebReports V1.9 - V3.1 Problem Types: CWE-79 Description: A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a Cross-Site Scripting reflected attack against other WebReport users. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.c
attack against other WebReport users. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE ID: CVE-2020-7572 State: PUBLISHED Published: 2020-11-19T21:02:39 Last Updated: 2024-08-04T09:33:19.950Z Vendors: n/a Products: EcoStruxure Building Operation WebReports V1.9 - V3.1 Problem Types: CWE-611 Description: A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SE
L parser. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE ID: CVE-2020-7573 State: PUBLISHED Published: 2020-11-19T21:02:45 Last Updated: 2024-08-04T09:33:19.573Z Vendors: n/a Products: EcoStruxure Building Operation WebReports V1.9 - V3.1 Problem Types: CWE-284 Description: A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control. Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2020-315-04/
CVE ID: CVE-2020-7574 State: PUBLISHED Published: 2020-04-14T19:50:54 Last Updated: 2024-08-04T09:33:19.576Z Vendors: Siemens Products: Climatix POL908 (BACnet/IP module), Climatix POL909 (AWM module) Problem Types: CWE-79 Description: A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the "Server Config" web interface of the affected devices that could allow an attacker to inject arbitrary JavaScript code. The code could be potentially executed later by another (possibly privileged) user. The security vulnerability could be exploited by
ld be potentially executed later by another (possibly privileged) user. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires no system privileges. An attacker could use the vulnerability to compromise the confidentiality and integrity of other users' web session. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-886514.pdf
CVE ID: CVE-2020-7575 State: PUBLISHED Published: 2020-04-14T19:50:54 Last Updated: 2024-08-04T09:33:19.843Z Vendors: Siemens Products: Climatix POL908 (BACnet/IP module), Climatix POL909 (AWM module) Problem Types: CWE-80 Description: A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitrary JavaScript code via specially crafted GET requests. The code could be potentially executed later by another (privileged) user. The security vulnerabilit
afted GET requests. The code could be potentially executed later by another (privileged) user. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires no system privileges. An attacker could use the vulnerability to compromise the confidentiality and integrity of other users' web sessions. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-886514.pdf
CVE ID: CVE-2020-7576 State: PUBLISHED Published: 2020-07-14T13:18:05 Last Updated: 2024-08-04T09:33:19.929Z Vendors: Siemens Products: Camstar Enterprise Platform, Opcenter Execution Core Problem Types: CWE-79 Description: A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2), Opcenter Execution Core (V8.2). An authenticated user with the ability to create containers, packages or register defects could perform stored Cross-Site Scripting (XSS) attacks within the vulnerable software. The impact of this attack could result in the session cookies of legitimate users being stolen. Should the attacker gain access to these
is attack could result in the session cookies of legitimate users being stolen. Should the attacker gain access to these cookies, they could then hijack the session and perform arbitrary actions in the name of the victim. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf
CVE ID: CVE-2020-7577 State: PUBLISHED Published: 2020-07-14T13:18:05 Last Updated: 2024-08-04T09:33:19.769Z Vendors: Siemens Products: Camstar Enterprise Platform, Opcenter Execution Core Problem Types: CWE-89 Description: A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2). Through the use of several vulnerable fields of the application, an authenticated user could perform an SQL Injection attack by passing a modified SQL query downstream to the back-end server. The exploit of this vulnerability could be used to read, and potentially modify application data to which the user has access to. Additional Analyst Notes
could be used to read, and potentially modify application data to which the user has access to. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf
CVE ID: CVE-2020-7578 State: PUBLISHED Published: 2020-07-14T13:18:05 Last Updated: 2024-08-04T09:33:19.916Z Vendors: Siemens Products: Camstar Enterprise Platform, Opcenter Execution Core Problem Types: CWE-284 Description: A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2). Authenticated users could have access to resources they normally would not have. This vulnerability could allow an attacker to view internal information and perform unauthorized changes. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf
CVE ID: CVE-2020-7579 State: PUBLISHED Published: 2020-03-10T19:16:17 Last Updated: 2024-08-04T09:33:19.698Z Vendors: Siemens AG Products: Spectrum Power™ 5 Problem Types: CWE-80 Description: A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. If deployed according to recommended system configuration, Siemens consideres the environmental vector as CR:L/IR:M/AR:H/MAV:A (4.1). Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/pr
:M/AR:H/MAV:A (4.1). Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-938930.pdf
CVE ID: CVE-2020-7580 State: PUBLISHED Published: 2020-06-10T00:00:00 Last Updated: 2024-08-04T09:33:19.492Z Vendors: Siemens Products: SIMATIC Automation Tool, SIMATIC NET PC Software V14, SIMATIC NET PC Software V15, SIMATIC NET PC Software V16, SIMATIC PCS neo, SIMATIC ProSave, SIMATIC S7-1500 Software Controller, SIMATIC STEP 7 (TIA Portal) V13, SIMATIC STEP 7 (TIA Portal) V14, SIMATIC STEP 7 (TIA Portal) V15, SIMATIC STEP 7 (TIA Portal) V16, SIMATIC STEP 7 V5, SIMATIC WinCC OA V3.16, SIMATIC WinCC OA V3.17, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional V13, SIMATIC WinCC Runtime Professional V14, SIMATIC WinCC Runtime Professional V15, SIMATIC WinCC Runtime Professi
onal V13, SIMATIC WinCC Runtime Professional V14, SIMATIC WinCC Runtime Professional V15, SIMATIC WinCC Runtime Professional V16, SIMATIC WinCC V7.4, SIMATIC WinCC V7.5, SINAMICS STARTER, SINAMICS Startdrive, SINEC NMS, SINEMA Server, SINUMERIK ONE virtual, SINUMERIK Operate Problem Types: CWE-428 Description: A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Upd3), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC ProSave (All versions < V17), SIMATIC S7-1500 Software Controller (All versions < V21.
