CVSS: 7.2EPSS: 7%CPEs: 4EXPL: 0CVE-2021-33733
https://notcve.org/view.php?id=CVE-2021-33733
12 Oct 2021 — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application. Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP2 Update 1). Un atacante autenticado con privilegios podría ejecutar comandos arbitrarios en la base de datos local mediante el envío de peticiones diseñadas al servidor ... • https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 3%CPEs: 4EXPL: 0CVE-2021-33732
https://notcve.org/view.php?id=CVE-2021-33732
12 Oct 2021 — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application. Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP2 Update 1). Un atacante autenticado con privilegios podría ejecutar comandos arbitrarios en la base de datos local mediante el envío de peticiones diseñadas al servidor ... • https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 7%CPEs: 4EXPL: 0CVE-2021-33731
https://notcve.org/view.php?id=CVE-2021-33731
12 Oct 2021 — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application. Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP2 Update 1). Un atacante autenticado con privilegios podría ejecutar comandos arbitrarios en la base de datos local mediante el envío de peticiones diseñadas al servidor ... • https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 7%CPEs: 4EXPL: 0CVE-2021-33730
https://notcve.org/view.php?id=CVE-2021-33730
12 Oct 2021 — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application. Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP2 Update 1). Un atacante autenticado con privilegios podría ejecutar comandos arbitrarios en la base de datos local mediante el envío de peticiones diseñadas al servidor ... • https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-33729
https://notcve.org/view.php?id=CVE-2021-33729
12 Oct 2021 — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker that is able to import firmware containers to an affected system could execute arbitrary commands in the local database. Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP2 Update 1). Un atacante autenticado que sea capaz de importar contenedores de firmware a un sistema afectado podría ejecutar comandos arbitrarios en la base de datos local • https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2021-33728
https://notcve.org/view.php?id=CVE-2021-33728
12 Oct 2021 — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary code on the device with root privileges. Se ha identificado una vulnerabilidad en SINEC NMS (Todas... • https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-33726
https://notcve.org/view.php?id=CVE-2021-33726
12 Oct 2021 — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to download arbitrary files under a user controlled path and does not correctly check if the relative path is still within the intended target directory. Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP2 Update 1). El sistema afectado permite descargar archivos arbitrarios bajo una ruta controlada por el usuario y no comprueba correctamente si la ruta re... • https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-33727
https://notcve.org/view.php?id=CVE-2021-33727
12 Oct 2021 — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could download the user profile of any user. With this, the attacker could leak confidential information of any user in the affected system. Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP2 Update 1). Un atacante autenticado podría descargar el perfil de usuario de cualquier usuario. • https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2021-33725
https://notcve.org/view.php?id=CVE-2021-33725
12 Oct 2021 — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to delete arbitrary files or directories under a user controlled path and does not correctly check if the relative path is still within the intended target directory. Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP2 Update 1). El sistema afectado permite eliminar archivos o directorios arbitrarios bajo una ruta controlada por el usuario y no comprueba c... • https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2021-33724
https://notcve.org/view.php?id=CVE-2021-33724
12 Oct 2021 — A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system contains an Arbitrary File Deletion vulnerability that possibly allows to delete an arbitrary file or directory under a user controlled path. Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP2 Update 1). El sistema afectado contiene una vulnerabilidad de Eliminación de Archivos Arbitrarios que posiblemente permite eliminar un archivo o directorio arbitrario bajo... • https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •