Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ugin channel. Using this plugin channel you are able to send a payload packet containing a byte (2) and a string (any spigot command). This could be used to make yourself a server operator and be used to extract other user information through phishing (pretending to be an admin), many servers use essentials so the /geoip command could be available to them, etc. This could also be modified to allow you to set the servers language, set another players language, etc. This issue affects those who have bungee enabled in config. This issue has been fixed in version 3.8.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tritonmc/Triton/se
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tritonmc/Triton/security/advisories/GHSA-8vj5-jccf-q25r - https://github.com/tritonmc/Triton/releases/tag/v3.8.4
CVE ID: CVE-2023-30860 State: PUBLISHED Published: 2023-05-08T18:04:09.703Z Last Updated: 2025-01-29T15:05:30.585Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-79 Description: WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert malicious scripts. Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and tak
including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts. Version 12.4 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WWBN/AVideo/security/advisories/GHSA-xr9h-p2rc-rpqm - https://youtu.be/Nke0Bmv5F-o
CVE ID: CVE-2023-30861 State: PUBLISHED Published: 2023-05-02T17:04:22.197Z Last Updated: 2025-02-13T16:49:37.977Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: pallets Products: flask Problem Types: CWE-539 Description: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depen
The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is acces
e cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq - https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b - https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965 - https://github.com/pallets/flask/releases/tag/2.2.5 - https://github.com/pallets/
3b16170b7c047f5758eb910c416511e9c965 - https://github.com/pallets/flask/releases/tag/2.2.5 - https://github.com/pallets/flask/releases/tag/2.3.2 - https://www.debian.org/security/2023/dsa-5442 - https://security.netapp.com/advisory/ntap-20230818-0006/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00024.html
CVE ID: CVE-2023-30863 State: PUBLISHED Published: 2023-06-06T05:13:09.889Z Last Updated: 2025-01-08T15:12:49.819Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Description: In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1664822361414762498
CVE ID: CVE-2023-30864 State: PUBLISHED Published: 2023-06-06T05:13:10.873Z Last Updated: 2025-01-08T15:11:13.707Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Description: In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1664822361414762498
CVE ID: CVE-2023-30865 State: PUBLISHED Published: 2023-06-06T05:13:11.797Z Last Updated: 2025-01-08T15:08:54.740Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Description: In dialer service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1664822361414762498
CVE ID: CVE-2023-30866 State: PUBLISHED Published: 2023-06-06T05:13:12.727Z Last Updated: 2025-01-08T14:51:41.688Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000 Description: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/1664822361414762498
CVE ID: CVE-2023-30867 State: PUBLISHED Published: 2023-12-15T12:14:02.074Z Last Updated: 2024-08-02T14:37:15.494Z Vendors: Apache Software Foundation Products: Apache StreamPark (incubating) Problem Types: CWE-89 Description: In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select * from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters, leading to SQL injection. This could potentially result in information leakage. Mitigation: Users are recommended to upgrade to version 2.1.2, which fixes the issue. Additional A
information leakage. Mitigation: Users are recommended to upgrade to version 2.1.2, which fixes the issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/bhdzh6hnh04yyf3g203bbyvxryd720o2
CVE ID: CVE-2023-30868 State: PUBLISHED Published: 2023-05-18T08:28:46.250Z Last Updated: 2025-02-13T16:49:38.518Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Jon Christopher Products: CMS Tree Page View Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jon Christopher CMS Tree Page View plugin <= 1.6.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cms-tree-page-view/wordpress-cms-tree-page-view-plugin-1-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve - http://packetstormsecurity.com/files/172730/WordPress-
w-plugin-1-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve - http://packetstormsecurity.com/files/172730/WordPress-Tree-Page-View-1.6.7-Cross-Site-Scripting.html
CVE ID: CVE-2023-30869 State: PUBLISHED Published: 2023-05-02T09:46:36.439Z Last Updated: 2025-01-08T22:08:16.581Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Easy Digital Downloads Products: Easy Digital Downloads Problem Types: CWE-287 Description: Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-1-1-4-1-unauthenticated-privi
om/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-1-1-4-1-unauthenticated-privilege-escalation-vulnerability?_s_id=cve - https://patchstack.com/articles/critical-easy-digital-downloads-vulnerability?_s_id=cve
CVE ID: CVE-2023-30870 State: PUBLISHED Published: 2024-12-09T11:31:02.189Z Last Updated: 2024-12-09T16:46:14.129Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: wooproductimporter Products: Sharkdropship for AliExpress Dropship and Affiliate Problem Types: CWE-862 Description: Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship for AliExpress Dropship and Affiliate: from n/a through 2.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/p
ough 2.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wooshark-aliexpress-importer/vulnerability/wordpress-sharkdropship-for-aliexpress-dropship-and-affiliate-plugin-2-2-3-multiple-broken-access-control-vulnerabilities?_s_id=cve
CVE ID: CVE-2023-30871 State: PUBLISHED Published: 2023-08-16T10:10:28.373Z Last Updated: 2024-09-25T14:49:26.469Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: PT Woo Plugins (by Webdados) Products: Stock Exporter for WooCommerce Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce plugin <= 1.1.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/stock-exporter-for-woocommerce/wordpress-stock-exporter-for-woocommerce-plugin-1-1-0-reflected-cross-site-scripting-
ity/stock-exporter-for-woocommerce/wordpress-stock-exporter-for-woocommerce-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-30872 State: PUBLISHED Published: 2023-12-20T17:03:42.240Z Last Updated: 2025-05-06T18:41:22.546Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: BannerSky Products: BSK Forms Blacklist Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BannerSky BSK Forms Blacklist.This issue affects BSK Forms Blacklist: from n/a through 3.6.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bsk-gravityforms-blacklist/wordpress-bsk-forms-blacklist-plugin-3-6-2-sql-injection-vulnerability?
atabase/vulnerability/bsk-gravityforms-blacklist/wordpress-bsk-forms-blacklist-plugin-3-6-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-30873 State: PUBLISHED Published: 2024-12-09T11:31:01.298Z Last Updated: 2024-12-09T13:49:55.924Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Fahad Mahmood Products: WP Docs Problem Types: CWE-862 Description: Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through 1.9.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-docs/vulnerability/wordpress-wp-docs-plugin-1-9-8-broken-access-control?_s_id=cve
CVE ID: CVE-2023-30874 State: PUBLISHED Published: 2023-08-17T08:25:39.198Z Last Updated: 2024-09-25T16:43:22.479Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Steve Curtis, St. Pete Design Products: Gps Plotter Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Steve Curtis, St. Pete Design Gps Plotter plugin <= 5.1.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gps-plotter/wordpress-gps-plotter-plugin-5-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-30875 State: PUBLISHED Published: 2023-08-18T07:58:44.657Z Last Updated: 2024-09-25T14:39:39.895Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: All My Web Needs Products: Logo Scheduler Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in All My Web Needs Logo Scheduler plugin <= 1.2.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/logo-scheduler-great-for-holidays-events-and-more/wordpress-logo-scheduler-great-for-holidays-events-and-more-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_i
ore/wordpress-logo-scheduler-great-for-holidays-events-and-more-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-30876 State: PUBLISHED Published: 2023-08-17T08:08:59.692Z Last Updated: 2024-08-02T14:37:15.505Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Dave Ross Products: Dave's WordPress Live Search Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dave Ross Dave's WordPress Live Search plugin <= 4.8.1 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/daves-wordpress-live-search/wordpress-dave-s-wordpress-live-search-plugin-4-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-30877 State: PUBLISHED Published: 2023-08-17T08:30:23.774Z Last Updated: 2024-09-25T16:43:15.569Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Maxim Glazunov Products: XML for Google Merchant Center Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Maxim Glazunov XML for Google Merchant Center plugin <= 3.0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/xml-for-google-merchant-center/wordpress-xml-for-google-merchant-center-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-30897 State: PUBLISHED Published: 2023-06-13T08:17:11.223Z Last Updated: 2025-01-03T01:43:13.277Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC WinCC Problem Types: CWE-732 Description: A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to set proper access rights for their installation folder if a non-default installation path was chosen during installation. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
ode and escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-914026.pdf
CVE ID: CVE-2023-30898 State: PUBLISHED Published: 2023-05-09T11:51:36.439Z Last Updated: 2025-01-28T18:34:29.442Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Siveillance Video 2020 R2, Siveillance Video 2020 R3, Siveillance Video 2021 R1, Siveillance Video 2021 R2, Siveillance Video 2022 R1, Siveillance Video 2022 R2, Siveillance Video 2022 R3, Siveillance Video 2023 R1 Problem Types: CWE-502 Description: A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixR
), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Event Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ker to execute code on the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf
CVE ID: CVE-2023-30899 State: PUBLISHED Published: 2023-05-09T11:51:37.547Z Last Updated: 2025-01-28T17:34:19.244Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Siveillance Video 2020 R2, Siveillance Video 2020 R3, Siveillance Video 2021 R1, Siveillance Video 2021 R2, Siveillance Video 2022 R1, Siveillance Video 2022 R2, Siveillance Video 2022 R3, Siveillance Video 2023 R1 Problem Types: CWE-502 Description: A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixR
), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
attacker to execute code on the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-789345.pdf
CVE ID: CVE-2023-30900 State: PUBLISHED Published: 2023-10-10T10:21:19.684Z Last Updated: 2025-02-27T20:46:14.714Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Xpedition Layout Browser Problem Types: CWE-121 Description: A vulnerability has been identified in Xpedition Layout Browser (All versions < VX.2.14). Affected application contains a stack overflow vulnerability when parsing a PCB file. An attacker can leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-829656.pdf
CVE ID: CVE-2023-30901 State: PUBLISHED Published: 2023-06-13T08:17:12.290Z Last Updated: 2025-11-11T20:20:10.988Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Siemens Products: SICAM P850, SICAM P855 Problem Types: CWE-352 Description: A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA10-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA10-2AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA30-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA30-2AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA01-0AA0) (All versions < V3.
ns < V3.11), SICAM P850 (7KG8500-0AA30-2AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA01-0AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA01-2AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA02-0AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA02-2AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA11-0AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA11-2AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA12-0AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA12-2AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA31-0AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA31-2AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA32-0AA0) (All versions < V3.11), SICAM P850 (7KG
850 (7KG8501-0AA31-2AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA32-0AA0) (All versions < V3.11), SICAM P850 (7KG8501-0AA32-2AA0) (All versions < V3.11), SICAM P855 (7KG8550-0AA00-0AA0) (All versions < V3.11), SICAM P855 (7KG8550-0AA00-2AA0) (All versions < V3.11), SICAM P855 (7KG8550-0AA10-0AA0) (All versions < V3.11), SICAM P855 (7KG8550-0AA10-2AA0) (All versions < V3.11), SICAM P855 (7KG8550-0AA30-0AA0) (All versions < V3.11), SICAM P855 (7KG8550-0AA30-2AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA01-0AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA01-2AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA02-0AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA02-2AA0) (Al
AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA02-0AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA02-2AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA11-0AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA11-2AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA12-0AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA12-2AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA31-0AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA31-2AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA32-0AA0) (All versions < V3.11), SICAM P855 (7KG8551-0AA32-2AA0) (All versions < V3.11). The web interface of the affected devices are vulnerable to Cross-Site Request Forgery attacks. By tricking an
V3.11). The web interface of the affected devices are vulnerable to Cross-Site Request Forgery attacks. By tricking an authenticated victim user to click a malicious link, an attacker could perform arbitrary actions on the device on behalf of the victim user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-887249.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-480095.pdf - https://cert-portal.siemens.com/productcert/html/ssa-887249.html - https://cert-portal.siemens.com/productcert/html/ssa-480095.html - https://cert-portal.siemens.com/productcert/html/ssa-201498.html