rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-10916 
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with access to the project file could run arbitrary system commands with the privileges of the local database server. The vulnerability could be exploited by an attacker with access to the project file. The vulnerability does impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens AG
product: SIMATIC PCS 7 V8.0 and earlier
vendor: Siemens AG
product: SIMATIC PCS 7 V8.1
vendor: Siemens AG
product: SIMATIC PCS 7 V8.2
vendor: Siemens AG
product: SIMATIC PCS 7 V9.0
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal) V13
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal) V14
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal) V15
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional V13
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional V14
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional V15
vendor: Siemens AG
product: SIMATIC WinCC V7.2 and earlier
vendor: Siemens AG
product: SIMATIC WinCC V7.3
vendor: Siemens AG
product: SIMATIC WinCC V7.4
vendor: Siemens AG
product: SIMATIC WinCC V7.5
Published: 2019-05-14T19:54:48.000Z
CVE-2019-10917 
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with local access to the project file could cause a Denial-of-Service condition on the affected product while the project file is loaded. Successful exploitation requires access to the project file. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-248
description: CWE-248: Uncaught Exception
Affected products: vendor: Siemens AG
product: SIMATIC PCS 7 V8.0 and earlier
vendor: Siemens AG
product: SIMATIC PCS 7 V8.1
vendor: Siemens AG
product: SIMATIC PCS 7 V8.2
vendor: Siemens AG
product: SIMATIC PCS 7 V9.0
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal) V13
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal) V14
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal) V15
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional V13
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional V14
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional V15
vendor: Siemens AG
product: SIMATIC WinCC V7.2 and earlier
vendor: Siemens AG
product: SIMATIC WinCC V7.3
vendor: Siemens AG
product: SIMATIC WinCC V7.4
vendor: Siemens AG
product: SIMATIC WinCC V7.5
Published: 2019-05-14T19:54:48.000Z
CVE-2019-10918 
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An authenticatd attacker with network access to the DCOM interface could execute arbitrary commands with SYSTEM privileges. The vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires authentication with a low-privileged user account and no user interaction. An attacker could use the vulnerability to compromise confidentiality and integrity and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-749
description: CWE-749: Exposed Dangerous Method or Function
Affected products: vendor: Siemens AG
product: SIMATIC PCS 7 V8.0 and earlier
vendor: Siemens AG
product: SIMATIC PCS 7 V8.1
vendor: Siemens AG
product: SIMATIC PCS 7 V8.2
vendor: Siemens AG
product: SIMATIC PCS 7 V9.0
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal) V13
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal) V14
vendor: Siemens AG
product: SIMATIC WinCC (TIA Portal) V15
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional V13
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional V14
vendor: Siemens AG
product: SIMATIC WinCC Runtime Professional V15
vendor: Siemens AG
product: SIMATIC WinCC V7.2 and earlier
vendor: Siemens AG
product: SIMATIC WinCC V7.3
vendor: Siemens AG
product: SIMATIC WinCC V7.4
vendor: Siemens AG
product: SIMATIC WinCC V7.5
Published: 2019-05-14T19:54:48.000Z
CVE-2019-10919 
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Attackers with access to port 10005/tcp could perform device reconfigurations and obtain project files from the devices. The system manual recommends to protect access to this port. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: LOGO! 8 BM (incl. SIPLUS variants)
Published: 2019-05-14T19:54:48.000Z
CVE-2019-10920 
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which is accessible via port 10005/tcp, can be decrypted due to a hardcoded encryption key. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-321
description: CWE-321: Use of Hard-coded Cryptographic Key
Affected products: vendor: Siemens
product: LOGO! 8 BM (incl. SIPLUS variants)
Published: 2019-05-14T19:54:48.000Z
CVE-2019-10921 
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Unencrypted storage of passwords in the project could allow an attacker with access to port 10005/tcp to obtain passwords of the device. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 10005/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality of the device. At the time of advisory publication no public exploitation of this security vulnerability was known
Problem types: cwe_id: CWE-256
description: CWE-256: Unprotected Storage of Credentials
Affected products: vendor: Siemens
product: LOGO! 8 BM (incl. SIPLUS variants)
Published: 2019-05-14T19:54:48.000Z
CVE-2019-10922 
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 and newer (All versions). An attacker with network access to affected installations, which are configured without "Encrypted Communication", can execute arbitrary code. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected installation. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens AG
product: SIMATIC PCS 7 V8.0 and earlier
vendor: Siemens AG
product: SIMATIC PCS 7 V8.1 and newer
vendor: Siemens AG
product: SIMATIC WinCC V7.2 and earlier
vendor: Siemens AG
product: SIMATIC WinCC V7.3 and newer
Published: 2019-05-14T19:54:48.000Z
CVE-2019-10924 
A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.3). The vulnerability could allow an attacker to execute arbitrary code if the attacker tricks a legitimate user to open a manipulated project. In order to exploit the vulnerability, a valid user must open a manipulated project file. No further privileges are required on the target system. The vulnerability could compromise the confidentiality, integrity and availability of the engineering station. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Siemens
product: LOGO! Soft Comfort
Published: 2019-05-14T19:54:48.000Z
CVE-2019-10925 
A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). An authenticated attacker could escalate privileges by sending specially crafted requests to the integrated webserver. The security vulnerability can be exploited by an attacker with network access to the device. Valid user credentials, but no user interaction are required. Successful exploitation compromises integrity and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: SIMATIC MV400 family
Published: 2019-06-12T13:47:56.000Z
CVE-2019-10926 
A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). Communication with the device is not encrypted. Data transmitted between the device and the user can be obtained by an attacker in a privileged network position. The security vulnerability can be exploited by an attacker in a privileged network position which allows eavesdropping the communication between the affected device and the user. The user must invoke a session. Successful exploitation of the vulnerability compromises confidentiality of the data transmitted.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Siemens
product: SIMATIC MV400 family
Published: 2019-06-12T13:47:56.000Z
CVE-2019-10927 
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.
Problem types: cwe_id: CWE-703
description: CWE-703: Improper Check or Handling of Exceptional Conditions
Affected products: vendor: Siemens AG
product: SCALANCE SC-600
vendor: Siemens AG
product: SCALANCE XB-200
vendor: Siemens AG
product: SCALANCE XC-200
vendor: Siemens AG
product: SCALANCE XF-200BA
vendor: Siemens AG
product: SCALANCE XP-200
vendor: Siemens AG
product: SCALANCE XR-300WG
Published: 2019-08-13T18:55:57.000Z
CVE-2019-10928 
A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by an authenticated attacker with physical access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the confidentiality, integrity and availability of the affected device.
Problem types: cwe_id: CWE-703
description: CWE-703: Improper Check or Handling of Exceptional Conditions
Affected products: vendor: Siemens AG
product: SCALANCE SC-600
Published: 2019-08-13T18:55:57.000Z
CVE-2019-10929 
A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V20.8), SIMATIC HMI Panel (incl. SIPLUS variants) (All versions), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.4.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.8.1), SIMATIC S7-1500 Software Controller (All versions < V20.8), SIMATIC S7-PLCSIM Advanced (All versions < V3.0), SIMATIC STEP 7 (TIA Portal) (All versions < V16), SIMATIC WinCC (TIA Portal) (All versions < V16), SIMATIC WinCC OA (All versions < V3.16 P013), SIMATIC WinCC Runtime Advanced (All versions < V16), SIMATIC WinCC Runtime Professional (All versions < V16), TIM 1531 IRC (incl. SIPLUS NET variants) (All versions < V2.1). Affected devices contain a message protection bypass vulnerability due to certain properties in the calculation used for integrity protection. This could allow an attacker in a Man-in-the-Middle position to modify network traffic sent on port 102/tcp to the affected devices.
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Siemens
product: SIMATIC CP 1626
vendor: Siemens
product: SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC HMI Panel (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC NET PC Software V14
vendor: Siemens
product: SIMATIC NET PC Software V15
vendor: Siemens
product: SIMATIC S7-1200 CPU family (incl. SIPLUS variants)
vendor: Siemens
product: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
vendor: Siemens
product: SIMATIC S7-1500 Software Controller
vendor: Siemens
product: SIMATIC S7-PLCSIM Advanced
vendor: Siemens
product: SIMATIC STEP 7 (TIA Portal)
vendor: Siemens
product: SIMATIC WinCC (TIA Portal)
vendor: Siemens
product: SIMATIC WinCC OA
vendor: Siemens
product: SIMATIC WinCC Runtime Advanced
vendor: Siemens
product: SIMATIC WinCC Runtime Professional
vendor: Siemens
product: TIM 1531 IRC (incl. SIPLUS NET variants)
Published: 2019-08-13T18:55:57.000Z
CVE-2019-10930 
A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions ), DIGSI 5 engineering software (All versions < V7.90), SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.90), SIPROTEC 5 device types 7SS85 and 7KE85 (All versions < V8.01), SIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modules (All versions). A remote attacker could use specially crafted packets sent to port 443/TCP to upload, download or delete files in certain parts of the file system.
Problem types: cwe_id: CWE-552
description: CWE-552: Files or Directories Accessible to External Parties
Affected products: vendor: Siemens AG
product: All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules
vendor: Siemens AG
product: DIGSI 5 engineering software
vendor: Siemens AG
product: SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules
vendor: Siemens AG
product: SIPROTEC 5 device types 7SS85 and 7KE85
vendor: Siemens AG
product: SIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modules
Published: 2019-07-11T21:17:47.000Z
CVE-2019-10931 
A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions ), DIGSI 5 engineering software (All versions < V7.90), SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.90), SIPROTEC 5 device types 7SS85 and 7KE85 (All versions < V8.01), SIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.59), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.59). Specially crafted packets sent to port 443/TCP could cause a Denial of Service condition.
Problem types: cwe_id: CWE-248
description: CWE-248: Uncaught Exception
Affected products: vendor: Siemens AG
product: All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules
vendor: Siemens AG
product: DIGSI 5 engineering software
vendor: Siemens AG
product: SIPROTEC 5 device types 6MD85, 6MD86, 6MD89, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, 7UT87 and 7VE85 with CPU variants CP300 and CP100 and the respective Ethernet communication modules
vendor: Siemens AG
product: SIPROTEC 5 device types 7SS85 and 7KE85
vendor: Siemens AG
product: SIPROTEC 5 device types with CPU variants CP200 and the respective Ethernet communication modules
vendor: Siemens AG
product: SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules
Published: 2019-07-11T21:17:47.000Z
CVE-2019-10933 
A vulnerability has been identified in Spectrum Power 3 (Corporate User Interface) (All versions <= v3.11), Spectrum Power 4 (Corporate User Interface) (Version v4.75), Spectrum Power 5 (Corporate User Interface) (All versions < v5.50), Spectrum Power 7 (Corporate User Interface) (All versions <= v2.20). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user does not need to be logged into the web interface in order for the exploitation to succeed.At the stage of publishing this security advisory no public exploitation is known.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Siemens AG
product: Spectrum Power 3 (Corporate User Interface)
vendor: Siemens AG
product: Spectrum Power 4 (Corporate User Interface)
vendor: Siemens AG
product: Spectrum Power 5 (Corporate User Interface)
vendor: Siemens AG
product: Spectrum Power 7 (Corporate User Interface)
Published: 2019-07-11T21:17:47.000Z
CVE-2019-10934 
A vulnerability has been identified in TIA Portal V14 (All versions), TIA Portal V15 (All versions < V15.1 Update 7), TIA Portal V16 (All versions < V16 Update 6), TIA Portal V17 (All versions < V17 Update 4). Changing the contents of a configuration file could allow an attacker to execute arbitrary code with SYSTEM privileges. The security vulnerability could be exploited by an attacker with a valid account and limited access rights on the system. No user interaction is required. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Siemens
product: TIA Portal V14
vendor: Siemens
product: TIA Portal V15
vendor: Siemens
product: TIA Portal V16
vendor: Siemens
product: TIA Portal V17
Published: 2020-01-16T15:35:24.000Z