Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
y crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE ID: CVE-2024-23800 State: PUBLISHED Published: 2024-02-13T09:00:15.818Z Last Updated: 2024-08-01T23:13:08.487Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-476 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service co
CVE ID: CVE-2024-23801 State: PUBLISHED Published: 2024-02-13T09:00:16.989Z Last Updated: 2024-08-01T23:13:07.365Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-476 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted SPP files. An attacker could leverage this vulnerability to crash the application causing denial of service co
CVE ID: CVE-2024-23802 State: PUBLISHED Published: 2024-02-13T09:00:18.318Z Last Updated: 2025-05-09T18:27:19.902Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-125 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of th
d structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE ID: CVE-2024-23803 State: PUBLISHED Published: 2024-02-13T09:00:19.548Z Last Updated: 2025-05-09T18:27:39.819Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-787 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions < V2302.0007). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current proc
le parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE ID: CVE-2024-23804 State: PUBLISHED Published: 2024-02-13T09:00:20.764Z Last Updated: 2024-08-21T17:39:08.064Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Tecnomatix Plant Simulation V2201, Tecnomatix Plant Simulation V2302 Problem Types: CWE-121 Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0012), Tecnomatix Plant Simulation V2302 (All versions < V2302.0006). The affected applications contain a stack overflow vulnerability while parsing specially crafted PSOBJ files. This could allow an attacker to execute code in the context of the current process. Additiona
ially crafted PSOBJ files. This could allow an attacker to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-017796.html
CVE ID: CVE-2024-23805 State: PUBLISHED Published: 2024-02-14T16:30:25.339Z Last Updated: 2025-05-12T15:06:55.185Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-131 Description: Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. For the Application Visibility and Reporting module, this may occur when the HTTP Analytics profile with URLs enabled under Collected Entities is configured on a virtual server and the DB variables avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI are enabled. For BIG-IP Advanced WAF and ASM, this may occur when either a DoS or Bot Defense profile is con
nameFromURI are enabled. For BIG-IP Advanced WAF and ASM, this may occur when either a DoS or Bot Defense profile is configured on a virtual server and the DB variables avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI are enabled. Note: The DB variables avr.IncludeServerInURI and avr.CollectOnlyHostnameFromURI are not enabled by default. For more information about the HTTP Analytics profile and the Collect URLs setting, refer to K30875743: Create a new Analytics profile and attach it to your virtual servers https://my.f5.com/manage/s/article/K30875743 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program
re versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000137334
CVE ID: CVE-2024-23806 State: PUBLISHED Published: 2024-02-07T16:23:16.889Z Last Updated: 2025-06-13T15:07:44.967Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: HID Global Products: HID iCLASS SE reader configuration cards, OMNIKEY Secure Elements reader configuration cards Problem Types: CWE-285 Description: Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 - https://www.hidglobal.com/support
CVE ID: CVE-2024-23807 State: PUBLISHED Published: 2024-02-28T13:50:39.904Z Last Updated: 2024-08-01T23:13:08.245Z Vendors: Apache Software Foundation Products: Apache Xerces C++ Problem Types: CWE-416 Description: The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisor
_DISABLE_DTD environment variable. This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/xerces-c/pull/54 - https://lists.apache.org/thread/c497tgn864tsbm8w0bo3f0d81s07zk9r
CVE ID: CVE-2024-23808 State: PUBLISHED Published: 2024-05-07T06:26:57.552Z Last Updated: 2024-08-01T23:13:08.096Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125, CWE-476 Description: in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free or cause DOS through NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-05.md
CVE ID: CVE-2024-23809 State: PUBLISHED Published: 2024-02-20T15:29:33.826Z Last Updated: 2025-11-04T18:28:53.520Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: The Biosig Project Products: libbiosig Problem Types: CWE-415 Description: A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .vdhr file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerab
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-1919
CVE ID: CVE-2024-23810 State: PUBLISHED Published: 2024-02-13T09:00:21.960Z Last Updated: 2025-05-09T18:27:53.038Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SINEC NMS Problem Types: CWE-89 Description: A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application is vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-943925.html
CVE ID: CVE-2024-23811 State: PUBLISHED Published: 2024-02-13T09:00:23.301Z Last Updated: 2024-08-27T14:27:23.272Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SINEC NMS Problem Types: CWE-434 Description: A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-943925.html
CVE ID: CVE-2024-23812 State: PUBLISHED Published: 2024-02-13T09:00:24.566Z Last Updated: 2024-08-16T19:11:29.535Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SINEC NMS Problem Types: CWE-78 Description: A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application incorrectly neutralizes special elements when creating a report which could lead to command injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-943925.html
CVE ID: CVE-2024-23813 State: PUBLISHED Published: 2024-02-13T09:00:25.915Z Last Updated: 2025-05-09T18:28:11.158Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: Polarion ALM Problem Types: CWE-287 Description: A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-871717.html
CVE ID: CVE-2024-23814 State: PUBLISHED Published: 2025-02-11T10:28:33.403Z Last Updated: 2025-07-10T10:53:47.525Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: SIDOOR ATD430W, SIDOOR ATE530G COATED, SIDOOR ATE530S COATED, SIMATIC CFU DIQ, SIMATIC CFU PA, SIMATIC ET 200AL IM 157-1 PN, SIMATIC ET 200M IM 153-4 PN IO HF, SIMATIC ET 200M IM 153-4 PN IO ST, SIMATIC ET 200MP IM 155-5 PN BA, SIMATIC ET 200MP IM 155-5 PN HF, SIMATIC ET 200MP IM 155-5 PN ST, SIMATIC ET 200pro IM 154-3 PN HF, SIMATIC ET 200pro IM 154-4 PN HF, SIMATIC ET 200pro IM 154-8 PN/DP CPU, SIMATIC ET 200pro IM 154-8F PN/DP CPU, SIMATIC ET 200pro IM 154-8FX PN/
4-4 PN HF, SIMATIC ET 200pro IM 154-8 PN/DP CPU, SIMATIC ET 200pro IM 154-8F PN/DP CPU, SIMATIC ET 200pro IM 154-8FX PN/DP CPU, SIMATIC ET 200S IM 151-3 PN FO, SIMATIC ET 200S IM 151-3 PN HF, SIMATIC ET 200S IM 151-3 PN HS, SIMATIC ET 200S IM 151-3 PN ST, SIMATIC ET 200S IM 151-8 PN/DP CPU, SIMATIC ET 200S IM 151-8F PN/DP CPU, SIMATIC ET 200SP CPU 1510SP F-1 PN, SIMATIC ET 200SP CPU 1510SP-1 PN, SIMATIC ET 200SP CPU 1512SP F-1 PN, SIMATIC ET 200SP CPU 1512SP-1 PN, SIMATIC ET 200SP IM 155-6 MF HF, SIMATIC ET 200SP IM 155-6 PN BA, SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants), SIMATIC ET 200SP IM 155-6 PN HF, SIMATIC ET 200SP IM 155-6 PN HS, SIMATIC ET 200SP IM 155-6 PN ST, SIMATIC E
variants), SIMATIC ET 200SP IM 155-6 PN HF, SIMATIC ET 200SP IM 155-6 PN HS, SIMATIC ET 200SP IM 155-6 PN ST, SIMATIC ET 200SP IM 155-6 PN ST BA, SIMATIC ET 200SP IM 155-6 PN/2 HF, SIMATIC ET 200SP IM 155-6 PN/3 HF, SIMATIC PN/PN Coupler, SIMATIC Power Line Booster PLB, Base Module, SIMATIC Power Line Booster PLB, Modem Module ST, SIMATIC S7-1200 CPU 1211C AC/DC/Rly, SIMATIC S7-1200 CPU 1211C DC/DC/DC, SIMATIC S7-1200 CPU 1211C DC/DC/Rly, SIMATIC S7-1200 CPU 1212C AC/DC/Rly, SIMATIC S7-1200 CPU 1212C DC/DC/DC, SIMATIC S7-1200 CPU 1212C DC/DC/Rly, SIMATIC S7-1200 CPU 1212FC DC/DC/DC, SIMATIC S7-1200 CPU 1212FC DC/DC/Rly, SIMATIC S7-1200 CPU 1214C AC/DC/Rly, SIMATIC S7-1200 CPU 1214C DC/DC/DC
DC/DC/DC, SIMATIC S7-1200 CPU 1212FC DC/DC/Rly, SIMATIC S7-1200 CPU 1214C AC/DC/Rly, SIMATIC S7-1200 CPU 1214C DC/DC/DC, SIMATIC S7-1200 CPU 1214C DC/DC/Rly, SIMATIC S7-1200 CPU 1214FC DC/DC/DC, SIMATIC S7-1200 CPU 1214FC DC/DC/Rly, SIMATIC S7-1200 CPU 1215C AC/DC/Rly, SIMATIC S7-1200 CPU 1215C DC/DC/DC, SIMATIC S7-1200 CPU 1215C DC/DC/Rly, SIMATIC S7-1200 CPU 1215FC DC/DC/DC, SIMATIC S7-1200 CPU 1215FC DC/DC/Rly, SIMATIC S7-1200 CPU 1217C DC/DC/DC, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 15
SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-300 CPU 314C-2 PN/DP, SIMATIC S7-300 CPU 315-2 PN/DP, SIMATIC S7-300 CPU 315F-2 PN/DP, SIMATIC S7-300 CPU 315T-3 PN/DP, SIMATIC S7-300 CPU 317-2 PN/DP, SIMATIC S7-300 CPU 317F-2 PN/DP, SIMATIC S7-300 CPU 317T-3 PN/DP, SIMATIC S7-300 CPU 317TF-3 PN/DP, SIMATIC S7-300 CPU 319-3 PN/DP, SIMATIC S7-300 CPU 319F-3 PN/DP, SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants), SIMATIC TDC CP
ATIC S7-410 V10 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants), SIMATIC TDC CP51M1, SIMATIC TDC CPU555, SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants), SIMOCODE pro V PROFINET, SINUMERIK 840D sl, SIPLUS ET 200M IM 153-4 PN IO HF, SIPLUS ET 200M IM 153-4 PN IO ST, SIPLUS ET 200MP IM 155-5 PN HF, SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL, SIPLUS ET 200MP IM 155-5 PN ST, SIPLUS ET 200MP IM 155-5 PN ST TX RAIL, SIPLUS ET 200S IM 151-8 PN/DP CPU, SIPLUS ET 200S IM 151-8F PN/DP CPU, SIPLUS ET 200S IM151-3 PN HF, SIPLUS ET 200S IM151-3 PN ST, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP IM 155-6 PN HF, SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL, SIPLUS E
ST, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP IM 155-6 PN HF, SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL, SIPLUS ET 200SP IM 155-6 PN HF TX RAIL, SIPLUS ET 200SP IM 155-6 PN ST, SIPLUS ET 200SP IM 155-6 PN ST BA, SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL, SIPLUS ET 200SP IM 155-6 PN ST TX RAIL, SIPLUS HCS4200 CIM4210, SIPLUS HCS4200 CIM4210C, SIPLUS HCS4300 CIM4310, SIPLUS NET PN/PN Coupler, SIPLUS S7-1200 CPU 1212 AC/DC/RLY, SIPLUS S7-1200 CPU 1212 DC/DC/RLY, SIPLUS S7-1200 CPU 1212C DC/DC/DC, SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL, SIPLUS S7-1200 CPU 1214 AC/DC/RLY, SIPLUS S7-1200 CPU 1214 DC/DC/DC, SIPLUS S7-1200 CPU 1214 DC/DC/RLY, SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL, SIPLUS S7-
SIPLUS S7-1200 CPU 1214 DC/DC/DC, SIPLUS S7-1200 CPU 1214 DC/DC/RLY, SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL, SIPLUS S7-1200 CPU 1214FC DC/DC/DC, SIPLUS S7-1200 CPU 1214FC DC/DC/RLY, SIPLUS S7-1200 CPU 1215 AC/DC/RLY, SIPLUS S7-1200 CPU 1215 DC/DC/DC, SIPLUS S7-1200 CPU 1215 DC/DC/RLY, SIPLUS S7-1200 CPU 1215C DC/DC/DC, SIPLUS S7-1200 CPU 1215FC DC/DC/DC, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516F-3 PN/DP, SIPLUS S7-300 CPU 314C-2 PN/DP, SIPLUS S7-300 CPU 315-2 PN/DP, SIPLUS S7-300 CPU 315F-2 PN/DP, SIPLUS S7-300 CPU 317-2 PN/DP, SIPLUS S7-300 CPU 317F-2 PN
IPLUS S7-300 CPU 315-2 PN/DP, SIPLUS S7-300 CPU 315F-2 PN/DP, SIPLUS S7-300 CPU 317-2 PN/DP, SIPLUS S7-300 CPU 317F-2 PN/DP, SIWAREX WP231, SIWAREX WP241, SIWAREX WP251, SIWAREX WP521 ST, SIWAREX WP522 ST Problem Types: CWE-400 Description: The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment re-assembly. This could allow an unauthenticated remote attacker to cause a temporary denial of service condition of the ICMP service, other communication services are not affected. Affected devices will resume normal operation after the attack terminates. Additional An
tion services are not affected. Affected devices will resume normal operation after the attack terminates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-769027.html - https://cert-portal.siemens.com/productcert/html/ssa-725549.html
CVE ID: CVE-2024-23815 State: PUBLISHED Published: 2025-05-13T09:38:11.730Z Last Updated: 2025-05-13T19:04:43.460Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: Desigo CC Problem Types: CWE-306 Description: A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networks outside of a highly protected zone), Desigo CC (All versions if access from Installed Clients to Desigo CC server is only allowed within highly protected zones). The affected server application fails to authenticate specific client requests. Modification of the client binary could allow an unauthent
r application fails to authenticate specific client requests. Modification of the client binary could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database via the event port (default: 4998/tcp) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-523418.html
CVE ID: CVE-2024-23816 State: PUBLISHED Published: 2024-02-13T09:00:27.125Z Last Updated: 2025-05-09T18:28:24.829Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Location Intelligence Perpetual Large, Location Intelligence Perpetual Medium, Location Intelligence Perpetual Non-Prod, Location Intelligence Perpetual Small, Location Intelligence SUS Large, Location Intelligence SUS Medium, Location Intelligence SUS Non-Prod, Location Intelligence SUS Small Problem Types: CWE-798 Description: A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intellig
s been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secr
.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-580228.html
CVE ID: CVE-2024-23817 State: PUBLISHED Published: 2024-01-25T19:42:30.343Z Last Updated: 2025-06-17T21:19:31.064Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Dolibarr Products: dolibarr Problem Types: CWE-79, CWE-80 Description: Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document an
the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Dolibarr/d
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-7947-48q7-cp5m
CVE ID: CVE-2024-23818 State: PUBLISHED Published: 2024-03-20T17:57:38.893Z Last Updated: 2024-08-01T23:13:07.982Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: geoserver Products: geoserver Problem Types: CWE-79 Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.3 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap OpenLayer