34 results (0.004 seconds)

CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 0

CVE-2024-30321

https://notcve.org/view.php?id=CVE-2024-30321

09 Jul 2024 — A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions < V19 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 23), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 17), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products do not properly handle certain requests to their web application, which may lead to the leak of privileged information. This cou... • https://cert-portal.siemens.com/productcert/html/ssa-883918.html • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •

CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2022-45147

https://notcve.org/view.php?id=CVE-2022-45147

09 Jul 2024 — A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.co... • https://cert-portal.siemens.com/productcert/html/ssa-825651.html • CWE-502: Deserialization of Untrusted Data •

CVSS: 9.0EPSS: 0%CPEs: 7EXPL: 0

CVE-2023-28829

https://notcve.org/view.php?id=CVE-2023-28829

13 Jun 2023 — A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC WinCC (All versions < V8.0), SINAUT Software ST7sc (All versions). Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows... • https://cert-portal.siemens.com/productcert/pdf/ssa-508677.pdf • CWE-477: Use of Obsolete Function •

CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0

CVE-2023-25910

https://notcve.org/view.php?id=CVE-2023-25910

13 Jun 2023 — A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7 SP1 HF1), SIMATIC S7-PM (All versions < V5.7 SP2 HF1), SIMATIC STEP 7 V5 (All versions < V5.7). The affected product contains a database management system that could allow remote users with low privileges to use embedded functions of the database (local or in a network share) that have impact on the server. An attacker with network access to the server network could leverage these embedded... • https://cert-portal.siemens.com/productcert/html/ssa-968170.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 7.8EPSS: 0%CPEs: 17EXPL: 0

CVE-2022-24287

https://notcve.org/view.php?id=CVE-2022-24287

10 May 2022 — A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime Professional V16 and earlier (All versions), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Upd4), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 21), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 8). A missing printer configuration on the host could allow a... • https://cert-portal.siemens.com/productcert/pdf/ssa-363107.pdf • CWE-1188: Initialization of a Resource with an Insecure Default •

CVSS: 7.8EPSS: 0%CPEs: 54EXPL: 0

CVE-2021-40363

https://notcve.org/view.php?id=CVE-2021-40363

09 Feb 2022 — A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V17 (All versions <= V17 Update 4), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The affected component stores the... • https://cert-portal.siemens.com/productcert/pdf/ssa-914168.pdf • CWE-312: Cleartext Storage of Sensitive Information CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory •

CVSS: 8.8EPSS: 0%CPEs: 53EXPL: 0

CVE-2021-40360

https://notcve.org/view.php?id=CVE-2021-40360

09 Feb 2022 — A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The password hash of a local user account in the remote server could be granted via... • https://cert-portal.siemens.com/productcert/pdf/ssa-914168.pdf • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •

CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0

CVE-2021-42022

https://notcve.org/view.php?id=CVE-2021-42022

14 Dec 2021 — A vulnerability has been identified in SIMATIC eaSie PCS 7 Skill Package (All versions < V21.00 SP3). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files. The affected file download function is disabled by default. Se ha identificado una vulnerabilidad en SIMATIC eaSie PCS 7 Skill Package (Todas las v... • https://cert-portal.siemens.com/productcert/pdf/ssa-199605.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 5.5EPSS: 0%CPEs: 21EXPL: 0

CVE-2021-40364

https://notcve.org/view.php?id=CVE-2021-40364

09 Nov 2021 — A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An a... • https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdf • CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 9.9EPSS: 0%CPEs: 48EXPL: 0

CVE-2021-40358

https://notcve.org/view.php?id=CVE-2021-40358

09 Nov 2021 — A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). Legitimate file operations on the web server of the affected system... • https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •