14 results (0.017 seconds)

CVSS: 5.9EPSS: 0%CPEs: 205EXPL: 0

CVE-2021-3449 – NULL pointer deref in signature_algorithms processing

https://notcve.org/view.php?id=CVE-2021-3449

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. • http://www.openwall.com/lists/oss-security/2021/03/27/1 http://www.openwall.com/lists/oss-security/2021/03/27/2 http://www.openwall.com/lists/oss-security/2021/03/28/3 http://www.openwall.com/lists/oss-security/2021/03/28/4 https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148 https://kb.pulse • CWE-476: NULL Pointer Dereference •

CVSS: 7.5EPSS: 0%CPEs: 147EXPL: 0

CVE-2019-10936

https://notcve.org/view.php?id=CVE-2019-10936

Affected devices improperly handle large amounts of specially crafted UDP packets. This could allow an unauthenticated remote attacker to trigger a denial of service condition. Se ha identificado una vulnerabilidad en Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Kits de desarrollo/evaluación para PROFINET IO: EK-ERTEC 200P, SIMATIC CFU PA, SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. variantes SIPLUS), SIMATIC ET200AL, SIMATIC ET200M (incl. variantes SIPLUS), SIMATIC ET200MP IM155-5 PN BA (incl. variantes SIPLUS), SIMATIC ET200MP IM155-5 PN HF (incl. variantes SIPLUS), SIMATIC ET200MP IM155-5 PN ST (incl. variantes SIPLUS) SIPLUS), SIMATIC ET200S (incl. variantes SIPLUS), SIMATIC ET200SP IM155-6 PN BA (incl. variantes SIPLUS), SIMATIC ET200SP IM155-6 PN HA (incl. variantes SIPLUS), SIMATIC ET200SP IM155-6 PN HF (incl. variantes SIPLUS), SIMATIC ET200SP IM155-6 PN HS (incl. variantes SIPLUS), SIMATIC ET200SP IM155-6 PN ST (incl. variantes SIPLUS). SIPLUS), SIMATIC ET200SP IM155-6 PN/2 HF (incl. variantes SIPLUS), SIMATIC ET200SP IM155-6 PN/3 HF (incl. variantes SIPLUS) variantes SIPLUS), SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12, SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN, 4AO U/I 4xM12, SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12, SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12, SIMATIC ET200ecoPN, 8AI 4 U/I; 4 RTD/TC 8xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12, SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12, SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12, SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN: IO-Link Master, SIMATIC ET200pro, paneles exteriores SIMATIC HMI Comfort de 7" y 15" (incl. variantes SIPLUS), paneles SIMATIC HMI Comfort de 4" a 22" (incl. variantes SIPLUS), paneles móviles SIMATIC HMI KTP, acoplador SIMATIC PN/PN (incl. variantes SIPLUS NET), driver SIMATIC PROFINET, familia de CPUs SIMATIC S7-1200 (incl. variantes SIPLUS), familia de CPUs SIMATIC S7-1500 (incl. variantes SIPLUS). CPUs ET200 y variantes SIPLUS), SIMATIC S7-1500 Software Controller, familia de CPUs SIMATIC S7-300 (incl. CPUs ET200 y variantes SIPLUS), familia de CPUs SIMATIC S7-400 H V6 (incl. variantes SIPLUS), familia de CPUs SIMATIC S7-400 PN/DP V6 e inferiores (incl. variantes SIPLUS), familia de CPUs SIMATIC S7-400 PN/DP V7 (incl. variantes SIPLUS), SIMATIC S7-400 PN/DP V7 (incl. variantes SIPLUS). • https://cert-portal.siemens.com/productcert/html/ssa-473245.html https://cert-portal.siemens.com/productcert/pdf/ssa-473245.pdf • CWE-400: Uncontrolled Resource Consumption •

CVSS: 7.8EPSS: 0%CPEs: 68EXPL: 0

CVE-2019-6575

https://notcve.org/view.php?id=CVE-2019-6575

A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V2.7), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants) (All versions < V15.1 Upd 4), SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants) (All versions < V15.1 Upd 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Upd 4), SIMATIC IPC DiagMonitor (All versions < V5.1.3), SIMATIC NET PC Software V13 (All versions), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC RF188C (All versions < V1.1.0), SIMATIC RF600R family (All versions < V3.2.1), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.5 < V2.6.1), SIMATIC S7-1500 Software Controller (All versions between V2.5 (including) and V2.7 (excluding)), SIMATIC WinCC OA (All versions < V3.15 P018), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Upd 4), SINEC NMS (All versions < V1.0 SP1), SINEMA Server (All versions < V14 SP2), SINUMERIK OPC UA Server (All versions < V2.1), TeleControl Server Basic (All versions < V3.1.1). Specially crafted network packets sent to affected devices on port 4840/tcp could allow an unauthenticated remote attacker to cause a denial of service condition of the OPC communication or crash the device. • https://cert-portal.siemens.com/productcert/pdf/ssa-307392.pdf • CWE-248: Uncaught Exception CWE-755: Improper Handling of Exceptional Conditions •

CVSS: 7.5EPSS: 0%CPEs: 125EXPL: 0

CVE-2019-6568

https://notcve.org/view.php?id=CVE-2019-6568

The webserver of the affected devices contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation which leads to a restart of the webserver of the affected device. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. SIPLUS), paneles exteriores SIMATIC HMI Comfort de 7" y 15" (incl. variantes SIPLUS), paneles SIMATIC HMI Comfort de 4" - 22" (incl. variantes SIPLUS), paneles SIMATIC ET 200SP Open Controller CPU 1515SP PC SIPLUS), paneles móviles SIMATIC HMI KTP KTP400F, KTP700, KTP700F, KTP900 y KTP900F, SIMATIC IPC DiagMonitor, SIMATIC RF182C, SIMATIC RF185C, SIMATIC RF186C, SIMATIC RF188C, familia SIMATIC RF600R, familia de CPUs SIMATIC S7-1500 (incl. • https://cert-portal.siemens.com/productcert/pdf/ssa-480230.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-530931.pdf • CWE-125: Out-of-bounds Read •

CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2018-16559

https://notcve.org/view.php?id=CVE-2018-16559

A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted network packets sent to port 80/tcp or 443/tcp could allow an unauthenticated remote attacker to cause a Denial-of-Service condition of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 80/tcp or 443/tcp. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. • https://cert-portal.siemens.com/productcert/pdf/ssa-180635.pdf • CWE-20: Improper Input Validation •