CVSS: 5.6EPSS: 46%CPEs: 665EXPL: 7CVE-2018-3639 – AMD / ARM / Intel - Speculative Execution Variant 4 Speculative Store Bypass
https://notcve.org/view.php?id=CVE-2018-3639
21 May 2018 — Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. Los sistemas con microprocesadores que emplean la ejecución especulativa y que realizan la ejecución especulativa de lecturas de memoria antes de que se conozcan las direcciones de todas l... • https://packetstorm.news/files/id/147839 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0CVE-2017-6865
https://notcve.org/view.php?id=CVE-2017-6865
11 May 2017 — A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC Automation Tool (All versions < V3.0), SIMATIC NET PC-Software (All versions < V14 SP1), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2), SIMATIC STEP 7 (TIA Portal) V14 (All versions < V14 SP1), SIMATIC STEP 7 V5.X (All versions < V5.6), SIMATIC WinAC RTX 2010 SP2 (All versions), SIMATIC WinAC RTX F 2010 SP2 (All version... • https://cert-portal.siemens.com/productcert/pdf/ssa-275839.pdf • CWE-20: Improper Input Validation •
CVSS: 6.9EPSS: 0%CPEs: 27EXPL: 0CVE-2016-7165
https://notcve.org/view.php?id=CVE-2016-7165
15 Nov 2016 — A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2 HF1), SIMATIC IT Production Suite (All versions < V7.0 SP1 HFX 2), SIMATIC NET PC-Software (All versions < V14), SIMATIC PCS 7 V7.1 (All versions), SIMATIC PCS 7 V8.0 (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1), SIMATIC STEP 7 (TIA Portal) V13 (All versions < V13 SP2), SIMATIC STEP 7 V5.X (All versions < V5.5 SP4 HF11), SIMATIC WinCC (TIA Portal) Basic, Comfort, Advanced (... • http://securityaffairs.co/wordpress/53266/security/cve-2016-7165-siemens.html • CWE-254: 7PK - Security Features CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6486 – Siemens SINEMA Server Insecure File Permissions Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2016-6486
08 Aug 2016 — Siemens SINEMA Server uses weak permissions for the application folder, which allows local users to gain privileges via unspecified vectors. Siemens SINEMA Server utiliza permisos débiles para la carpeta de aplicación, lo que permite a usuarios locales obtener privilegios a través de vectores no especificados. This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Siemens SINEMA Server. Authentication is required to exploit this vulnerability. The specific flaw ex... • http://www.securityfocus.com/bid/92254 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6204
https://notcve.org/view.php?id=CVE-2016-6204
22 Jul 2016 — Cross-site scripting (XSS) vulnerability in the integrated web server in Siemens SINEMA Remote Connect Server before 1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en el servidor web integrado en Siemens SINEMA Remote Connect Server en versiones anteriores a 1.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. • http://www.securityfocus.com/bid/92114 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2014-2731
https://notcve.org/view.php?id=CVE-2014-2731
19 Apr 2014 — Multiple unspecified vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to execute arbitrary code via HTTP traffic to port (1) 4999 or (2) 80. Múltiples vulnerabilidades no especificadas en el servidor web integrado en el servidor Siemens SINEMA anterior a 12 SP1 permiten a atacantes remotos ejecutar código arbitrario a través de trafico HTTP hacia puerto (1) 4999 o (2) 80. • http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-2733
https://notcve.org/view.php?id=CVE-2014-2733
19 Apr 2014 — Siemens SINEMA Server before 12 SP1 allows remote attackers to cause a denial of service (web-interface outage) via crafted HTTP requests to port (1) 4999 or (2) 80. El servidor Siemens SINEMA anterior a 12 SP1 permite a atacantes remotos causar una denegación de servicio (interrupción de interfaz web) a través de solicitudes HTTP manipuladas hacia puerto (1) 4999 o (2) 80. • http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-2732
https://notcve.org/view.php?id=CVE-2014-2732
19 Apr 2014 — Multiple directory traversal vulnerabilities in the integrated web server in Siemens SINEMA Server before 12 SP1 allow remote attackers to access arbitrary files via HTTP traffic to port (1) 4999 or (2) 80. Múltiples vulnerabilidades de salto de directorio en el servidor web integrado en Siemens SINEMA Server anterior a 12 SP1 permiten a atacantes remotos acceder a archivos arbitrarios a través de trafico HTTP hacia opuerto (1) 4999 o (2) 80. • http://ics-cert.us-cert.gov/advisories/ICSA-14-107-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •