rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-31879 
GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-29T03:03:15.000Z
CVE-2021-31881 
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP OFFER message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0008)
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: Capital Embedded AR Classic 431-422
default_status: unknown
vendor: Siemens
product: Capital Embedded AR Classic R20-11
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
baseScore: 7.1
baseSeverity: HIGH
Published: 2021-11-09T11:31:54.000Z
CVE-2021-31882 
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). The DHCP client application does not validate the length of the Domain Name Server IP option(s) (0x06) when processing DHCP ACK packets. This may lead to Denial-of-Service conditions. (FSMD-2021-0011)
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Siemens
product: Capital Embedded AR Classic 431-422
default_status: unknown
vendor: Siemens
product: Capital Embedded AR Classic R20-11
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2021-11-09T11:31:55.000Z
CVE-2021-31883 
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013)
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Siemens
product: Capital Embedded AR Classic 431-422
default_status: unknown
vendor: Siemens
product: Capital Embedded AR Classic R20-11
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
baseScore: 7.1
baseSeverity: HIGH
Published: 2021-11-09T11:31:56.000Z
CVE-2021-31884 
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Capital VSTAR (All versions with enabled Ethernet options), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). The DHCP client application assumes that the data supplied with the “Hostname” DHCP option is NULL terminated. In cases when global hostname variable is not defined, this may lead to Out-of-bound reads, writes, and Denial-of-service conditions. (FSMD-2021-0014)
Problem types: cwe_id: CWE-170
description: CWE-170: Improper Null Termination
Affected products: vendor: Siemens
product: APOGEE MBC (PPC) (BACnet)
vendor: Siemens
product: APOGEE MBC (PPC) (P2 Ethernet)
vendor: Siemens
product: APOGEE MEC (PPC) (BACnet)
vendor: Siemens
product: APOGEE MEC (PPC) (P2 Ethernet)
vendor: Siemens
product: APOGEE PXC Compact (BACnet)
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
vendor: Siemens
product: Capital VSTAR
vendor: Siemens
product: Desigo PXC00-E.D
vendor: Siemens
product: Desigo PXC00-U
vendor: Siemens
product: Desigo PXC001-E.D
vendor: Siemens
product: Desigo PXC100-E.D
vendor: Siemens
product: Desigo PXC12-E.D
vendor: Siemens
product: Desigo PXC128-U
vendor: Siemens
product: Desigo PXC200-E.D
vendor: Siemens
product: Desigo PXC22-E.D
vendor: Siemens
product: Desigo PXC22.1-E.D
vendor: Siemens
product: Desigo PXC36.1-E.D
vendor: Siemens
product: Desigo PXC50-E.D
vendor: Siemens
product: Desigo PXC64-U
vendor: Siemens
product: Desigo PXM20-E
vendor: Siemens
product: Nucleus NET
vendor: Siemens
product: Nucleus ReadyStart V3
vendor: Siemens
product: Nucleus Source Code
vendor: Siemens
product: TALON TC Compact (BACnet)
vendor: Siemens
product: TALON TC Modular (BACnet)
Published: 2021-11-09T11:31:57.000Z
CVE-2021-31885 
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.1), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). TFTP server application allows for reading the contents of the TFTP memory buffer via sending malformed TFTP commands. (FSMD-2021-0009)
Problem types: cwe_id: CWE-805
description: CWE-805: Buffer Access with Incorrect Length Value
Affected products: vendor: Siemens
product: APOGEE MBC (PPC) (BACnet)
vendor: Siemens
product: APOGEE MBC (PPC) (P2 Ethernet)
vendor: Siemens
product: APOGEE MEC (PPC) (BACnet)
vendor: Siemens
product: APOGEE MEC (PPC) (P2 Ethernet)
vendor: Siemens
product: APOGEE PXC Compact (BACnet)
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
vendor: Siemens
product: Desigo PXC00-E.D
vendor: Siemens
product: Desigo PXC00-U
vendor: Siemens
product: Desigo PXC001-E.D
vendor: Siemens
product: Desigo PXC100-E.D
vendor: Siemens
product: Desigo PXC12-E.D
vendor: Siemens
product: Desigo PXC128-U
vendor: Siemens
product: Desigo PXC200-E.D
vendor: Siemens
product: Desigo PXC22-E.D
vendor: Siemens
product: Desigo PXC22.1-E.D
vendor: Siemens
product: Desigo PXC36.1-E.D
vendor: Siemens
product: Desigo PXC50-E.D
vendor: Siemens
product: Desigo PXC64-U
vendor: Siemens
product: Desigo PXM20-E
vendor: Siemens
product: Nucleus NET
vendor: Siemens
product: Nucleus ReadyStart V3
vendor: Siemens
product: Nucleus ReadyStart V4
vendor: Siemens
product: Nucleus Source Code
vendor: Siemens
product: PLUSCONTROL 1st Gen
vendor: Siemens
product: TALON TC Compact (BACnet)
vendor: Siemens
product: TALON TC Modular (BACnet)
Published: 2021-11-09T11:31:58.000Z
CVE-2021-31886 
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “USER” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0010)
Problem types: cwe_id: CWE-170
description: CWE-170: Improper Null Termination
Affected products: vendor: Siemens
product: APOGEE MBC (PPC) (BACnet)
vendor: Siemens
product: APOGEE MBC (PPC) (P2 Ethernet)
vendor: Siemens
product: APOGEE MEC (PPC) (BACnet)
vendor: Siemens
product: APOGEE MEC (PPC) (P2 Ethernet)
vendor: Siemens
product: APOGEE PXC Compact (BACnet)
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
vendor: Siemens
product: Desigo PXC00-E.D
vendor: Siemens
product: Desigo PXC00-U
vendor: Siemens
product: Desigo PXC001-E.D
vendor: Siemens
product: Desigo PXC100-E.D
vendor: Siemens
product: Desigo PXC12-E.D
vendor: Siemens
product: Desigo PXC128-U
vendor: Siemens
product: Desigo PXC200-E.D
vendor: Siemens
product: Desigo PXC22-E.D
vendor: Siemens
product: Desigo PXC22.1-E.D
vendor: Siemens
product: Desigo PXC36.1-E.D
vendor: Siemens
product: Desigo PXC50-E.D
vendor: Siemens
product: Desigo PXC64-U
vendor: Siemens
product: Desigo PXM20-E
vendor: Siemens
product: Nucleus NET
vendor: Siemens
product: Nucleus ReadyStart V3
vendor: Siemens
product: Nucleus Source Code
vendor: Siemens
product: TALON TC Compact (BACnet)
vendor: Siemens
product: TALON TC Modular (BACnet)
Published: 2021-11-09T11:31:59.000Z
CVE-2021-31887 
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “PWD/XPWD” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0016)
Problem types: cwe_id: CWE-170
description: CWE-170: Improper Null Termination
Affected products: vendor: Siemens
product: APOGEE MBC (PPC) (BACnet)
vendor: Siemens
product: APOGEE MBC (PPC) (P2 Ethernet)
vendor: Siemens
product: APOGEE MEC (PPC) (BACnet)
vendor: Siemens
product: APOGEE MEC (PPC) (P2 Ethernet)
vendor: Siemens
product: APOGEE PXC Compact (BACnet)
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
vendor: Siemens
product: Desigo PXC00-E.D
vendor: Siemens
product: Desigo PXC00-U
vendor: Siemens
product: Desigo PXC001-E.D
vendor: Siemens
product: Desigo PXC100-E.D
vendor: Siemens
product: Desigo PXC12-E.D
vendor: Siemens
product: Desigo PXC128-U
vendor: Siemens
product: Desigo PXC200-E.D
vendor: Siemens
product: Desigo PXC22-E.D
vendor: Siemens
product: Desigo PXC22.1-E.D
vendor: Siemens
product: Desigo PXC36.1-E.D
vendor: Siemens
product: Desigo PXC50-E.D
vendor: Siemens
product: Desigo PXC64-U
vendor: Siemens
product: Desigo PXM20-E
vendor: Siemens
product: Nucleus NET
vendor: Siemens
product: Nucleus ReadyStart V3
vendor: Siemens
product: Nucleus Source Code
vendor: Siemens
product: TALON TC Compact (BACnet)
vendor: Siemens
product: TALON TC Modular (BACnet)
Published: 2021-11-09T11:32:00.000Z
CVE-2021-31888 
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “MKD/XMKD” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0018)
Problem types: cwe_id: CWE-170
description: CWE-170: Improper Null Termination
Affected products: vendor: Siemens
product: APOGEE MBC (PPC) (BACnet)
vendor: Siemens
product: APOGEE MBC (PPC) (P2 Ethernet)
vendor: Siemens
product: APOGEE MEC (PPC) (BACnet)
vendor: Siemens
product: APOGEE MEC (PPC) (P2 Ethernet)
vendor: Siemens
product: APOGEE PXC Compact (BACnet)
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
vendor: Siemens
product: Desigo PXC00-E.D
vendor: Siemens
product: Desigo PXC00-U
vendor: Siemens
product: Desigo PXC001-E.D
vendor: Siemens
product: Desigo PXC100-E.D
vendor: Siemens
product: Desigo PXC12-E.D
vendor: Siemens
product: Desigo PXC128-U
vendor: Siemens
product: Desigo PXC200-E.D
vendor: Siemens
product: Desigo PXC22-E.D
vendor: Siemens
product: Desigo PXC22.1-E.D
vendor: Siemens
product: Desigo PXC36.1-E.D
vendor: Siemens
product: Desigo PXC50-E.D
vendor: Siemens
product: Desigo PXC64-U
vendor: Siemens
product: Desigo PXM20-E
vendor: Siemens
product: Nucleus NET
vendor: Siemens
product: Nucleus ReadyStart V3
vendor: Siemens
product: Nucleus Source Code
vendor: Siemens
product: TALON TC Compact (BACnet)
vendor: Siemens
product: TALON TC Modular (BACnet)
Published: 2021-11-09T11:32:00.000Z
CVE-2021-31889 
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0). Malformed TCP packets with a corrupted SACK option leads to Information Leaks and Denial-of-Service conditions. (FSMD-2021-0015)
Problem types: cwe_id: CWE-191
description: CWE-191: Integer Underflow (Wrap or Wraparound)
Affected products: vendor: Siemens
product: Capital Embedded AR Classic 431-422
default_status: unknown
vendor: Siemens
product: Capital Embedded AR Classic R20-11
default_status: unknown
vendor: Siemens
product: PLUSCONTROL 1st Gen
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 7.5
baseSeverity: HIGH
Published: 2021-11-09T11:32:01.000Z
CVE-2021-31890 
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an TCP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0017)
Problem types: cwe_id: CWE-240
description: CWE-240: Improper Handling of Inconsistent Structural Elements
Affected products: vendor: Siemens
product: Capital Embedded AR Classic 431-422
default_status: unknown
vendor: Siemens
product: Capital Embedded AR Classic R20-11
default_status: unknown
vendor: Siemens
product: PLUSCONTROL 1st Gen
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 7.5
baseSeverity: HIGH
Published: 2021-11-09T11:32:02.000Z
CVE-2021-31891 
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Debian 9 or earlier), Operation Scheduler (All versions with OIS running on Debian 9 or earlier), Siveillance Control (All versions with OIS running on Debian 9 or earlier), Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Siemens
product: Desigo CC
vendor: Siemens
product: GMA-Manager
vendor: Siemens
product: Operation Scheduler
vendor: Siemens
product: Siveillance Control
vendor: Siemens
product: Siveillance Control Pro
Published: 2021-09-14T10:47:31.000Z
CVE-2021-31892 
A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Siemens
product: SINUMERIK Analyse MyCondition
vendor: Siemens
product: SINUMERIK Analyze MyPerformance
vendor: Siemens
product: SINUMERIK Analyze MyPerformance /OEE-Monitor
vendor: Siemens
product: SINUMERIK Analyze MyPerformance /OEE-Tuning
vendor: Siemens
product: SINUMERIK Integrate Client 02
vendor: Siemens
product: SINUMERIK Integrate Client 03
vendor: Siemens
product: SINUMERIK Integrate Client 04
vendor: Siemens
product: SINUMERIK Integrate for Production 4.1
vendor: Siemens
product: SINUMERIK Integrate for Production 5.1
vendor: Siemens
product: SINUMERIK Manage MyMachines
vendor: Siemens
product: SINUMERIK Manage MyMachines /Remote
vendor: Siemens
product: SINUMERIK Manage MyMachines /Spindel Monitor
vendor: Siemens
product: SINUMERIK Manage MyPrograms
vendor: Siemens
product: SINUMERIK Manage MyResources /Programs
vendor: Siemens
product: SINUMERIK Manage MyResources /Tools
vendor: Siemens
product: SINUMERIK Manage MyTools
vendor: Siemens
product: SINUMERIK Operate V4.8
vendor: Siemens
product: SINUMERIK Operate V4.93
vendor: Siemens
product: SINUMERIK Operate V4.94
vendor: Siemens
product: SINUMERIK Optimize MyProgramming /NX-Cam Editor
Published: 2021-07-13T11:02:55.000Z