Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-28360 State: PUBLISHED Published: 2020-11-23T20:33:13 Last Updated: 2024-08-04T16:33:59.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote attackers to request server-side resources or potentially execute arbitrary code through various SSRF techniques. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/private-ip - https://gith
Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/private-ip - https://github.com/frenchbread/private-ip
CVE ID: CVE-2020-28361 State: PUBLISHED Published: 2020-11-18T13:34:23 Last Updated: 2024-08-04T16:33:59.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue. Additional Analyst Notes: - CVE Program Con
art/duration accounting mechanisms leading potentially to a loss of revenue. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/159030/Kamailio-5.4.0-Header-Smuggling.html - https://support.sippysoft.com/support/discussions/topics/3000179616
CVE ID: CVE-2020-28362 State: PUBLISHED Published: 2020-11-18T16:27:38 Last Updated: 2024-08-04T16:33:59.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rd02e75766cd333a0df417588460f5e4477060633000bfe94955851fd%40%3Cissues.trafficcontrol.apache.org%3E - https://groups.google.com/g/golang-nuts/c/c-ssaaS7RMI - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3ZSHGNTJWCWYAKY5OLZS2XQQYHSXSUO/ - https://security.netapp.com/advisory/ntap-20201202-0004/ - https://lis
t.org/message/F3ZSHGNTJWCWYAKY5OLZS2XQQYHSXSUO/ - https://security.netapp.com/advisory/ntap-20201202-0004/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4COUPL3YVTZ6RTEIT6LPBDJUFF3VSP/ - https://www.arista.com/en/support/advisories-notices/security-advisories/12166-security-advisory-62
CVE ID: CVE-2020-28364 State: PUBLISHED Published: 2020-11-09T19:19:34 Last Updated: 2024-08-04T16:33:59.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users. Additional Analyst Notes: - CVE Program Container: References: - https://docs.locust.io/en/stable/changelog.html
CVE ID: CVE-2020-28365 State: PUBLISHED Published: 2020-12-30T18:17:10 Last Updated: 2024-08-04T16:33:59.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during the login process. When an administrator looks at logs, the payload is executed. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sapplica/sentrifugo/commits/master - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020
/github.com/sapplica/sentrifugo/commits/master - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-055
CVE ID: CVE-2020-28366 State: PUBLISHED Published: 2020-11-18T00:00:00 Last Updated: 2024-08-04T16:33:58.955Z Vendors: Go toolchain Products: cmd/go, cmd/cgo Problem Types: CWE-94: Improper Control of Generation of Code ('Code Injection') Description: Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/cl/269658 - https://go.googlesource.com/go/+/062e0e5ce6df339dc26732438ad771f73dbf2292 - https://go.dev/issue/42559 - https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM - https://p
2438ad771f73dbf2292 - https://go.dev/issue/42559 - https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM - https://pkg.go.dev/vuln/GO-2022-0475
CVE ID: CVE-2020-28367 State: PUBLISHED Published: 2020-11-18T00:00:00 Last Updated: 2024-08-04T16:33:59.087Z Vendors: Go toolchain Products: cmd/go Problem Types: CWE-94: Improper Control of Generation of Code ('Code Injection') Description: Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/cl/267277 - https://go.googlesource.com/go/+/da7aa86917811a571e6634b45a457f918b8e6561 - https://go.dev/issue/42556 - https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM - https://pkg.go.dev/vuln/
6561 - https://go.dev/issue/42556 - https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM - https://pkg.go.dev/vuln/GO-2022-0476 - https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
CVE ID: CVE-2020-28368 State: PUBLISHED Published: 2020-11-10T18:17:29 Last Updated: 2024-08-04T16:33:59.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-351.html - https://platypusattack.com - https://www.zdnet.com/article/new-platypus-attack-can-steal-da
.org/xsa/advisory-351.html - https://platypusattack.com - https://www.zdnet.com/article/new-platypus-attack-can-steal-data-from-intel-cpus/ - http://xenbits.xen.org/xsa/advisory-351.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XV23EZIMNLJN4YXRRXLQV2ALW6ZEALXV/ - http://www.openwall.com/lists/oss-security/2020/11/26/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5J66QUUHXH2RR4CNCKQRGVXVSOUFRPDA/ - https://www.debian.org/security/2020/dsa-4804
CVE ID: CVE-2020-28369 State: PUBLISHED Published: 2023-12-12T00:00:00 Last Updated: 2024-08-04T16:33:59.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp. Additional Analyst Notes: - CVE Program Container: References: - https://www.beyondtrust.com/privilege-management/windows-mac - https://www.beyondtrust.com/trust-center/security-advisories/bt22-08
CVE ID: CVE-2020-28371 State: PUBLISHED Published: 2020-11-09T21:13:18 Last Updated: 2024-08-04T16:33:59.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStream.java has a boundary check to prevent out-of-bounds memory read/write operations. However, an integer overflow leads to bypassing this check and achieving the out-of-bounds access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ReadyTalk/avian/commit/0871979b298add320ca63f6506
alyst Notes: - CVE Program Container: References: - https://github.com/ReadyTalk/avian/commit/0871979b298add320ca63f65060acb7532c8a0dd - https://github.com/ReadyTalk/avian/pull/572
CVE ID: CVE-2020-28373 State: PUBLISHED Published: 2020-11-09T21:32:28 Last Updated: 2024-08-04T16:33:59.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects R6400v2 V1.0.4.102_10.0.75, R6400 V1.0.1.62_1.0.41, R7000P V1.3.2.126_10.1.66, XR300 V1.0.3.50_10.3.36, R8000 V1.0.4.62, R8300 V1.0.2.136, R8500 V1.0.2.136, R7300DST V1.0.0.74, R7850 V1.0.5.64, R7900 V1.0.4.30, RAX20 V1.0.2.64, RAX80 V1.0.3.102, and R6250 V1.0.4.44. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cpeggg/Netgear-upnpd-poc
CVE ID: CVE-2020-28374 State: PUBLISHED Published: 2021-01-13T03:07:45 Last Updated: 2024-08-04T16:33:59.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Additional Analyst Notes: - CVE Program Container: References: - ht
ions are proxied via an attacker-selected backstore. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1178372 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.7 - https://github.com/torvalds/linux/commit/2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 - https://bugzilla.suse.com/attachment.cgi?id=844938 - http://www.openwall.com/lists/oss-security/2021/01/13/2 - http://www.openwall.com/lists/oss-security/2021/01/13/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag
-security/2021/01/13/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZEUPID5DZYLZBIO4BEVLHFUDZZIFL57/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTGQDYIEO2GOCOOKADBHEITF44GY55QF/ - http://packetstormsecurity.com/files/161229/Kernel-Live-Patch-Security-Notice-LSN-0074-1.html - https://www.debian.org/security/2021/dsa-4843 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HK7SRTITN5ABAUOOIGFVR7XE5YKYYAVO/ - https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html - https://security.netapp.com/advisory/ntap-20210219-0002/ - http
s.debian.org/debian-lts-announce/2021/02/msg00018.html - https://security.netapp.com/advisory/ntap-20210219-0002/ - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
CVE ID: CVE-2020-28381 State: PUBLISHED Published: 2021-01-12T20:18:35 Last Updated: 2024-08-04T16:33:59.080Z Vendors: Siemens Products: Solid Edge SE2020, Solid Edge SE2021 Problem Types: CWE-787 Description: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write into uninitialized memory. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.co
of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-048/ - https://www.zerodayinitiative.com/advisories/ZDI-21-053/ - https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04 - https://www.zerodayinitiative.com/advisories/ZDI-21-074/
CVE ID: CVE-2020-28382 State: PUBLISHED Published: 2021-01-12T20:18:35 Last Updated: 2024-08-04T16:33:59.191Z Vendors: Siemens Products: Solid Edge SE2020, Solid Edge SE2021 Problem Types: CWE-787 Description: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in a out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-porta
the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-052/ - https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04 - https://www.zerodayinitiative.com/advisories/ZDI-21-075/
CVE ID: CVE-2020-28383 State: PUBLISHED Published: 2021-01-12T20:18:35 Last Updated: 2024-08-04T16:33:59.029Z Vendors: Siemens Products: JT2Go, Solid Edge SE2020, Solid Edge SE2021, Teamcenter Visualization Problem Types: CWE-787 Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing PAR files. This can result in an out of bounds write past the memory location that is a read only image address. An attacker could leverage this vulnerability
f bounds write past the memory location that is a read only image address. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-11885) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-622830.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-054/ - https://cert-portal.siemens.com/productcert/pdf/ssa-663999.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04 - https://www.zerodayinitiative.com/advisories/ZDI-21-047/ - https://www.zerodayinitiative.com/advisories/ZDI-21-073/
CVE ID: CVE-2020-28384 State: PUBLISHED Published: 2021-01-12T20:18:35 Last Updated: 2024-08-04T16:33:59.070Z Vendors: Siemens Products: Solid Edge SE2020, Solid Edge SE2021 Problem Types: CWE-121 Description: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could lead to a stack based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa
ss. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-055/ - https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04 - https://www.zerodayinitiative.com/advisories/ZDI-21-076/
CVE ID: CVE-2020-28385 State: PUBLISHED Published: 2021-03-15T17:03:30 Last Updated: 2024-08-04T16:33:59.024Z Vendors: Siemens Products: Solid Edge SE2020, Solid Edge SE2021 Problem Types: CWE-787 Description: A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12049) Additional Analyst Notes: - CVE Program Container: References: - h
n the context of the current process. (ZDI-CAN-12049) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-715184.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-574442.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-103-06
CVE ID: CVE-2020-28386 State: PUBLISHED Published: 2021-01-12T20:18:36 Last Updated: 2024-08-04T16:33:59.063Z Vendors: Siemens Products: Solid Edge SE2020, Solid Edge SE2021 Problem Types: CWE-787 Description: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2). Affected applications lack proper validation of user-supplied data when parsing DFT files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-port
n the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-979834.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-060/ - https://us-cert.cisa.gov/ics/advisories/icsa-21-012-04 - https://www.zerodayinitiative.com/advisories/ZDI-21-077/
CVE ID: CVE-2020-28387 State: PUBLISHED Published: 2021-03-15T17:03:30 Last Updated: 2024-08-04T16:33:59.035Z Vendors: Siemens Products: Solid Edge SE2020, Solid Edge SE2021 Problem Types: CWE-611 Description: A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). When opening a specially crafted SEECTCXML file, the application could disclose arbitrary files to remote attackers. This is because of the passing of specially crafted content to the underlying XML parser without taking proper restrictions such as prohibiting an external dtd. (ZDI-CAN-11923) Additional Analyst Notes: - CVE Program Container: References: -
ns such as prohibiting an external dtd. (ZDI-CAN-11923) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-715184.pdf
CVE ID: CVE-2020-28388 State: PUBLISHED Published: 2021-02-09T00:00:00 Last Updated: 2024-08-04T16:33:58.999Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), Nucleus NET, Nucleus ReadyStart V3, Nucleus Source Code, PLUSCONTROL 1st Gen, TALON TC Compact (BACnet), TALON TC Modular (BACnet) Problem Types: CWE-342 Description: A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All
et) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus ReadyStart V3 (All versions < V2012.12), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). Initial Sequence Numbers (ISNs) for TCP connections are derived from an insufficiently random source. As a result, the ISN of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future
of current and future TCP connections could be predictable. An attacker could hijack existing sessions or spoof future ones. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-362164.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-344238.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-436469.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdf
CVE ID: CVE-2020-28390 State: PUBLISHED Published: 2021-01-12T20:18:36 Last Updated: 2024-08-04T16:33:59.104Z Vendors: Siemens Products: Opcenter Execution Core Problem Types: CWE-522 Description: A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). The application contains an information leakage vulnerability in the handling of web client sessions. A local attacker who has access to the Web Client Session Storage could disclose the passwords of currently logged-in users. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf - https://www.zerodayinitiative.com/advisorie
ferences: - https://cert-portal.siemens.com/productcert/pdf/ssa-604937.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-051/
CVE ID: CVE-2020-28391 State: PUBLISHED Published: 2021-01-12T00:00:00 Last Updated: 2024-08-04T16:33:59.106Z Vendors: Siemens Products: SCALANCE X-200 switch family (incl. SIPLUS NET variants), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants), SCALANCE X-200RNA switch family Problem Types: CWE-321 Description: A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7). Devices create a new unique key upon factory reset, except when used with C-PLUG. When used with C-PLUG the devic
.2.7). Devices create a new unique key upon factory reset, except when used with C-PLUG. When used with C-PLUG the devices use the hardcoded private RSA-key shipped with the firmware-image. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-012-02
CVE ID: CVE-2020-28392 State: PUBLISHED Published: 2021-02-09T15:38:20 Last Updated: 2024-08-04T16:33:59.083Z Vendors: Siemens Products: SIMARIS configuration Problem Types: CWE-276 Description: A vulnerability has been identified in SIMARIS configuration (All versions < V4.0.1). During installation to default target folder, incorrect permissions are configured for the application folder and subfolders which could allow an attacker to gain persistence or potentially escalate privileges should a user with elevated credentials log onto the machine. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-794542.pdf
CVE ID: CVE-2020-28393 State: PUBLISHED Published: 2021-05-12T13:18:22 Last Updated: 2024-08-04T16:33:59.094Z Vendors: n/a Products: SCALANCE XM-400, XR-500 Problem Types: CWE-682 Description: An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device on the SCALANCE XM-400, XR-500 (All versions prior to v6.4). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-131-10 - https://cert-portal.siemens.com/productcert/pdf/ssa-116379.pdf