Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
r who successfully makes an MSM user who has already established a session to MSM web interface clicks a forged link to the MSM web interface, e.g., the link is sent per E-Mail, could trick the user into downloading malicious software onto his computer. This issue affects: Hitachi Energy MSM V2.2 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000085&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-40337 State: PUBLISHED Published: 2022-01-25T19:11:15.088680Z Last Updated: 2024-09-16T22:08:41.501Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Hitachi Energy Products: LinkOne Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in Hitachi Energy LinkOne allows an attacker that manages to exploit the vulnerability can take advantage to exploit multiple web attacks and stole sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageC
tes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-40338 State: PUBLISHED Published: 2022-01-28T19:09:55.954957Z Last Updated: 2024-09-16T22:40:31.929Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=e
- CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-40339 State: PUBLISHED Published: 2022-01-28T19:09:56.663744Z Last Updated: 2024-09-17T01:51:52.071Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Configuration vulnerability in Hitachi Energy LinkOne application due to the lack of HTTP Headers, allows an attacker that manages to exploit this vulnerability to retrieve sensitive information. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-40340 State: PUBLISHED Published: 2022-01-28T19:09:57.381711Z Last Updated: 2024-09-17T02:11:03.373Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Information Exposure vulnerability in Hitachi Energy LinkOne application, due to a misconfiguration in the ASP server exposes server and ASP.net information, an attacker that manages to exploit this vulnerability can use the exposed information as a reconnaissance for further exploitation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb
3.20; 3.22; 3.23; 3.24; 3.25; 3.26. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000079&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-40341 State: PUBLISHED Published: 2023-01-05T21:26:42.760Z Last Updated: 2025-04-10T13:31:25.498Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Hitachi Energy Products: FOXMAN-UN, UNEM Problem Types: CWE-326 Description: DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue affects * FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product:
UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R16A, UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:fo
ienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.
:*:*:*:*:*:*:* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-40342 State: PUBLISHED Published: 2023-01-05T21:27:02.929Z Last Updated: 2025-04-10T14:07:23.190Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Hitachi Energy Products: FOXMAN-UN, UNEM Problem Types: CWE-798 Description: In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. This issue affects * FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FO
R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R16A, UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:*
:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-40343 State: PUBLISHED Published: 2021-10-26T10:51:53 Last Updated: 2024-08-04T02:27:31.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the root user. Additional Analyst Notes: - CVE Program Container: References: - https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT - https://synacktiv.com - https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdf
CVE ID: CVE-2021-40344 State: PUBLISHED Published: 2021-10-26T10:52:00 Last Updated: 2024-08-04T02:27:31.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution. Additional Analyst Notes: - CVE Program Container: References: - https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT - https://synacktiv.com - https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabil
NGES-5.TXT - https://synacktiv.com - https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdf
CVE ID: CVE-2021-40345 State: PUBLISHED Published: 2021-10-26T00:00:00 Last Updated: 2024-08-04T02:27:31.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands. Additional Analyst Notes: - CVE Program Container: References: - https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT - https://synacktiv.com - https://github.com/ArianeBlow/NagiosXI-EmersonFI/blob/main/README.md - https://www.synacktiv.com/sites/default/files/2021-10/Nagi
ithub.com/ArianeBlow/NagiosXI-EmersonFI/blob/main/README.md - https://www.synacktiv.com/sites/default/files/2021-10/Nagios_XI_multiple_vulnerabilities_0.pdf
CVE ID: CVE-2021-40346 State: PUBLISHED Published: 2021-09-08T16:40:38 Last Updated: 2024-08-04T02:27:31.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs. Additional Analyst Notes: - CVE Program Container: References: - https://www.mail-archive.com/haproxy%40formilux.org - https://git.haproxy.org/?p=haproxy.git - https://www.debian.org/security/2021/dsa-4968 - https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html - https://jfrog.com/b
ian.org/security/2021/dsa-4968 - https://www.mail-archive.com/haproxy%40formilux.org/msg41114.html - https://jfrog.com/blog/critical-vulnerability-in-haproxy-cve-2021-40346-integer-overflow-enables-http-smuggling/ - https://github.com/haproxy/haproxy/commit/3b69886f7dcc3cfb3d166309018e6cfec9ce2c95 - https://lists.apache.org/thread.html/r284567dd7523f5823e2ce995f787ccd37b1cc4108779c50a97c79120%40%3Cdev.cloudstack.apache.org%3E - https://lists.apache.org/thread.html/r8a58fd7a29808e5d27ee56877745e58dc4bb041b9af94601554e2a5a%40%3Cdev.cloudstack.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/ - http
oraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A7V2IYO22LWVBGUNZWVKNTMDV4KINLFO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXTSBY2TEAXWZVFQM3CXHJFRONX7PEMN/
CVE ID: CVE-2021-40347 State: PUBLISHED Published: 2021-09-10T18:17:24 Last Updated: 2024-08-04T02:27:31.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/mailman/postorius/-/issues/531 - https://phabricator.wikimedia.org/T289798 - https://gitlab.com/mailman/postorius/-/tags - https://www.debian.org/security/2021/dsa-4970 - https://gi
a.org/T289798 - https://gitlab.com/mailman/postorius/-/tags - https://www.debian.org/security/2021/dsa-4970 - https://gitlab.com/mailman/postorius/-/commit/3d880c56b58bc26b32eac0799407d74b64b7474b - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993746
CVE ID: CVE-2021-40348 State: PUBLISHED Published: 2021-11-01T04:32:06 Last Updated: 2024-08-04T02:44:09.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1. Additional Analyst Notes:
hat eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2021/10/28/4 - https://github.com/uyuni-project/uyuni/commit/790c7388efac6923c5475e01c1ff718dffa9f052
CVE ID: CVE-2021-40349 State: PUBLISHED Published: 2021-09-27T05:41:36 Last Updated: 2024-08-04T02:44:09.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: e7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal attack that results in information disclosure via the "GET /.." substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/e7d/speedtest/releases - https://old.reddit.com/r/HackingTechniques/comments/poc55t/directory_traversal_bypass_on_e7d_speedtest/
CVE ID: CVE-2021-40350 State: PUBLISHED Published: 2021-09-01T14:22:41 Last Updated: 2024-08-04T02:44:09.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices allows attackers to perform any desired action via a crafted query containing an unspecified Cookie header. Authentication bypass can be achieved by including an administrative cookie that the device does not validate. Additional Analyst Notes: - CVE Program Container: References: - https://securityshards.wordpress.com/2021/08/31/cve-pending-christie-dwu850-gs-authentication-bypass/
CVE ID: CVE-2021-40352 State: PUBLISHED Published: 2021-09-01T12:20:41 Last Updated: 2024-08-04T02:44:09.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-emr.org/wiki/index.php/Securing_OpenEMR - https://github.com/allenenosh/CVE-2021-40352 - http://packetstormsecurity.com/files/164011/OpenEMR-6.0.0-Insecure-Direct-Object-Reference.html
CVE ID: CVE-2021-40353 State: PUBLISHED Published: 2021-09-01T00:15:14 Last Updated: 2024-08-04T02:44:10.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637. Additional Analyst Notes: - CVE Program Container: References: - https://www.opensis.com/download/english - https://github.com/5qu1n7/CVE-2021-40353
CVE ID: CVE-2021-40354 State: PUBLISHED Published: 2021-09-14T10:47:58 Last Updated: 2024-08-04T02:44:09.181Z Vendors: Siemens Products: Teamcenter V12.4, Teamcenter V13.0, Teamcenter V13.1, Teamcenter V13.2 Problem Types: CWE-267 Description: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The "surrogate" functionality on the user profile of the application does not perform sufficient access control that could lead to an account takeover. Any profile on the application can perform this attack and access any other user assig
ould lead to an account takeover. Any profile on the application can perform this attack and access any other user assigned tasks via the "inbox/surrogate tasks". Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-987403.pdf
CVE ID: CVE-2021-40355 State: PUBLISHED Published: 2021-09-14T10:47:59 Last Updated: 2024-08-04T02:44:09.463Z Vendors: Siemens Products: Teamcenter V12.4, Teamcenter V13.0, Teamcenter V13.1, Teamcenter V13.2 Problem Types: CWE-639 Description: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The affected application contains Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to use user-supplied input to access objects directly. Additional Analyst Notes: - CVE Program Container: References: - https:
user-supplied input to access objects directly. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-987403.pdf
CVE ID: CVE-2021-40356 State: PUBLISHED Published: 2021-09-14T10:48:00 Last Updated: 2024-08-04T02:44:10.071Z Vendors: Siemens Products: Teamcenter V12.4, Teamcenter V13.0, Teamcenter V13.1, Teamcenter V13.2 Problem Types: CWE-611 Description: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://cert-p
es on the application server filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-987403.pdf
CVE ID: CVE-2021-40357 State: PUBLISHED Published: 2021-09-14T10:48:01 Last Updated: 2024-08-04T02:44:09.599Z Vendors: Siemens Products: Teamcenter Active Workspace V4.3, Teamcenter Active Workspace V5.0, Teamcenter Active Workspace V5.1, Teamcenter Active Workspace V5.2 Problem Types: CWE-22 Description: A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.10), Teamcenter Active Workspace V5.0 (All versions < V5.0.8), Teamcenter Active Workspace V5.1 (All versions < V5.1.5), Teamcenter Active Workspace V5.2 (All versions < V5.2.1). A path traversal vulnerability in the application could allow an attacker to bypass certain restrictions such as direct a
path traversal vulnerability in the application could allow an attacker to bypass certain restrictions such as direct access to other services within the host. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-413407.pdf
CVE ID: CVE-2021-40358 State: PUBLISHED Published: 2021-11-09T11:32:04 Last Updated: 2024-08-04T02:44:09.554Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC PCS 7 V8.2, SIMATIC PCS 7 V9.0, SIMATIC PCS 7 V9.1, SIMATIC WinCC V15 and earlier, SIMATIC WinCC V16, SIMATIC WinCC V17, SIMATIC WinCC V7.4, SIMATIC WinCC V7.5 Problem Types: CWE-22 Description: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V
rsions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). Legitimate file operations on the web server of the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read, write or delete unexpected critical files. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/produ
d critical files. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdf
CVE ID: CVE-2021-40359 State: PUBLISHED Published: 2021-11-09T11:32:05 Last Updated: 2024-08-04T02:44:09.625Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: OpenPCS 7 V8.2, OpenPCS 7 V9.0, OpenPCS 7 V9.1, SIMATIC BATCH V8.2, SIMATIC BATCH V9.0, SIMATIC BATCH V9.1, SIMATIC NET PC Software V14, SIMATIC NET PC Software V15, SIMATIC NET PC Software V16, SIMATIC NET PC Software V17, SIMATIC PCS 7 V8.2, SIMATIC PCS 7 V9.0, SIMATIC PCS 7 V9.1, SIMATIC Route Control V8.2, SIMATIC Route Control V9.0, SIMATIC Route Control V9.1, SIMATIC WinCC V15 and earlier, SIMATIC WinCC V16, SIMATIC WinCC V17, SIMATIC WinCC V7.4, SIMATIC WinCC V7.5 Pr
rol V9.1, SIMATIC WinCC V15 and earlier, SIMATIC WinCC V16, SIMATIC WinCC V17, SIMATIC WinCC V7.4, SIMATIC WinCC V7.5 Problem Types: CWE-22 Description: A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versions), SIMATIC BATCH V8.2 (All versions), SIMATIC BATCH V9.0 (All versions), SIMATIC BATCH V9.1 (All versions), SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions < V16 Update 6), SIMATIC NET PC Software V17 (All versions < V17 SP1), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS
l versions < V17 SP1), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC Route Control V8.2 (All versions), SIMATIC Route Control V9.0 (All versions), SIMATIC Route Control V9.1 (All versions), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the