Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ons < V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.4). An attacker with network access to the installation could bypass the application-level authentication. In order to exploit the vulnerability, an attacker must obtain network access to an affected installation and must obtain a valid username to the system. Successful exploitation requires no user privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisor
could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-886615.pdf - http://www.securityfocus.com/bid/105924
CVE ID: CVE-2018-13805 State: PUBLISHED Published: 2018-10-10T17:00:00 Last Updated: 2024-08-05T09:14:47.124Z Vendors: Siemens AG Products: SIMATIC ET 200SP Open Controller, SIMATIC S7-1500 Software Controller, SIMATIC S7-1500 incl. F Problem Types: Other Description: A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions >= V2.0 and < V2.1.6), SIMATIC S7-1500 Software Controller (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 incl. F (All versions >= V2.0 and < V2.5). An attacker can cause a denial-of-service condition on the network stack by sending a large number of specially crafted packets to the PLC. The PLC will lose its ability to communicate over th
by sending a large number of specially crafted packets to the PLC. The PLC will lose its ability to communicate over the network. This vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no privileges and no user interaction. An attacker could use this vulnerability to compromise availability of the network connectivity. At the time of advisory publication no public exploitation of this vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-347726.pdf
CVE ID: CVE-2018-13806 State: PUBLISHED Published: 2018-09-12T14:00:00Z Last Updated: 2024-09-16T17:44:16.314Z Vendors: Siemens AG Products: SIEMENS TD Keypad Designer Problem Types: CWE-427 Description: A vulnerability has been identified in SIEMENS TD Keypad Designer (All versions). A DLL hijacking vulnerability exists in all versions of SIEMENS TD Keypad Designer which could allow an attacker to execute code with the permission of the user running TD Designer. The attacker must have write access to the directory containing the TD project file in order to exploit the vulnerability. A legitimate user with higher privileges than the attacker must open the TD project in order for this vulnera
erability. A legitimate user with higher privileges than the attacker must open the TD project in order for this vulnerability to be exploited. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-198330.pdf
CVE ID: CVE-2018-13807 State: PUBLISHED Published: 2018-09-12T14:00:00Z Last Updated: 2024-09-17T00:37:09.724Z Vendors: Siemens AG Products: SCALANCE X300, SCALANCE X408, SCALANCE X414 Problem Types: CWE-20 Description: A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All versions). The web interface on port 443/tcp could allow an attacker to cause a Denial-of-Service condition by sending specially crafted packets to the web server. The device will automatically reboot, impacting network availability for other devices. An attacker must have network access to port 443/tcp to exploit the vulnerability. Neither v
lability for other devices. An attacker must have network access to port 443/tcp to exploit the vulnerability. Neither valid credentials nor interaction by a legitimate user is required to exploit the vulnerability. There is no confidentiality or integrity impact, only availability is temporarily impacted. This vulnerability could be triggered by publicly available tools. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-254-05 - http://www.securityfocus.com/bid/105331 - https://cert-portal.siemens.com/productcert/pdf/ssa-447396.pdf
CVE ID: CVE-2018-13808 State: PUBLISHED Published: 2019-04-17T13:38:34 Last Updated: 2024-08-05T09:14:47.234Z Vendors: Siemens Products: CP 1604, CP 1616 Problem Types: Improper Neutralization of CRLF Sequences ('CRLF Injection') Description: A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). An attacker with network access to port 23/tcp could extract internal communication data or cause a Denial-of-Service condition. Successful exploitation requires network access to a vulnerable device. At the time of advisory publication no public exploitation of this vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert
loitation of this vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-559174.pdf
CVE ID: CVE-2018-13809 State: PUBLISHED Published: 2019-04-17T13:38:34 Last Updated: 2024-08-05T09:14:47.175Z Vendors: Siemens Products: CP 1604, CP 1616 Problem Types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated web server of the affected CP devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into following a malicious link. User interaction is required for a successful exploitation. At the time of advisory publication no public exploitation of this vulnerability was known. Additional Analyst Notes: -
At the time of advisory publication no public exploitation of this vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-559174.pdf
CVE ID: CVE-2018-13810 State: PUBLISHED Published: 2019-04-17T13:38:34 Last Updated: 2024-08-05T09:14:47.298Z Vendors: Siemens Products: CP 1604, CP 1616 Problem Types: Cross-Site Request Forgery (CSRF) Description: A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. At
tack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. At the time of advisory publication no public exploitation of this vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-559174.pdf
CVE ID: CVE-2018-13811 State: PUBLISHED Published: 2018-12-13T16:00:00 Last Updated: 2024-08-05T09:14:47.273Z Vendors: Siemens AG Products: SIMATIC STEP 7 (TIA Portal) Problem Types: CWE-916 Description: A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions < V15.1). Password hashes with insufficient computational effort could allow an attacker to access to a project file and reconstruct passwords. The vulnerability could be exploited by an attacker with local access to the project file. No user interaction is required to exploit the vulnerability. The vulnerability could allow the attacker to obtain certain passwords from the project. At the time of advisory publi
. The vulnerability could allow the attacker to obtain certain passwords from the project. At the time of advisory publication no public exploitation of this vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-621493.pdf - http://www.securityfocus.com/bid/105926
CVE ID: CVE-2018-13812 State: PUBLISHED Published: 2018-12-13T16:00:00 Last Updated: 2024-08-05T09:14:47.285Z Vendors: Siemens AG Products: SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) Problem Types: CWE-22 Description: A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update 4), SIMATIC HMI KTP Mobile Panels KTP40
pdate 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15 Update 4), SIMATIC WinCC Runtime Advanced (All versions < V15 Update 4), SIMATIC WinCC Runtime Professional (All versions < V15 Update 4), SIMATIC WinCC (TIA Portal) (All versions < V15 Update 4), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). A directory traversal vulnerability could allow to download arbitrary files from the device. The security vulnerability could be exploited by an attacker with network access to the integrated web server. No user interaction and no authentication is req
loited by an attacker with network access to the integrated web server. No user interaction and no authentication is required to exploit the vulnerability. The vulnerability impacts the confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105922 - https://cert-portal.siemens.com/productcert/pdf/ssa-233109.pdf
CVE ID: CVE-2018-13813 State: PUBLISHED Published: 2018-12-13T16:00:00 Last Updated: 2024-08-05T09:14:47.263Z Vendors: Siemens AG Products: SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) Problem Types: CWE-601 Description: A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update 4), SIMATIC HMI KTP Mobile Panels KTP4
Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15 Update 4), SIMATIC WinCC Runtime Advanced (All versions < V15 Update 4), SIMATIC WinCC Runtime Professional (All versions < V15 Update 4), SIMATIC WinCC (TIA Portal) (All versions < V15 Update 4), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The webserver of affected HMI devices may allow URL redirections to untrusted websites. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publ
authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105922 - https://cert-portal.siemens.com/productcert/pdf/ssa-233109.pdf
CVE ID: CVE-2018-13814 State: PUBLISHED Published: 2018-12-13T16:00:00 Last Updated: 2024-08-05T09:14:47.244Z Vendors: Siemens AG Products: SIMATIC HMI Comfort Panels 4" - 22", SIMATIC HMI Comfort Outdoor Panels 7" & 15", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) Problem Types: CWE-113 Description: A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP70
, SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V14), SIMATIC WinCC Runtime Advanced (All versions < V14), SIMATIC WinCC Runtime Professional (All versions < V14), SIMATIC WinCC (TIA Portal) (All versions < V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no pu
to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105931 - https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf
CVE ID: CVE-2018-13815 State: PUBLISHED Published: 2018-12-13T16:00:00 Last Updated: 2024-08-05T09:14:47.135Z Vendors: Siemens AG Products: SIMATIC S7-1200, SIMATIC S7-1500 Problem Types: CWE-410 Description: A vulnerability has been identified in SIMATIC S7-1200 (All versions), SIMATIC S7-1500 (All Versions < V2.6). An attacker could exhaust the available connection pool of an affected device by opening a sufficient number of connections to the device. Successful exploitation requires an attacker to be able to send packets to port 102/tcp of the affected device. No user interaction and no user privileges are required to exploit the vulnerability. The vulnerability, if exploited, could cause
teraction and no user privileges are required to exploit the vulnerability. The vulnerability, if exploited, could cause a Denial-of-Service condition impacting the availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105928 - https://cert-portal.siemens.com/productcert/pdf/ssa-584286.pdf
CVE ID: CVE-2018-13816 State: PUBLISHED Published: 2018-12-12T16:00:00 Last Updated: 2024-08-05T09:14:47.170Z Vendors: Siemens AG Products: TIM 1531 IRC Problem Types: CWE-284 Description: A vulnerability has been identified in TIM 1531 IRC (All version < V2.0). The devices was missing proper authentication on port 102/tcp, although configured. Successful exploitation requires an attacker to be able to send packets to port 102/tcp of the affected device. No user interaction and no user privileges are required to exploit the vulnerability. At the time of advisory publication no public exploitation of this vulnerability was known. Additional Analyst Notes: - CVE Program Container: References:
no public exploitation of this vulnerability was known. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-982399.pdf - http://www.securityfocus.com/bid/106194
CVE ID: CVE-2018-13817 State: REJECTED Published: 2019-04-17T13:34:20 Last Updated: 2019-04-17T13:34:20 Description: No description available.
CVE ID: CVE-2018-13818 State: PUBLISHED Published: 2018-07-10T14:00:00 Last Updated: 2024-08-05T09:14:47.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it Additional Analyst Notes: - CVE Program Container: References: - https://github.com/twigphp/Twig/blob/2.x/CHANGELOG - https://github.com/twigphp/Twig/commit/eddb97148ad779f27e670e1e3f19fb323aedafeb - https://www.exploit-db.com/exploits/44102/ - https://github.
gphp/Twig/commit/eddb97148ad779f27e670e1e3f19fb323aedafeb - https://www.exploit-db.com/exploits/44102/ - https://github.com/twigphp/Twig/issues/2743 - https://mobile.twitter.com/jameel_nabbo/status/1032593354704515072?s=20
CVE ID: CVE-2018-13819 State: PUBLISHED Published: 2018-08-30T14:00:00Z Last Updated: 2024-09-16T19:09:57.632Z Vendors: CA Technologies Products: Unified Infrastructure Management Problem Types: Use of Hard-coded Cryptographic Key Description: A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105199 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-02--security-notice-for-ca-unified-infrastructure-mgt.html
CVE ID: CVE-2018-13820 State: PUBLISHED Published: 2018-08-30T14:00:00Z Last Updated: 2024-09-16T17:27:47.173Z Vendors: CA Technologies Products: Unified Infrastructure Management Problem Types: Use of Hard-coded Password Description: A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105199 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-02--security-notice-for-ca-unified-infrastructure-mgt.html
CVE ID: CVE-2018-13821 State: PUBLISHED Published: 2018-08-30T14:00:00Z Last Updated: 2024-09-16T22:45:26.924Z Vendors: CA Technologies Products: Unified Infrastructure Management Problem Types: Missing Authentication Description: A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, including file reading/writing. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105199 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-02--security-notice-for-ca-unified-infrastructure-mgt.html
CVE ID: CVE-2018-13822 State: PUBLISHED Published: 2018-08-30T14:00:00Z Last Updated: 2024-09-17T03:38:20.075Z Vendors: CA Technologies Products: PPM Problem Types: Unprotected Storage of Credentials Description: Unprotected storage of credentials in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows attackers to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105297 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
CVE ID: CVE-2018-13823 State: PUBLISHED Published: 2018-08-30T14:00:00Z Last Updated: 2024-09-16T16:38:07.040Z Vendors: CA Technologies Products: PPM Problem Types: XML External Entity (XXE) Description: An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105297 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
CVE ID: CVE-2018-13824 State: PUBLISHED Published: 2018-08-30T14:00:00Z Last Updated: 2024-09-17T02:00:43.300Z Vendors: CA Technologies Products: PPM Problem Types: SQL Injection Description: Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105297 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
CVE ID: CVE-2018-13825 State: PUBLISHED Published: 2018-08-30T14:00:00Z Last Updated: 2024-09-17T03:59:51.363Z Vendors: CA Technologies Products: PPM Problem Types: Cross Site Scripting (XSS) Description: Insufficient input validation in the gridExcelExport functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute reflected cross-site scripting attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105297 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
CVE ID: CVE-2018-13826 State: PUBLISHED Published: 2018-08-30T14:00:00Z Last Updated: 2024-09-17T04:08:43.228Z Vendors: CA Technologies Products: PPM Problem Types: XML External Entity (XXE) Description: An XML external entity vulnerability in the XOG functionality, in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to conduct server side request forgery attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105297 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-01--security-notice-for-ca-ppm.html
CVE ID: CVE-2018-13827 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-13828 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-13829 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-13832 State: PUBLISHED Published: 2018-07-16T20:00:00 Last Updated: 2024-08-05T09:14:47.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text. Additional Analyst Notes: - CVE Program Container: References: - https://hackpuntes.com/cve-2018-13832-wordpress-plugin-all-in-one-favicon-4-6-autenticado-multiples-cross-site-scripting-persistentes/ - https://www.exploit-db.com/exploits/45056/
CVE ID: CVE-2018-13833 State: PUBLISHED Published: 2018-07-10T15:00:00Z Last Updated: 2024-09-17T02:00:59.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in cmft through 2017-09-24. The cmft::rwReadFile function in image.cpp allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dariomanesku/cmft/issues/38 - https://github.com/fouzhe/security/tree/master/cmft