deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-1754
Published: 2022-05-20
Description: Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://github.com/polonel/trudesk/commit/e836d04d16787c2c9c72e7bf011cf396d1f73c19; https://huntr.dev/bounties/2f65af7c-a74b-46a6-8847-5db6785f1cf2; https://github.com/polonel/trudesk/commit/e836d04d16787c2c9c72e7bf011cf396d1f73c19
CVE: CVE-2022-1806
Published: 2022-05-20
Description: Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/rtxteam/rtx/commit/9bb109b0014f952f315c7b89e0f29a9ba84ee04c; https://huntr.dev/bounties/101a2a31-0b27-433a-ad3a-a216238ca4d1; https://github.com/rtxteam/rtx/commit/9bb109b0014f952f315c7b89e0f29a9ba84ee04c
CVE: CVE-2022-25229
Published: 2022-05-20
Description: Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fluidattacks.com/advisories/bowie/; https://github.com/popcorn-official/popcorn-desktop/issues/2491; https://fluidattacks.com/advisories/bowie/
CVE: CVE-2022-25224
Published: 2022-05-20
Description: Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fluidattacks.com/advisories/lennon/; https://fluidattacks.com/advisories/lennon/
CVE: CVE-2022-25227
Published: 2022-05-20
Description: Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user into browse malicious site, to obtain an 'ID' that can be used to send websocket requests and achieve RCE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-346
References: https://fluidattacks.com/advisories/clapton/; https://fluidattacks.com/advisories/clapton/
CVE: CVE-2022-30551
Published: 2022-05-20
Description: OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-30551.pdf; https://github.com/OPCFoundation/UA-Java-Legacy; https://opcfoundation.org
CVE: CVE-2022-31215
Published: 2022-05-20
Description: In certain Goverlan products, the Windows Firewall is temporarily turned off upon a Goverlan agent update operation. This allows remote attackers to bypass firewall blocking rules for a time period of up to 30 seconds. This affects Goverlan Reach Console before 10.5.1, Reach Server before 3.70.1, and Reach Client Agents before 10.1.11.
CVSS Score: 6.5 (MEDIUM)
References: https://goverlan.com; https://www.goverlan.com/knowledge/article/security-advisory-govsa-2022-0506-1-disable-windows-firewall/; https://goverlan.com
CVE: CVE-2022-1784
Published: 2022-05-20
Description: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf; https://huntr.dev/bounties/d1330ce8-cccb-4bae-b9a9-a03b97f444a5; https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf
CVE: CVE-2022-24043
Published: 2022-05-20
Description: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The login functionality of the application fails to normalize the response times of login attempts performed with wrong usernames with the ones executed with correct usernames. A remote unauthenticated attacker could exploit this side-channel information to perform a username enumeration attack and identify valid usernames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
CVE: CVE-2022-24044
Published: 2022-05-20
Description: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The login functionality of the application does not employ any countermeasures against Password Spraying attacks or Credential Stuffing attacks. An attacker could obtain a list of valid usernames on the device by exploiting the issue and then perform a precise Password Spraying or Credential Stuffing attack in order to obtain access to at least one account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307, CWE-307
References: https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
CVE: CVE-2022-24045
Published: 2022-05-20
Description: A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The application, after a successful login, sets the session cookie on the browser via client-side JavaScript code, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). Any attempts to browse the application via unencrypted HTTP protocol would lead to the transmission of all his/her session cookies in plaintext through the network. An attacker could then be able to sniff the network and capture sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-614, CWE-311
References: https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-626968.pdf
CVE: CVE-2022-24287
Published: 2022-05-20
Description: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime Professional V16 and earlier (All versions), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Upd4), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 21), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 8). A missing printer configuration on the host could allow an authenticated attacker to escape the WinCC Kiosk Mode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1188, CWE-1188
References: https://cert-portal.siemens.com/productcert/pdf/ssa-363107.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-363107.pdf
CVE: CVE-2022-24290
Published: 2022-05-20
Description: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All versions), Teamcenter V13.2 (All versions < V13.2.0.8), Teamcenter V13.3 (All versions < V13.3.0.3), Teamcenter V14.0 (All versions < V14.0.0.2). The tcserver.exe binary in affected applications is vulnerable to a stack overflow condition during the parsing of user input that may lead the binary to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-789162.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-789162.pdf
CVE: CVE-2022-26632
Published: 2022-05-20
Description: Multi-Vendor Online Groceries Management System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /products/view_product.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/50739; https://www.exploit-db.com/exploits/50739
CVE: CVE-2022-26633
Published: 2022-05-20
Description: Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/50740; https://www.exploit-db.com/exploits/50740
CVE: CVE-2022-26634
Published: 2022-05-20
Description: HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.exploit-db.com/exploits/50765; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2022-27092
Published: 2022-05-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-27094
Published: 2022-05-20
Description: Sony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://www.exploit-db.com/exploits/50817; https://www.exploit-db.com/exploits/50817
CVE: CVE-2022-27095
Published: 2022-05-20
Description: BattlEye v0.9 contains an unquoted service path which allows attackers to escalate privileges to the system level.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://www.exploit-db.com/exploits/50815; https://www.exploit-db.com/exploits/50815
CVE: CVE-2022-27242
Published: 2022-05-20
Description: A vulnerability has been identified in OpenV2G (V0.9.4). The OpenV2G EXI parsing feature is missing a length check when parsing X509 serial numbers. Thus, an attacker could introduce a buffer overflow that leads to memory corruption.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-736385.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-736385.pdf
CVE: CVE-2022-27640
Published: 2022-05-20
Description: A vulnerability has been identified in SIMATIC CP 442-1 RNA (All versions < V1.5.18), SIMATIC CP 443-1 RNA (All versions < V1.5.18). The affected devices improperly handles excessive ARP broadcast requests. This could allow an attacker to create a denial of service condition by performing ARP storming attacks, which can cause the device to reboot.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://cert-portal.siemens.com/productcert/pdf/ssa-480937.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-480937.pdf
CVE: CVE-2022-27653
Published: 2022-05-20
Description: A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted .NEU files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15594)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-162616.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-162616.pdf
CVE: CVE-2022-28104
Published: 2022-05-20
Description: Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://packetstormsecurity.com/files/166430; https://www.foxitsoftware.com/support/security-bulletins.php; https://packetstormsecurity.com/files/166430
CVE: CVE-2022-28105
Published: 2022-05-20
Description: Online Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /scbs/view_facility.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2022-28106
Published: 2022-05-20
Description: Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2022-28991
Published: 2022-05-20
Description: Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to access sensitive files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://packetstormsecurity.com/files/166590/Multi-Store-Inventory-Management-System-1.0-Information-Disclosure.html; https://packetstormsecurity.com/files/166590/Multi-Store-Inventory-Management-System-1.0-Information-Disclosure.html
CVE: CVE-2022-28992
Published: 2022-05-20
Description: A Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://packetstormsecurity.com/files/166587/Online-Banquet-Booking-System-1.0-Cross-Site-Request-Forgery.html; https://packetstormsecurity.com/files/166587/Online-Banquet-Booking-System-1.0-Cross-Site-Request-Forgery.html
CVE: CVE-2022-28993
Published: 2022-05-20
Description: Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://packetstormsecurity.com/files/166591/Multi-Store-Inventory-Management-System-1.0-Account-Takeover.html; https://packetstormsecurity.com/files/166591/Multi-Store-Inventory-Management-System-1.0-Account-Takeover.html
CVE: CVE-2022-29021
Published: 2022-05-20
Description: A buffer overflow vulnerability exists in the razerkbd driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibly escalate their privileges via a crafted buffer sent to the matrix_custom_frame device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/openrazer/openrazer/pull/1790; https://www.cyberark.com/resources/threat-research-blog/colorful-vulnerabilities; https://github.com/openrazer/openrazer/pull/1790
CVE: CVE-2022-29022
Published: 2022-05-20
Description: A buffer overflow vulnerability exists in the razeraccessory driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibly escalate their privileges via a crafted buffer sent to the matrix_custom_frame device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/openrazer/openrazer/pull/1790; https://www.cyberark.com/resources/threat-research-blog/colorful-vulnerabilities; https://github.com/openrazer/openrazer/pull/1790
CVE: CVE-2022-29023
Published: 2022-05-20
Description: A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibly escalate their privileges via a crafted buffer sent to the matrix_custom_frame device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/openrazer/openrazer/pull/1790; https://www.cyberark.com/resources/threat-research-blog/colorful-vulnerabilities; https://github.com/openrazer/openrazer/pull/1790
CVE: CVE-2022-29028
Published: 2022-05-20
Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The Tiff_Loader.dll is vulnerable to infinite loop condition while parsing specially crafted TIFF files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835, CWE-835
References: https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE: CVE-2022-29029
Published: 2022-05-20
Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll contains a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE: CVE-2022-29030
Published: 2022-05-20
Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The Mono_Loader.dll library is vulnerable to integer overflow condition while parsing specially crafted TG4 files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-680, CWE-190
References: https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE: CVE-2022-29031
Published: 2022-05-20
Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll contains a null pointer dereference vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE: CVE-2022-29032
Published: 2022-05-20
Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll library contains a double free vulnerability while parsing specially crafted CGM files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE: CVE-2022-29033
Published: 2022-05-20
Description: A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V14.0 (All versions < V14.0.0.1). The CGM_NIST_Loader.dll library is vulnerable to uninitialized pointer free while parsing specially crafted CGM files. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-824
References: https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-553086.pdf
CVE: CVE-2022-29320
Published: 2022-05-20
Description: MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://www.exploit-db.com/exploits/50859; https://www.exploit-db.com/exploits/50859
CVE: CVE-2022-29801
Published: 2022-05-20
Description: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://cert-portal.siemens.com/productcert/pdf/ssa-789162.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-789162.pdf
CVE: CVE-2022-29872
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of POST requests. This could allow an authenticated attacker to set the device to a denial of service state or to control the program counter and, thus, execute arbitrary code on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-141, CWE-20
References: https://cert-portal.siemens.com/productcert/html/ssa-165073.html; https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE: CVE-2022-29873
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of certain GET and POST requests. This could allow an unauthenticated attacker to set the device to a denial of service state or to control the program counter and, thus, execute arbitrary code on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-141
References: https://cert-portal.siemens.com/productcert/html/ssa-165073.html; https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE: CVE-2022-29874
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with clients but communicate in cleartext via HTTP. This could allow an unauthenticated attacker to capture the traffic and interfere with the functionality of the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-319, CWE-319
References: https://cert-portal.siemens.com/productcert/html/ssa-165073.html; https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf
CVE: CVE-2022-29876
Published: 2022-05-20
Description: A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response. This could allow an unauthenticated attacker to perform reflected XSS attacks.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://cert-portal.siemens.com/productcert/html/ssa-165073.html; https://cert-portal.siemens.com/productcert/html/ssa-471761.html; https://cert-portal.siemens.com/productcert/pdf/ssa-165073.pdf