rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-40798 
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), User Management Component (UMC) (All versions < V2.15.1.3). Affected products contain a out-of-bounds read vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to cause a denial of service condition.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: SIMATIC PCS neo V4.1
default_status: unknown
vendor: Siemens
product: SIMATIC PCS neo V5.0
default_status: unknown
vendor: Siemens
product: SIMATIC PCS neo V6.0
default_status: unknown
vendor: Siemens
product: User Management Component (UMC)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 7.5
baseSeverity: HIGH
Published: 2025-09-09T08:48:05.138Z
CVE-2025-40800 
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), NX V2412 (All versions < V2412.8700), NX V2506 (All versions < V2506.6000), Simcenter 3D (All versions < V2506.6000), Simcenter Femap (All versions < V2506.0002), Solid Edge SE2025 (All versions < V225.0 Update 10), Solid Edge SE2026 (All versions < V226.0 Update 1). The IAM client in affected products is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Siemens
product: COMOS V10.6
default_status: unknown
vendor: Siemens
product: COMOS V10.6
default_status: unknown
vendor: Siemens
product: NX V2412
default_status: unknown
vendor: Siemens
product: NX V2506
default_status: unknown
vendor: Siemens
product: Simcenter 3D
default_status: unknown
vendor: Siemens
product: Simcenter Femap
default_status: unknown
vendor: Siemens
product: Solid Edge SE2025
default_status: unknown
vendor: Siemens
product: Solid Edge SE2026
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
baseScore: 7.4
baseSeverity: HIGH
Published: 2025-12-09T10:44:23.488Z
CVE-2025-40801 
A vulnerability has been identified in COMOS V10.6 (All versions < V10.6.1), COMOS V10.6 (All versions < V10.6.1), JT Bi-Directional Translator for STEP (All versions), NX V2412 (All versions < V2412.8900 with Cloud Entitlement (bundled as NX X)), NX V2506 (All versions < V2506.6000 with Cloud Entitlement (bundled as NX X)), Simcenter 3D (All versions < V2506.6000 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Femap (All versions < V2506.0002 with Cloud Entitlement (bundled as Simcenter X Mechanical)), Simcenter Studio (All versions < V2506.0001), Simcenter System Architect (All versions < V2506.0001), Tecnomatix Plant Simulation (All versions < V2504.0007). The SALT SDK is missing server certificate validation while establishing TLS connections to the authorization server. This could allow an attacker to perform a man-in-the-middle attack.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Siemens
product: COMOS V10.6
default_status: unknown
vendor: Siemens
product: COMOS V10.6
default_status: unknown
vendor: Siemens
product: JT Bi-Directional Translator for STEP
default_status: unknown
vendor: Siemens
product: NX V2412
default_status: unknown
vendor: Siemens
product: NX V2506
default_status: unknown
vendor: Siemens
product: Simcenter 3D
default_status: unknown
vendor: Siemens
product: Simcenter Femap
default_status: unknown
vendor: Siemens
product: Simcenter Studio
default_status: unknown
vendor: Siemens
product: Simcenter System Architect
default_status: unknown
vendor: Siemens
product: Tecnomatix Plant Simulation
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
Published: 2025-12-09T10:44:24.727Z
CVE-2025-40802 
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device may be susceptible to resource exhaustion when subjected to high volumes of query requests.
This could allow an attacker to cause a temporary denial of service, with the system recovering once the activity stops.
Problem types: cwe_id: CWE-400
description: CWE-400: Uncontrolled Resource Consumption
Affected products: vendor: Siemens
product: RUGGEDCOM RST2428P
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
baseScore: 3.1
baseSeverity: LOW
Published: 2025-09-09T08:48:06.428Z
CVE-2025-40803 
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions). The affected device exposes certain non-critical information from the device. This could allow an unauthenticated attacker to access sensitive data, potentially leading to a breach of confidentiality.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Siemens
product: RUGGEDCOM RST2428P
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 3.1
baseSeverity: LOW
Published: 2025-09-09T08:48:07.758Z
CVE-2025-40804 
A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a network share without any authentication. This could allow an attacker to access or alter sensitive data without proper authorization.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Siemens
product: SIMATIC Virtualization as a Service (SIVaaS)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
baseScore: 9.1
baseSeverity: CRITICAL
Published: 2025-09-09T08:48:09.048Z
CVE-2025-40806 
A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users.
Problem types: cwe_id: CWE-204
description: CWE-204: Observable Response Discrepancy
Affected products: vendor: Siemens
product: Gridscale X Prepay
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2025-12-09T10:44:25.884Z
CVE-2025-40807 
A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establish still valid user sessions.
Problem types: cwe_id: CWE-294
description: CWE-294: Authentication Bypass by Capture-replay
Affected products: vendor: Siemens
product: Gridscale X Prepay
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseScore: 6.3
baseSeverity: MEDIUM
Published: 2025-12-09T10:44:26.973Z
CVE-2025-40809 
A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Solid Edge SE2024
default_status: unknown
vendor: Siemens
product: Solid Edge SE2025
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2025-10-14T09:15:27.478Z
CVE-2025-40810 
A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds write vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Siemens
product: Solid Edge SE2024
default_status: unknown
vendor: Siemens
product: Solid Edge SE2025
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2025-10-14T09:15:28.668Z
CVE-2025-40811 
A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: Solid Edge SE2024
default_status: unknown
vendor: Siemens
product: Solid Edge SE2025
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2025-10-14T09:15:29.918Z
CVE-2025-40812 
A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 14), Solid Edge SE2025 (All versions < V225.0 Update 6). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PRT files. This could allow an attacker to crash the application or execute code in the context of the current process.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: Solid Edge SE2024
default_status: unknown
vendor: Siemens
product: Solid Edge SE2025
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2025-10-14T09:15:32.119Z
CVE-2025-40815 
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not properly validate the structure of TCP packets in several methods. This could allow an attacker to cause buffer overflows, get control over the instruction counter and run custom code.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Siemens
product: LOGO! 12/24RCE
default_status: unknown
vendor: Siemens
product: LOGO! 12/24RCEo
default_status: unknown
vendor: Siemens
product: LOGO! 230RCE
default_status: unknown
vendor: Siemens
product: LOGO! 230RCEo
default_status: unknown
vendor: Siemens
product: LOGO! 24CE
default_status: unknown
vendor: Siemens
product: LOGO! 24CEo
default_status: unknown
vendor: Siemens
product: LOGO! 24RCE
default_status: unknown
vendor: Siemens
product: LOGO! 24RCEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 12/24RCE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 12/24RCEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 230RCE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 230RCEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24CE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24CEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24RCE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24RCEo
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.2
baseSeverity: HIGH
Published: 2025-11-11T20:20:37.904Z
CVE-2025-40816 
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be reachable.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: LOGO! 12/24RCE
default_status: unknown
vendor: Siemens
product: LOGO! 12/24RCEo
default_status: unknown
vendor: Siemens
product: LOGO! 230RCE
default_status: unknown
vendor: Siemens
product: LOGO! 230RCEo
default_status: unknown
vendor: Siemens
product: LOGO! 24CE
default_status: unknown
vendor: Siemens
product: LOGO! 24CEo
default_status: unknown
vendor: Siemens
product: LOGO! 24RCE
default_status: unknown
vendor: Siemens
product: LOGO! 24RCEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 12/24RCE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 12/24RCEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 230RCE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 230RCEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24CE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24CEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24RCE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24RCEo
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
baseScore: 7.6
baseSeverity: HIGH
Published: 2025-11-11T20:20:39.123Z
CVE-2025-40817 
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA2) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA2) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to change time of the device, which means the device could behave differently.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: LOGO! 12/24RCE
default_status: unknown
vendor: Siemens
product: LOGO! 12/24RCEo
default_status: unknown
vendor: Siemens
product: LOGO! 230RCE
default_status: unknown
vendor: Siemens
product: LOGO! 230RCEo
default_status: unknown
vendor: Siemens
product: LOGO! 24CE
default_status: unknown
vendor: Siemens
product: LOGO! 24CEo
default_status: unknown
vendor: Siemens
product: LOGO! 24RCE
default_status: unknown
vendor: Siemens
product: LOGO! 24RCEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 12/24RCE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 12/24RCEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 230RCE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 230RCEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24CE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24CEo
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24RCE
default_status: unknown
vendor: Siemens
product: SIPLUS LOGO! 24RCEo
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2025-11-11T20:20:42.082Z
CVE-2025-40818 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications contain private SSL/TLS keys on the server that are not properly protected allowing any user with server access to read these keys. This could allow an authenticated attacker to impersonate the server potentially enabling man-in-the-middle, traffic decryption or unauthorized access to services that trust these certificates.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Siemens
product: SINEMA Remote Connect Server
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 3.3
baseSeverity: LOW
Published: 2025-12-09T10:44:28.093Z
CVE-2025-40819 
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP4). Affected applications do not properly validate license restrictions against the database, allowing direct modification of the system_ticketinfo table to bypass license limitations without proper enforcement checks. This could allow with database access to circumvent licensing restrictions by directly modifying database values and potentially enabling unauthorized use beyond the permitted scope.
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Siemens
product: SINEMA Remote Connect Server
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Published: 2025-12-09T10:44:29.280Z
CVE-2025-40827 
A vulnerability has been identified in Siemens Software Center (All versions < V3.5), Solid Edge SE2025 (All versions < V225.0 Update 10). The affected application is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code via placing a crafted DLL file on the system.
Problem types: cwe_id: CWE-427
description: CWE-427: Uncontrolled Search Path Element
Affected products: vendor: Siemens
product: Siemens Software Center
default_status: unknown
vendor: Siemens
product: Solid Edge SE2025
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2025-11-11T20:20:43.538Z
CVE-2025-40829 
A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vulnerability while parsing specially crafted SLDPRT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-27146)
Problem types: cwe_id: CWE-908
description: CWE-908: Use of Uninitialized Resource
Affected products: vendor: Siemens
product: Simcenter Femap
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.8
baseSeverity: HIGH
Published: 2025-12-12T08:36:47.219Z
CVE-2025-40830 
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper authorization checks for the file_transfer feature in ssmctl-client command. This could allow an authenticated, lowly privileged local attacker to read or write to any file on server or sensor.
Problem types: cwe_id: CWE-285
description: CWE-285: Improper Authorization
Affected products: vendor: Siemens
product: SINEC Security Monitor
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
baseScore: 6.7
baseSeverity: MEDIUM
Published: 2025-12-09T10:44:32.353Z
CVE-2025-40831 
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of date parameter in report generation functionality. This could allow an authenticated, lowly privileged attacker to cause denial of service condition of the report functionality.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Siemens
product: SINEC Security Monitor
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2025-12-09T10:44:33.449Z
CVE-2025-40834 
A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected widget does not properly neutralize the input. This could allow an attacker to execute cross-site scripting attacks.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens
product: Mendix RichText
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
baseScore: 5.7
baseSeverity: MEDIUM
Published: 2025-11-17T11:39:22.373Z
CVE-2025-40836 Ericsson Indoor Connect 8855 - Improper Input Validation Vulnerability
Ericsson Indoor Connect 8855 contains an improper input validation vulnerability which if exploited can allow an attacker to execute commands with escalated privileges.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Ericsson
product: Indoor Connect 8855
default_status: affected
Credits: lang: en
value: Telstra
Published: 2025-09-25T14:49:02.613Z
CVE-2025-40837 Ericsson Indoor Connect 8855 - Missing Authorization Vulnerability
Ericsson Indoor Connect 8855 contains a missing authorization vulnerability which if exploited can allow access to the system as a user with higher privileges than intended.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Ericsson
product: Indoor Connect 8855
default_status: affected
Credits: lang: en
value: Telstra
Published: 2025-09-25T14:52:23.376Z
CVE-2025-40838 Ericsson Indoor Connect 8855 - Insufficiently Protected Credentials Vulnerability
Ericsson Indoor Connect 8855 contains a vulnerability where server-side security can be bypassed in the client which if exploited can lead to unauthorized disclosure of certain information.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Ericsson
product: Indoor Connect 8855
default_status: affected
Credits: lang: en
value: Telstra
Published: 2025-09-25T14:54:43.229Z