CVE Vulnerability Catalog

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves lack of validation and sanitization of facility names in the Bulk Import/Export workflow. An authenticated attacker with specific privileges can execute arbitrary SQL commands on the underlying database.

A vulnerability in .NET Client Library for SIMATIC S7 Webserver API (versions < V3.3.62) involves improper redaction of PLC restore passwords from HTTP error exception messages. An attacker with access to logs or other diagnostic output could obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.

A vulnerability in .NET Client Library for SIMATIC S7 Webserver API (versions < V3.3.61) is due to lack of validation of filenames received from remote servers during ticket downloads. An attacker who can manipulate the ticket response can write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.

A vulnerability in Industrial Edge App Publisher (versions < V1.27.9) is due to lack of sanitization of data received from the backend before rendering in the user interface. Because the front end is integrated with Node.js, this allows execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine.

A vulnerability in Industrial Edge App Publisher (versions < V1.27.9) is due to lack of server certificate validation when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity.

A vulnerability in SIMATIC IPC BX-21A, SIMATIC IPC RW-543A, and SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G is due to the presence of a BIOS vendor test key in the UEFI Secure Boot key database. A local attacker with physical or administrative access can boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.

A vulnerability affects devices that do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. An attacker could social engineer an authorized user with 'Read diagnostics' right into importing a specially crafted file, allowing attacker-controlled JavaScript to execute in the user's browser session and perform PLC operations within the user's authorization scope.

A vulnerability affects devices that do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. An attacker could social engineer an authorized user with 'Read diagnostics' right into importing a specially crafted trace file, allowing attacker-controlled JavaScript to execute in the user's browser session when the error message is displayed.

A vulnerability affects devices that do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. An attacker could social engineer an authorized user with 'Read diagnostics' right into importing a specially crafted trace file, allowing attacker-controlled JavaScript to execute in the user's browser session when the user interacts with an affected selection menu.

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

A vulnerability affects devices that do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. An attacker could social engineer an authorized user with 'Read diagnostics' right into importing a specially crafted trace file, allowing attacker-controlled JavaScript to execute in the user's browser session and perform PLC operations within the user's authorization scope.

A vulnerability affects devices that do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. An attacker could social engineer an authorized user with 'Read diagnostics' right into importing a specially crafted trace file, allowing attacker-controlled JavaScript to execute in the user's browser session and perform PLC operations within the user's authorization scope.

Affected devices do not properly restrict executable content contained in imported trace files. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

A vulnerability in SIMATIC WinCC V7.5, V8.0, and V8.1 is due to insufficient restriction of permissions assigned to a database role. An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to system compromise.

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. An authenticated remote attacker could access sensitive internal information.

A vulnerability in Siemens Industrial Edge Cloud Device, Industrial Edge Device Kit, and other Industrial Edge devices. The systems do not properly restrict access to internal APIs and paths for authenticated users, which could allow a remote attacker to access sensitive internal information.

A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. This can result in unexpected behavior and limited information disclosure.

TYPO3 forms using FileUpload or ImageUpload elements with a custom saveToFileMount stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. As a result, files could end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages.

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the SCP Receive Handler component. The manipulation leads to path traversal. Remote exploitation is possible. Upgrading to version 0.16.2 resolves the issue.