CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-32252
https://notcve.org/view.php?id=CVE-2022-32252
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker. Se ha identificado una vulnerabilidad en SINEMA Remote Connect Server (Todas las versiones anteriores a V3.1). La aplicación no lleva a cabo una comprobación de la integridad de los paquetes de actualización. • https://cert-portal.siemens.com/productcert/html/ssa-484086.html https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-32251
https://notcve.org/view.php?id=CVE-2022-32251
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions of any user and gain the privileges of an administrative user. Se ha identificado una vulnerabilidad en SINEMA Remote Connect Server (Todas las versiones anteriores a V3.1). Falta una verificación de autenticación para un recurso usado para cambiar los roles y permisos de un usuario. • https://cert-portal.siemens.com/productcert/html/ssa-484086.html https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2022-29034 – SIEMENS-SINEMA Remote Connect 3.0.1.0-01.01.00.02 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2022-29034
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting (XSS) attacks. Se ha identificado una vulnerabilidad en SINEMA Remote Connect Server (Todas las versiones anteriores a V3.1). Una ventana emergente de mensaje de error en la interfaz web de la aplicación afectada no evita una inyección de código JavaScript. Esto podría permitir a atacantes llevar a cabo ataques de tipo cross-site scripting (XSS) reflejados SIEMENS-SINEMA Remote Connect versions 3.0.1.0-01.01.00.02 and below suffer from a cross site scripting vulnerability. • http://packetstormsecurity.com/files/167554/SIEMENS-SINEMA-Remote-Connect-3.0.1.0-01.01.00.02-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2022/Jun/35 https://cert-portal.siemens.com/productcert/html/ssa-484086.html https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-27221
https://notcve.org/view.php?id=CVE-2022-27221
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack. Se ha identificado una vulnerabilidad en SINEMA Remote Connect Server (Todas las versiones anteriores a V3.1). Un atacante en el "machine-in-the-middle" podría obtener valores secretos en texto plano al observar las diferencias de longitud durante una serie de conjeturas en las que una cadena en una URL de petición HTTP coincida potencialmente con una cadena desconocida en un cuerpo de respuesta HTTP, también se conoce como ataque "BREACH" • https://cert-portal.siemens.com/productcert/html/ssa-484086.html https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf • CWE-203: Observable Discrepancy •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-27220
https://notcve.org/view.php?id=CVE-2022-27220
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 6220. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors. Se ha identificado una vulnerabilidad en SINEMA Remote Connect Server (Todas las versiones anteriores a V3.0 SP2). La aplicación afectada carece de encabezados generales de seguridad HTTP en el servidor web configurado en el puerto 6220. • https://cert-portal.siemens.com/productcert/pdf/ssa-911567.pdf • CWE-358: Improperly Implemented Security Check for Standard CWE-1021: Improper Restriction of Rendered UI Layers or Frames •