All versions < V3.0 SP1), SIMATIC ProSave (All versions < V17), SIMATIC S7-1500 Software Controller (All versions < V21.8), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2 Update 4), SIMATIC STEP 7 (TIA Portal) V14 (All versions < V14 SP1 Update 10), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMATIC STEP 7 V5 (All versions < V5.6 SP2 HF3), SIMATIC WinCC OA V3.16 (All versions < V3.16 P018), SIMATIC WinCC OA V3.17 (All versions < V3.17 P003), SIMATIC WinCC Runtime Advanced (All versions < V16 Update 2), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2 Update 4), SIMATIC WinCC Runtime Pr
ions < V16 Update 2), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2 Update 4), SIMATIC WinCC Runtime Professional V14 (All versions < V14 SP1 Update 10), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Update 5), SIMATIC WinCC Runtime Professional V16 (All versions < V16 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions < V7.5 SP1 Update 3), SINAMICS STARTER (All Versions < V5.4 HF2), SINAMICS Startdrive (All Versions < V16 Update 3), SINEC NMS (All versions < V1.0 SP2), SINEMA Server (All versions < V14 SP3), SINUMERIK ONE virtual (All Versions < V6.14), SINUMERIK Operate (All Versions < V6.14). A common compone
ons < V14 SP3), SINUMERIK ONE virtual (All Versions < V6.14), SINUMERIK Operate (All Versions < V6.14). A common component used by the affected applications regularly calls a helper binary with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to execute arbitrary code with SYTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-312271.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-161-04
CVE ID: CVE-2020-7581 State: PUBLISHED Published: 2020-07-14T13:18:05 Last Updated: 2024-08-04T09:33:19.617Z Vendors: Siemens Products: Opcenter Execution Discrete, Opcenter Execution Foundation, Opcenter Execution Process, Opcenter Intelligence, Opcenter Quality, Opcenter RD&L, SIMATIC Notifier Server for Windows, SIMATIC PCS neo, SIMATIC STEP 7 (TIA Portal) V15, SIMATIC STEP 7 (TIA Portal) V16, SIMOCODE ES V15.1, SIMOCODE ES V16, Soft Starter ES V15.1, Soft Starter ES V16 Problem Types: CWE-428 Description: A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions <
e (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). A component within the affected appli
All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). A component within the affected application calls a helper binary with SYSTEM privileges during startup while the call path is not quoted. This could allow a local attacker with administrative privileges to execute code with SYSTEM level privileges. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-841348.pdf
CVE ID: CVE-2020-7583 State: PUBLISHED Published: 2020-08-14T15:24:06 Last Updated: 2024-08-04T09:33:19.886Z Vendors: Siemens AG Products: Automation License Manager 5, Automation License Manager 6 Problem Types: CWE-285 Description: A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0.8). The application does not properly validate the users' privileges when executing some operations, which could allow a user with low permissions to arbitrary modify files that should be protected against writing. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-
g. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-388646.pdf
CVE ID: CVE-2020-7584 State: PUBLISHED Published: 2020-07-14T13:18:05 Last Updated: 2024-08-04T09:33:19.577Z Vendors: Siemens AG Products: SIMATIC S7-200 SMART CPU family Problem Types: CWE-400 Description: A vulnerability has been identified in SIMATIC S7-200 SMART CPU family (All versions >= V2.2 < V2.5.1). Affected devices do not properly handle large numbers of new incomming connections and could crash under certain circumstances. An attacker may leverage this to cause a Denial-of-Service situation. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-589181.pdf
CVE ID: CVE-2020-7585 State: PUBLISHED Published: 2020-06-10T16:23:39 Last Updated: 2024-08-04T09:33:19.945Z Vendors: Siemens Products: SIMATIC PCS 7 V8.2 and earlier, SIMATIC PCS 7 V9.0, SIMATIC PDM, SIMATIC STEP 7 V5.X, SINAMICS STARTER (containing STEP 7 OEM version) Problem Types: CWE-427 Description: A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges