Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-15733 State: PUBLISHED Published: 2020-12-14T17:05:26 Last Updated: 2024-08-04T13:22:30.667Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Bitdefender Products: Antivirus Plus Problem Types: CWE-346 Description: An Origin Validation Error vulnerability in the SafePay component of Bitdefender Antivirus Plus allows a web resource to misrepresent itself in the URL bar. This issue affects: Bitdefender Antivirus Plus versions prior to 25.0.7.29. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/url-spoofing-vulnerability-bitdefender-safepay-va-8958
CVE ID: CVE-2020-15734 State: PUBLISHED Published: 2021-04-12T16:50:16.211874Z Last Updated: 2024-09-16T23:26:28.470Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Bitdefender Products: Safepay Problem Types: CWE-346 Description: An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same directory or sub-directories. This issue affects: Bitdefender Safepay versions prior to 25.0.7.29. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/origin-policy-vulnerability-bitdefender-s
ntainer: References: - https://www.bitdefender.com/support/security-advisories/origin-policy-vulnerability-bitdefender-safepay/
CVE ID: CVE-2020-15736 State: REJECTED Published: 2021-03-17T12:26:02 Last Updated: 2021-03-17T12:26:02 Description: No description available.
CVE ID: CVE-2020-15737 State: REJECTED Published: 2021-03-17T12:26:03 Last Updated: 2021-03-17T12:26:03 Description: No description available.
CVE ID: CVE-2020-15738 State: REJECTED Published: 2021-03-17T12:26:03 Last Updated: 2021-03-17T12:26:03 Description: No description available.
CVE ID: CVE-2020-15740 State: REJECTED Published: 2021-03-17T12:26:04 Last Updated: 2021-03-17T12:26:04 Description: No description available.
CVE ID: CVE-2020-15741 State: REJECTED Published: 2021-03-17T12:26:04 Last Updated: 2021-03-17T12:26:04 Description: No description available.
CVE ID: CVE-2020-15743 State: REJECTED Published: 2021-03-17T12:26:05 Last Updated: 2021-03-17T12:26:05 Description: No description available.
CVE ID: CVE-2020-15744 State: PUBLISHED Published: 2021-08-30T09:50:09.390324Z Last Updated: 2024-09-17T03:28:03.905Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Victure Products: PC420 Problem Types: CWE-121 Description: Stack-based Buffer Overflow vulnerability in the ONVIF server component of Victure PC420 smart camera allows an attacker to execute remote code on the target device. This issue affects: Victure PC420 firmware version 1.2.2 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/blog/labs/cracking-the-victure-pc420-camera
CVE ID: CVE-2020-15745 State: REJECTED Published: 2021-03-17T12:26:06 Last Updated: 2021-03-17T12:26:06 Description: No description available.
CVE ID: CVE-2020-15746 State: REJECTED Published: 2021-03-17T12:26:06 Last Updated: 2021-03-17T12:26:06 Description: No description available.
CVE ID: CVE-2020-15747 State: REJECTED Published: 2021-03-17T12:26:07 Last Updated: 2021-03-17T12:26:07 Description: No description available.
CVE ID: CVE-2020-15748 State: REJECTED Published: 2021-03-17T12:26:07 Last Updated: 2021-03-17T12:26:07 Description: No description available.
CVE ID: CVE-2020-15749 State: REJECTED Published: 2021-03-17T12:26:08 Last Updated: 2021-03-17T12:26:08 Description: No description available.
CVE ID: CVE-2020-15750 State: REJECTED Published: 2021-03-17T12:26:09 Last Updated: 2021-03-17T12:26:09 Description: No description available.
CVE ID: CVE-2020-15751 State: REJECTED Published: 2021-03-17T12:26:09 Last Updated: 2021-03-17T12:26:09 Description: No description available.
CVE ID: CVE-2020-15752 State: REJECTED Published: 2021-03-17T12:26:10 Last Updated: 2021-03-17T12:26:10 Description: No description available.
CVE ID: CVE-2020-15753 State: REJECTED Published: 2021-03-17T12:26:10 Last Updated: 2021-03-17T12:26:10 Description: No description available.
CVE ID: CVE-2020-15754 State: REJECTED Published: 2021-03-17T12:26:11 Last Updated: 2021-03-17T12:26:11 Description: No description available.
CVE ID: CVE-2020-15755 State: REJECTED Published: 2021-03-17T12:26:12 Last Updated: 2021-03-17T12:26:12 Description: No description available.
CVE ID: CVE-2020-15756 State: REJECTED Published: 2021-03-17T12:26:12 Last Updated: 2021-03-17T12:26:12 Description: No description available.
CVE ID: CVE-2020-15757 State: REJECTED Published: 2021-03-17T12:26:13 Last Updated: 2021-03-17T12:26:13 Description: No description available.
CVE ID: CVE-2020-15758 State: REJECTED Published: 2021-03-17T12:26:13 Last Updated: 2021-03-17T12:26:13 Description: No description available.
CVE ID: CVE-2020-15759 State: REJECTED Published: 2021-03-17T12:26:14 Last Updated: 2021-03-17T12:26:14 Description: No description available.
CVE ID: CVE-2020-15760 State: REJECTED Published: 2021-03-17T12:26:14 Last Updated: 2021-03-17T12:26:14 Description: No description available.
CVE ID: CVE-2020-15761 State: REJECTED Published: 2021-03-17T12:26:15 Last Updated: 2021-03-17T12:26:15 Description: No description available.
CVE ID: CVE-2020-15762 State: REJECTED Published: 2021-03-17T12:26:16 Last Updated: 2021-03-17T12:26:16 Description: No description available.
CVE ID: CVE-2020-15763 State: REJECTED Published: 2021-03-17T12:26:16 Last Updated: 2021-03-17T12:26:16 Description: No description available.
CVE ID: CVE-2020-15764 State: REJECTED Published: 2021-03-17T12:26:17 Last Updated: 2021-03-17T12:26:17 Description: No description available.
CVE ID: CVE-2020-15765 State: REJECTED Published: 2021-03-17T12:26:17 Last Updated: 2021-03-17T12:26:17 Description: No description available.
CVE ID: CVE-2020-15766 State: REJECTED Published: 2021-03-17T12:26:18 Last Updated: 2021-03-17T12:26:18 Description: No description available.
CVE ID: CVE-2020-15767 State: PUBLISHED Published: 2020-09-18T13:44:06 Last Updated: 2024-08-04T13:22:30.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access the server. This cookie value could then be used to perform CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/adv
Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15767
CVE ID: CVE-2020-15768 State: PUBLISHED Published: 2020-09-18T13:12:34 Last Updated: 2024-08-04T13:22:30.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2. Unrestricted HTTP header reflection in Gradle Enterprise allows remote attackers to obtain authentication cookies, if they are able to discover a separate XSS vulnerability. This potentially allows an attacker to impersonate another user. Gradle Enterprise affected application request paths:/info/headers, /cache-info/headers, /admin-info/headers, /distribution-broker-info/headers. Gradle Enterprise Build Cache Node
headers, /cache-info/headers, /admin-info/headers, /distribution-broker-info/headers. Gradle Enterprise Build Cache Node affected application request paths:/cache-node-info/headers. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15768
CVE ID: CVE-2020-15769 State: PUBLISHED Published: 2020-09-18T13:10:06 Last Updated: 2024-08-04T13:22:30.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4. An XSS issue exists via the request URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15769
CVE ID: CVE-2020-15770 State: PUBLISHED Published: 2020-09-18T13:23:59 Last Updated: 2024-08-04T13:22:30.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise 2018.5. An attacker can potentially make repeated attempts to guess a local user's password, due to lack of lock-out after excessive failed logins. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15770
CVE ID: CVE-2020-15771 State: PUBLISHED Published: 2020-09-18T13:22:46 Last Updated: 2024-08-04T13:22:30.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1. Cross-site transmission of cookie containing CSRF token allows remote attacker to bypass CSRF mitigation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15771
CVE ID: CVE-2020-15772 State: PUBLISHED Published: 2020-09-18T13:21:50 Last Updated: 2024-08-04T13:22:30.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator. The server side processing of this file dereferences XML External Entities (XXE), allowing a remote attacker with administrative access to perform server side request forgery. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/adviso
ogram Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15772
CVE ID: CVE-2020-15773 State: PUBLISHED Published: 2020-09-18T14:04:29 Last Updated: 2024-08-04T13:22:30.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user (for the duration of the browser session) after previously explicitly authenticating with the API. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15773
CVE ID: CVE-2020-15774 State: PUBLISHED Published: 2020-09-18T13:20:23 Last Updated: 2024-08-04T13:22:30.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their browser to access Gradle Enterprise as that user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15774
CVE ID: CVE-2020-15775 State: PUBLISHED Published: 2020-09-18T13:18:44 Last Updated: 2024-08-04T13:22:30.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts over time. This page is incorrectly viewable anonymously. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15775
CVE ID: CVE-2020-15776 State: PUBLISHED Published: 2020-09-18T13:16:05 Last Updated: 2024-08-04T13:22:30.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. An attacker with the ability to execute arbitrary code in a user's browser could impose an arbitrary value for this token, allowing them to perform cross-site request forgery. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15776 - https://cwe.mitre.org/data
com/gradle/gradle/security/advisories - https://security.gradle.com/advisory/CVE-2020-15776 - https://cwe.mitre.org/data/definitions/1004.html
CVE ID: CVE-2020-15777 State: PUBLISHED Published: 2020-08-25T21:34:43 Last Updated: 2024-08-04T13:22:30.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization gadget chain. The socket is not bound exclusively to localhost. The port this socket is assigned to is randomly selected and is not intentionally exposed to the public (either by design or documentation). This could potentially be used
ected and is not intentionally exposed to the public (either by design or documentation). This could potentially be used to achieve remote code execution and local privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://security.gradle.com/advisory/CVE-2020-15777 - https://docs.gradle.com/enterprise/maven-extension/#1_6
CVE ID: CVE-2020-15778 State: PUBLISHED Published: 2020-07-24T00:00:00 Last Updated: 2024-08-04T13:22:30.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openssh.com/security.html - https://github.com/cpandya2909/CVE-2020-15778/ - https://sec
iner: References: - https://www.openssh.com/security.html - https://github.com/cpandya2909/CVE-2020-15778/ - https://security.netapp.com/advisory/ntap-20200731-0007/ - https://news.ycombinator.com/item?id=25005567 - https://security.gentoo.org/glsa/202212-06 - https://access.redhat.com/errata/RHSA-2024:3166
CVE ID: CVE-2020-15779 State: PUBLISHED Published: 2020-07-15T20:42:39 Last Updated: 2024-08-04T13:22:30.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js. The socket.io-file::createFile message uses path.join with ../ in the name option, and the uploadDir and rename options determine the path. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/package/socket.io-file - https://github.com/rico345100/socket.io-file - https://www.npmjs.com/advisories/1519 - https://github.com/advisories/GHSA-9h4g-27m8-qjrg
CVE ID: CVE-2020-15780 State: PUBLISHED Published: 2020-07-15T21:24:16 Last Updated: 2024-08-04T13:22:30.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30. Additional Analyst Notes: - CVE Program Container: References: - https://git.zx2c4.com/american-unsigned-language/tree/american-unsigned-language-2.sh - https://www.openwall.com/lists/oss-security/2020/06/15/3 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=75b0c
om/lists/oss-security/2020/06/15/3 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=75b0cea7bf307f362057cc778efe89af4c615354 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.7 - http://www.openwall.com/lists/oss-security/2020/07/20/7 - http://www.openwall.com/lists/oss-security/2020/07/29/3 - http://www.openwall.com/lists/oss-security/2020/07/30/3 - http://www.openwall.com/lists/oss-security/2020/07/30/2 - https://usn.ubuntu.com/4425-1/ - https://usn.ubuntu.com/4439-1/ - https://usn.ubuntu.com/4426-1/ - https://usn.ubuntu.com/4440-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html - http://lists.opensuse.org/opensuse-sec
1/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
CVE ID: CVE-2020-15781 State: PUBLISHED Published: 2020-08-14T15:24:06 Last Updated: 2024-08-04T13:22:30.684Z Vendors: Siemens AG Products: SICAM WEB firmware for SICAM A8000 RTUs Problem Types: CWE-79 Description: A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficiently sanitize input, which enables an attacker to generate specially crafted log messages. If an unsuspecting victim views the log messages via the web browser, these log messages might be interpreted and executed as code by the web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality, integrity and ava
e web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality, integrity and availability of the web application. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-370042.pdf
CVE ID: CVE-2020-15782 State: PUBLISHED Published: 2021-05-28T16:10:10 Last Updated: 2024-08-04T13:22:30.758Z Vendors: Siemens Products: SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-1500 Software Controller, SIMATIC S7-PLCSIM Advanced, SINAMICS PERFECT HARMONY GH180 Drives, SINUMERIK MC, SINUMERIK ONE Problem Types: CWE-119 Description: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.
m Types: CWE-119 Description: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINAMICS PERFECT HARMONY GH180 Drives (Drives manufactured before 2021-08-13), SINUMERIK MC (All versions
ions < V4.0), SINAMICS PERFECT HARMONY GH180 Drives (Drives manufactured before 2021-08-13), SINUMERIK MC (All versions < V6.15), SINUMERIK ONE (All versions < V6.15). Affected devices are vulnerable to a memory protection bypass through a specific operation. A remote unauthenticated attacker with network access to port 102/tcp could potentially write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa
f - https://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-434535.pdf
CVE ID: CVE-2020-15783 State: PUBLISHED Published: 2020-11-12T19:21:09 Last Updated: 2024-08-04T13:22:30.725Z Vendors: Siemens Products: SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC TDC CPU555, SINUMERIK 840D sl Problem Types: CWE-400 Description: A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC TDC CPU555 (All versions), SINUMERIK 840D sl (All versions). Sending multiple specially crafted packets to the affected devices could cause a Denial-of-Service on port 102. A cold restart is required to recover the service. Additional Analyst Notes: - CVE Program Container: Refe
on port 102. A cold restart is required to recover the service. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-492828.pdf
CVE ID: CVE-2020-15784 State: PUBLISHED Published: 2020-09-09T18:11:32 Last Updated: 2024-08-04T13:22:30.767Z Vendors: Siemens AG Products: Spectrum Power 4 Problem Types: CWE-312 Description: A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). Insecure storage of sensitive information in the configuration files could allow the retrieval of user names. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-568969.pdf
CVE ID: CVE-2020-15785 State: PUBLISHED Published: 2020-09-09T18:11:37 Last Updated: 2024-08-04T13:22:30.946Z Vendors: Siemens AG Products: Siveillance Video Client Problem Types: CWE-319 Description: A vulnerability has been identified in Siveillance Video Client (All versions). In environments where Windows NTLM authentication is enabled the affected client application transmits usernames to the server in cleartext. This could allow an attacker in a privileged network position to obtain valid adminstrator login names and use this information to launch further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-770698
itional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-770698.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-252-05
CVE ID: CVE-2020-15786 State: PUBLISHED Published: 2020-09-09T18:11:39 Last Updated: 2024-08-04T13:22:30.857Z Vendors: Siemens Products: SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants), SIMATIC HMI Comfort Panels (incl. SIPLUS variants), SIMATIC HMI Mobile Panels, SIMATIC HMI Unified Comfort Panels Problem Types: CWE-307 Description: A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions <= V16), SIMATIC HMI Mobile Panels (All versions <= V16), SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently block exce
l versions <= V16), SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently block excessive authentication attempts. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf