CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-33711
https://notcve.org/view.php?id=CVE-2021-33711
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). The affected application allows verbose error messages which allow leaking of sensitive information, such as full paths. Se ha identificado una vulnerabilidad en Teamcenter Active Workspace versiones V4 (Todas las versiones anteriores a V4.3.9), Teamcenter Active Workspace versiones V5.0 (Todas las versiones anteriores a V5.0.7), Teamcenter Active Workspace versiones V5.1 (Todas las versiones anteriores a V5.1.4). La aplicación afectada permite mensajes de error verboso que permiten el filtrado de información confidencial, tal y como rutas completas • https://cert-portal.siemens.com/productcert/pdf/ssa-622535.pdf • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-33710
https://notcve.org/view.php?id=CVE-2021-33710
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected devices that could allow an attacker to execute malicious JavaScript code by tricking users into accessing a malicious link. Se ha identificado una vulnerabilidad en Teamcenter Active Workspace versiones V4 (Todas las versiones anteriores a V4.3.9), Teamcenter Active Workspace versiones V5.0 (Todas las versiones anteriores a V5.0.7), Teamcenter Active Workspace versiones V5.1 (Todas las versiones anteriores a V5.1.4). Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) reflejado en la interfaz web de los dispositivos afectados que podría permitir a un atacante ejecutar código JavaScript malicioso engañando a usuarios para que accedan a un enlace malicioso • https://cert-portal.siemens.com/productcert/pdf/ssa-622535.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2021-33709
https://notcve.org/view.php?id=CVE-2021-33709
A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). By sending malformed requests, a remote attacker could leak an application token due to an error not properly handled by the system. Se ha identificado una vulnerabilidad en Teamcenter Active Workspace versiones V4 (Todas las versiones anteriores a V4.3.9), Teamcenter Active Workspace versiones V5.0 (Todas las versiones anteriores a V5.0.7), Teamcenter Active Workspace versiones V5.1 (Todas las versiones anteriores a V5.1.4). Mediante el envío de peticiones malformadas, un atacante remoto podría filtrar un token de la aplicación debido a un error manejado inapropiadamente por el sistema • https://cert-portal.siemens.com/productcert/pdf/ssa-622535.pdf • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32944 – Siemens JT2Go DGN File Parsing Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-32944
A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a memory corruption or arbitrary code execution, allowing attackers to cause a denial-of-service condition or execute code in the context of the current process. Se presenta un problema de uso de la memoria previamente liberada en el procedimiento de lectura de archivos DGN en Drawings SDK (todas las versiones anteriores a 2022.4) resultando en una falta de comprobación apropiada de los datos suministrados por el usuario. Esto puede resultar en una corrupción de memoria o en una ejecución de código arbitrario, permitiendo a atacantes causar una condición de denegación de servicio o ejecutar código en el contexto del proceso actual This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. • https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-365397.pdf https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02 https://www.zerodayinitiative.com/advisories/ZDI-21-987 https://www.zerodayinitiative.com/advisories/ZDI-21-990 • CWE-416: Use After Free •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32950 – Siemens JT2Go DXF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-32950
An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allows attackers to cause a denial-of-service condition or read sensitive information from memory locations. Se presenta un problema de lectura fuera de límites en el análisis de archivos DXF en Drawings SDK (todas las versiones anteriores a 2022.4) resultando en una falta de comprobación apropiada de los datos suministrados por el usuario. Esto puede resultar en una lectura más allá del final de un búfer asignado y permite a atacantes causar una condición de denegación de servicio o leer información confidencial de las ubicaciones de memoria This vulnerability allows remote attackers to disclose sensitive information on affected installations of Siemens JT2Go. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. • https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-365397.pdf https://us-cert.cisa.gov/ics/advisories/icsa-21-159-02 https://www.zerodayinitiative.com/advisories/ZDI-21-988 • CWE-125: Out-of-bounds Read •