rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-7564 
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: n/a
product: Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details)
Published: 2020-11-18T13:51:16.000Z
CVE-2020-7565 
A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
Problem types: cwe_id: CWE-326
description: CWE-326: Inadequate Encryption Strength
Affected products: vendor: n/a
product: Modicon M221, all references, all versions
Published: 2020-11-19T21:10:09.000Z
CVE-2020-7566 
A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
Problem types: cwe_id: CWE-334
description: CWE-334: Small Space of Random ValuesÊ
Affected products: vendor: n/a
product: Modicon M221, all references, all versions
Published: 2020-11-19T21:10:22.000Z
CVE-2020-7567 
A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke the encryption keys.
Problem types: cwe_id: CWE-311
description: CWE-311: Missing Encryption of Sensitive Data
Affected products: vendor: n/a
product: Modicon M221, all references, all versions
Published: 2020-11-19T21:10:27.000Z
CVE-2020-7568 
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: n/a
product: Modicon M221, all references, all versions
Published: 2020-11-19T21:10:33.000Z
CVE-2020-7569 
A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: n/a
product: EcoStruxure Building Operation WebReports V1.9 - V3.1
Published: 2020-11-19T21:02:16.000Z
CVE-2020-7570 
A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-siteScripting Stored)
Affected products: vendor: n/a
product: EcoStruxure Building Operation WebReports V1.9 - V3.1
Published: 2020-11-19T21:02:22.000Z
CVE-2020-7571 
A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a Cross-Site Scripting reflected attack against other WebReport users.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-siteScripting Stored)
Affected products: vendor: n/a
product: EcoStruxure Building Operation WebReports V1.9 - V3.1
Published: 2020-11-19T21:02:28.000Z
CVE-2020-7572 
A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: n/a
product: EcoStruxure Building Operation WebReports V1.9 - V3.1
Published: 2020-11-19T21:02:39.000Z
CVE-2020-7573 
A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: n/a
product: EcoStruxure Building Operation WebReports V1.9 - V3.1
Published: 2020-11-19T21:02:45.000Z
CVE-2020-7574 
A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the "Server Config" web interface of the affected devices that could allow an attacker to inject arbitrary JavaScript code. The code could be potentially executed later by another (possibly privileged) user. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires no system privileges. An attacker could use the vulnerability to compromise the confidentiality and integrity of other users' web session.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens
product: Climatix POL908 (BACnet/IP module)
vendor: Siemens
product: Climatix POL909 (AWM module)
Published: 2020-04-14T19:50:54.000Z
CVE-2020-7575 
A vulnerability has been identified in Climatix POL908 (BACnet/IP module) (All versions), Climatix POL909 (AWM module) (All versions < V11.32). A persistent cross-site scripting (XSS) vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitrary JavaScript code via specially crafted GET requests. The code could be potentially executed later by another (privileged) user. The security vulnerability could be exploited by an attacker with network access to the affected system. Successful exploitation requires no system privileges. An attacker could use the vulnerability to compromise the confidentiality and integrity of other users' web sessions.
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Siemens
product: Climatix POL908 (BACnet/IP module)
vendor: Siemens
product: Climatix POL909 (AWM module)
Published: 2020-04-14T19:50:54.000Z
CVE-2020-7576 
A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2), Opcenter Execution Core (V8.2). An authenticated user with the ability to create containers, packages or register defects could perform stored Cross-Site Scripting (XSS) attacks within the vulnerable software. The impact of this attack could result in the session cookies of legitimate users being stolen. Should the attacker gain access to these cookies, they could then hijack the session and perform arbitrary actions in the name of the victim.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens
product: Camstar Enterprise Platform
vendor: Siemens
product: Opcenter Execution Core
vendor: Siemens
product: Opcenter Execution Core
Published: 2020-07-14T13:18:05.000Z
CVE-2020-7577 
A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2). Through the use of several vulnerable fields of the application, an authenticated user could perform an SQL Injection attack by passing a modified SQL query downstream to the back-end server. The exploit of this vulnerability could be used to read, and potentially modify application data to which the user has access to.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: Camstar Enterprise Platform
vendor: Siemens
product: Opcenter Execution Core
Published: 2020-07-14T13:18:05.000Z
CVE-2020-7578 
A vulnerability has been identified in Camstar Enterprise Platform (All versions), Opcenter Execution Core (All versions < V8.2). Authenticated users could have access to resources they normally would not have. This vulnerability could allow an attacker to view internal information and perform unauthorized changes.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Siemens
product: Camstar Enterprise Platform
vendor: Siemens
product: Opcenter Execution Core
Published: 2020-07-14T13:18:05.000Z
CVE-2020-7579 
A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. If deployed according to recommended system configuration, Siemens consideres the environmental vector as CR:L/IR:M/AR:H/MAV:A (4.1).
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: Siemens AG
product: Spectrum Power™ 5
Published: 2020-03-10T19:16:17.000Z
CVE-2020-7581 
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). A component within the affected application calls a helper binary with SYSTEM privileges during startup while the call path is not quoted. This could allow a local attacker with administrative privileges to execute code with SYSTEM level privileges.
Problem types: cwe_id: CWE-428
description: CWE-428: Unquoted Search Path or Element
Affected products: vendor: Siemens
product: Opcenter Execution Discrete
vendor: Siemens
product: Opcenter Execution Foundation
vendor: Siemens
product: Opcenter Execution Process
vendor: Siemens
product: Opcenter Intelligence
vendor: Siemens
product: Opcenter Quality
vendor: Siemens
product: Opcenter RD&L
vendor: Siemens
product: SIMATIC Notifier Server for Windows
vendor: Siemens
product: SIMATIC PCS neo
vendor: Siemens
product: SIMATIC STEP 7 (TIA Portal) V15
vendor: Siemens
product: SIMATIC STEP 7 (TIA Portal) V16
vendor: Siemens
product: SIMOCODE ES V15.1
vendor: Siemens
product: SIMOCODE ES V16
vendor: Siemens
product: Soft Starter ES V15.1
vendor: Siemens
product: Soft Starter ES V16
Published: 2020-07-14T13:18:05.000Z
CVE-2020-7583 
A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0.8). The application does not properly validate the users' privileges when executing some operations, which could allow a user with low permissions to arbitrary modify files that should be protected against writing.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Siemens AG
product: Automation License Manager 5
vendor: Siemens AG
product: Automation License Manager 6
Published: 2020-08-14T15:24:06.000Z
CVE-2020-7584 
A vulnerability has been identified in SIMATIC S7-200 SMART CPU family (All versions >= V2.2 < V2.5.1). Affected devices do not properly handle large numbers of new incomming connections and could crash under certain circumstances. An attacker may leverage this to cause a Denial-of-Service situation.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Siemens AG
product: SIMATIC S7-200 SMART CPU family
Published: 2020-07-14T13:18:05.000Z
CVE-2020-7585 
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise the availability of the system as well as to have access to confidential information.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: Siemens
product: SIMATIC PCS 7 V8.2 and earlier
vendor: Siemens
product: SIMATIC PCS 7 V9.0
vendor: Siemens
product: SIMATIC PDM
vendor: Siemens
product: SIMATIC STEP 7 V5.X
vendor: Siemens
product: SINAMICS STARTER (containing STEP 7 OEM version)
Published: 2020-06-10T16:23:39.000Z
CVE-2020-7586 
A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). A buffer overflow vulnerability could allow a local attacker to cause a Denial-of-Service situation. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise the availability of the system as well as to have access to confidential information.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: Siemens
product: SIMATIC PCS 7 V8.2 and earlier
vendor: Siemens
product: SIMATIC PCS 7 V9.0
vendor: Siemens
product: SIMATIC PDM
vendor: Siemens
product: SIMATIC STEP 7 V5.X
vendor: Siemens
product: SINAMICS STARTER (containing STEP 7 OEM version)
Published: 2020-06-10T16:23:52.000Z
CVE-2020-7587 
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending multiple specially crafted packets to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself. On some cases the vulnerability could leak random information from the remote service.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Siemens
product: Opcenter Execution Discrete
vendor: Siemens
product: Opcenter Execution Foundation
vendor: Siemens
product: Opcenter Execution Process
vendor: Siemens
product: Opcenter Intelligence
vendor: Siemens
product: Opcenter Quality
vendor: Siemens
product: Opcenter RD&L
vendor: Siemens
product: SIMATIC IT LMS
vendor: Siemens
product: SIMATIC IT Production Suite
vendor: Siemens
product: SIMATIC Notifier Server for Windows
vendor: Siemens
product: SIMATIC PCS neo
vendor: Siemens
product: SIMATIC STEP 7 (TIA Portal) V15
vendor: Siemens
product: SIMATIC STEP 7 (TIA Portal) V16
vendor: Siemens
product: SIMOCODE ES V15.1
vendor: Siemens
product: SIMOCODE ES V16
vendor: Siemens
product: Soft Starter ES V15.1
vendor: Siemens
product: Soft Starter ES V16
Published: 2020-07-14T13:18:05.000Z
CVE-2020-7588 
A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions < V3.3), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions < V2.6), SIMATIC IT Production Suite (All versions < V8.0), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions < V3.0 SP1), SIMATIC STEP 7 (TIA Portal) V15 (All versions < V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES V15.1 (All versions < V15.1 Update 4), SIMOCODE ES V16 (All versions < V16 Update 1), Soft Starter ES V15.1 (All versions < V15.1 Update 3), Soft Starter ES V16 (All versions < V16 Update 1). Sending a specially crafted packet to the affected service could cause a partial remote denial-of-service, that would cause the service to restart itself.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Siemens
product: Opcenter Execution Discrete
vendor: Siemens
product: Opcenter Execution Foundation
vendor: Siemens
product: Opcenter Execution Process
vendor: Siemens
product: Opcenter Intelligence
vendor: Siemens
product: Opcenter Quality
vendor: Siemens
product: Opcenter RD&L
vendor: Siemens
product: SIMATIC IT LMS
vendor: Siemens
product: SIMATIC IT Production Suite
vendor: Siemens
product: SIMATIC Notifier Server for Windows
vendor: Siemens
product: SIMATIC PCS neo
vendor: Siemens
product: SIMATIC STEP 7 (TIA Portal) V15
vendor: Siemens
product: SIMATIC STEP 7 (TIA Portal) V16
vendor: Siemens
product: SIMOCODE ES V15.1
vendor: Siemens
product: SIMOCODE ES V16
vendor: Siemens
product: Soft Starter ES V15.1
vendor: Siemens
product: Soft Starter ES V16
Published: 2020-07-14T13:18:05.000Z
CVE-2020-7589 
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions). The vulnerability could lead to an attacker reading and modifying the device configuration and obtain project files from affected devices. The security vulnerability could be exploited by an unauthenticated attacker with network access to port 135/tcp. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality, integrity, and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: LOGO! 8 BM (incl. SIPLUS variants)
Published: 2020-06-10T16:24:57.000Z
CVE-2020-7590 
A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running software V4.4.0 are also affected by CVE-2020-15797). Affected devices use a hard-coded password to protect the onboard database. This could allow an attacker to read and or modify the onboard database. Successful exploitation requires direct physical access to the device.
Problem types: cwe_id: CWE-259
description: CWE-259: Use of Hard-coded Password
Affected products: vendor: Siemens
product: DCA Vantage Analyzer
Published: 2020-10-13T15:30:19.000Z
CVE-2020-7591 
A vulnerability has been identified in SIPORT MP (All versions < 3.2.1). Vulnerable versions of the device could allow an authenticated attacker to impersonate other users of the system and perform (potentially administrative) actions on behalf of those users if the single sign-on feature ("Allow logon without password") is enabled.
Problem types: cwe_id: CWE-603
description: CWE-603: Use of Client-Side Authentication
Affected products: vendor: Siemens
product: SIPORT MP
Published: 2020-10-15T18:45:35.000Z
CVE-2020-7592 
A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC HMI KTP700F Mobile Arctic (All versions), SIMATIC HMI Mobile Panels 2nd Generation (All versions), SIMATIC WinCC Runtime Advanced (All versions). Unencrypted communication between the configuration software and the respective device could allow an attacker to capture potential plain text communication and have access to sensitive information.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Siemens AG
product: SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants)
vendor: Siemens AG
product: SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants)
vendor: Siemens AG
product: SIMATIC HMI Comfort Panels (incl. SIPLUS variants)
vendor: Siemens AG
product: SIMATIC HMI KTP700F Mobile Arctic
vendor: Siemens AG
product: SIMATIC HMI Mobile Panels 2nd Generation
vendor: Siemens AG
product: SIMATIC WinCC Runtime Advanced
Published: 2020-07-14T13:18:05.000Z
CVE-2020-7593 
A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (V1.81.01 - V1.81.03), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.01), LOGO! 8 BM (incl. SIPLUS variants) (V1.82.02). A buffer overflow vulnerability exists in the Web Server functionality of the device. A remote unauthenticated attacker could send a specially crafted HTTP request to cause a memory corruption, potentially resulting in remote code execution.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Siemens AG
product: LOGO! 8 BM (incl. SIPLUS variants)
vendor: Siemens AG
product: LOGO! 8 BM (incl. SIPLUS variants)
vendor: Siemens AG
product: LOGO! 8 BM (incl. SIPLUS variants)
Published: 2020-07-14T13:18:05.000Z
CVE-2020-7594 
MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-21T21:05:48.000Z