{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple DLL Hijacking vulnerabilities in Siemens Software Center (SSC) could allow a local attacker to execute code with elevated privileges.\n\nSiemens has released an update for the Siemens Software Center and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-188491.json"
      },
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-188491.html"
      },
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-188491.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-188491.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-04 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-222-04.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-04 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-222-04"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "\u00e2\u20ac\u2039Siemens Software Center",
    "tracking": {
      "current_release_date": "2025-05-06T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-23-222-04",
      "initial_release_date": "2023-08-08T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-08-08T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2025-05-06T06:00:00.000000Z",
          "legacy_version": "Revision",
          "number": "2",
          "summary": "Revision - Fixing typos"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.0",
                "product": {
                  "name": "Siemens Software Center",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Siemens Software Center"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-41544",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application host to prevent local access by untrusted personnel",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 or later version (Existing installations of SSC will be prompted to update whenever a new version is available. The latest version can also be downloaded in the respective link)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.sw.siemens.com/en-US/siemens-software-center/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2021-41544"
    },
    {
      "cve": "CVE-2022-25634",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application host to prevent local access by untrusted personnel",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 or later version (Existing installations of SSC will be prompted to update whenever a new version is available. The latest version can also be downloaded in the respective link)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.sw.siemens.com/en-US/siemens-software-center/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-25634"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple DLL Hijacking vulnerabilities in Siemens Software Center (SSC) could allow a local attacker to execute code with elevated privileges.\n\nSiemens has released an update for the Siemens Software Center and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-188491.json"
      },
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-188491.html"
      },
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-188491.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-188491.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-04 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-222-04.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-222-04 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-222-04"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "\u00e2\u20ac\u2039Siemens Software Center",
    "tracking": {
      "current_release_date": "2025-05-06T06:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-23-222-04",
      "initial_release_date": "2023-08-08T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-08-08T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2025-05-06T06:00:00.000000Z",
          "legacy_version": "Revision",
          "number": "2",
          "summary": "Revision - Fixing typos"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.0",
                "product": {
                  "name": "Siemens Software Center",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Siemens Software Center"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-41544",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application host to prevent local access by untrusted personnel",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 or later version (Existing installations of SSC will be prompted to update whenever a new version is available. The latest version can also be downloaded in the respective link)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.sw.siemens.com/en-US/siemens-software-center/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2021-41544"
    },
    {
      "cve": "CVE-2022-25634",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application host to prevent local access by untrusted personnel",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 or later version (Existing installations of SSC will be prompted to update whenever a new version is available. The latest version can also be downloaded in the respective link)",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.sw.siemens.com/en-US/siemens-software-center/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-25634"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Qt ist eine C++ Klassenbibliothek f\u00fcr die plattform\u00fcbergreifende Programmierung grafischer Benutzeroberfl\u00e4chen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann eine Schwachstelle in QT ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2403 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2023-2403.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2403 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2403"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2023-2252 vom 2023-09-21",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2252.html"
      },
      {
        "category": "external",
        "summary": "National Vulnerability Database vom 2022-03-02",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25634"
      }
    ],
    "source_lang": "en-US",
    "title": "QT: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2023-09-20T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:58:39.905+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-2403",
      "initial_release_date": "2022-03-02T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-03-02T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-09-20T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Amazon aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Open Source QT \u003c= 5.15.8",
                "product": {
                  "name": "Open Source QT \u003c= 5.15.8",
                  "product_id": "T022206",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:qt:qt:5.15.8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Open Source QT \u003c= 6.2.3",
                "product": {
                  "name": "Open Source QT \u003c= 6.2.3",
                  "product_id": "T022207",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:qt:qt:6.2.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "QT"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-25634",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in QT. Der Fehler besteht darin, dass es m\u00f6glich ist, Systembibliotheksdateien aus einem ungewollten Arbeitsverzeichnis zu laden. Ein Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T022206",
          "T022207",
          "398363"
        ]
      },
      "release_date": "2022-03-02T23:00:00.000+00:00",
      "title": "CVE-2022-25634"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Qt ist eine C++ Klassenbibliothek f\u00fcr die plattform\u00fcbergreifende Programmierung grafischer Benutzeroberfl\u00e4chen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann eine Schwachstelle in QT ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2403 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2023-2403.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2403 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2403"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2023-2252 vom 2023-09-21",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-2252.html"
      },
      {
        "category": "external",
        "summary": "National Vulnerability Database vom 2022-03-02",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25634"
      }
    ],
    "source_lang": "en-US",
    "title": "QT: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2023-09-20T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:58:39.905+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-2403",
      "initial_release_date": "2022-03-02T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-03-02T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2023-09-20T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Amazon aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Open Source QT \u003c= 5.15.8",
                "product": {
                  "name": "Open Source QT \u003c= 5.15.8",
                  "product_id": "T022206",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:qt:qt:5.15.8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Open Source QT \u003c= 6.2.3",
                "product": {
                  "name": "Open Source QT \u003c= 6.2.3",
                  "product_id": "T022207",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:qt:qt:6.2.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "QT"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-25634",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in QT. Der Fehler besteht darin, dass es m\u00f6glich ist, Systembibliotheksdateien aus einem ungewollten Arbeitsverzeichnis zu laden. Ein Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T022206",
          "T022207",
          "398363"
        ]
      },
      "release_date": "2022-03-02T23:00:00.000+00:00",
      "title": "CVE-2022-25634"
    }
  ]
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2022-25634 Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2022-25634.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.",
    "tracking": {
      "current_release_date": "2022-03-10T00:00:00.000Z",
      "generator": {
        "date": "2025-10-19T23:23:33.125Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2022-25634",
      "initial_release_date": "2022-03-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2022-03-10T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.0",
                "product": {
                  "name": "CBL Mariner 1.0",
                  "product_id": "16820"
                }
              },
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccm1 qt5-qtsvg 5.12.11-3",
                "product": {
                  "name": "\u003ccm1 qt5-qtsvg 5.12.11-3",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version",
                "name": "cm1 qt5-qtsvg 5.12.11-3",
                "product": {
                  "name": "cm1 qt5-qtsvg 5.12.11-3",
                  "product_id": "18773"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 qt5-qtsvg 5.12.11-3",
                "product": {
                  "name": "\u003ccbl2 qt5-qtsvg 5.12.11-3",
                  "product_id": "3"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 qt5-qtsvg 5.12.11-3",
                "product": {
                  "name": "cbl2 qt5-qtsvg 5.12.11-3",
                  "product_id": "16857"
                }
              }
            ],
            "category": "product_name",
            "name": "qt5-qtsvg"
          },
          {
            "category": "product_name",
            "name": "cbl2 qt5-qtbase 5.12.11-15",
            "product": {
              "name": "cbl2 qt5-qtbase 5.12.11-15",
              "product_id": "1"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccm1 qt5-qtsvg 5.12.11-3 as a component of CBL Mariner 1.0",
          "product_id": "16820-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "16820"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cm1 qt5-qtsvg 5.12.11-3 as a component of CBL Mariner 1.0",
          "product_id": "18773-16820"
        },
        "product_reference": "18773",
        "relates_to_product_reference": "16820"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 qt5-qtsvg 5.12.11-3 as a component of CBL Mariner 2.0",
          "product_id": "17086-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 qt5-qtsvg 5.12.11-3 as a component of CBL Mariner 2.0",
          "product_id": "16857-17086"
        },
        "product_reference": "16857",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 qt5-qtbase 5.12.11-15 as a component of CBL Mariner 2.0",
          "product_id": "17086-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17086"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-25634",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17086-1"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "mitre",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "18773-16820",
          "16857-17086"
        ],
        "known_affected": [
          "16820-2",
          "17086-3"
        ],
        "known_not_affected": [
          "17086-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-25634 Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2022-25634.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-10T00:00:00.000Z",
          "details": "5.12.11-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "16820-2",
            "17086-3"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "16820-2",
            "17086-3"
          ]
        }
      ],
      "title": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory."
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EE0E420-E881-4893-948F-4ED9C590E2BC",
              "versionEndIncluding": "5.15.8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34D0AEC9-E2D5-4E2D-9099-3A257273BB27",
              "versionEndIncluding": "6.2.3",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory."
    },
    {
      "lang": "es",
      "value": "Qt versiones hasta 5.15.8 y versiones 6.x hasta 6.2.3, pueden cargar archivos de biblioteca del sistema desde un directorio de trabajo no deseado"
    }
  ],
  "id": "CVE-2022-25634",
  "lastModified": "2024-11-21T06:52:28.763",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-02T15:15:08.277",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://codereview.qt-project.org/c/qt/qtbase/+/396440"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://codereview.qt-project.org/c/qt/qtbase/+/396689"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://codereview.qt-project.org/c/qt/qtbase/+/396440"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://codereview.qt-project.org/c/qt/qtbase/+/396689"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple DLL Hijacking vulnerabilities in Siemens Software Center (SSC) could allow a local attacker to execute code with elevated privileges.\n\nSiemens has released an update for the Siemens Software Center and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-188491.html"
      },
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-188491.json"
      },
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-188491.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-188491.txt"
      }
    ],
    "title": "SSA-188491: DLL Hijacking Vulnerabilities in Siemens Software Center",
    "tracking": {
      "current_release_date": "2023-08-08T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-188491",
      "initial_release_date": "2023-08-08T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-08-08T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/\u003cV3.0",
                "product": {
                  "name": "Siemens Software Center",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Siemens Software Center"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-41544",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application host to prevent local access by untrusted personnel",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 or later version (Existing installations of SSC will be prompted to update whenever a new version is available. The latest version can also be downloaded in the respective link)",
          "product_ids": [
            "1"
          ],
          "url": "https://www.sw.siemens.com/en-US/siemens-software-center/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2021-41544"
    },
    {
      "cve": "CVE-2022-25634",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Harden the application host to prevent local access by untrusted personnel",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.0 or later version (Existing installations of SSC will be prompted to update whenever a new version is available. The latest version can also be downloaded in the respective link)",
          "product_ids": [
            "1"
          ],
          "url": "https://www.sw.siemens.com/en-US/siemens-software-center/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-25634"
    }
  ]
}

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-25634",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-25634"
    }
  },
  "description": "Qt\u662f\u632a\u5a01Qt\u516c\u53f8\u7684\u4e00\u4e2a\u8de8\u5e73\u53f0\u7684C++\u5e94\u7528\u7a0b\u5e8f\u5f00\u53d1\u6846\u67b6\u3002\u5e7f\u6cdb\u7528\u4e8e\u5f00\u53d1GUI\u7a0b\u5e8f\uff0c\u8fd9\u79cd\u60c5\u51b5\u4e0b\u53c8\u88ab\u79f0\u4e3a\u90e8\u4ef6\u5de5\u5177\u7bb1\u3002\u4e5f\u53ef\u7528\u4e8e\u5f00\u53d1\u975eGUI\u7a0b\u5e8f\uff0c\u4f8b\u5982\u63a7\u5236\u53f0\u5de5\u5177\u548c\u670d\u52a1\u5668\u3002\n\nQt 5.15.8\u4e4b\u524d\u7248\u672c\u548c6.X\u52306.2.3\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8f6f\u4ef6\u7f3a\u5c11\u5bf9\u4e8e\u76ee\u5f55\u7684\u9650\u5236\uff0c\u53ef\u4ee5\u4ece\u4e00\u4e2a\u610f\u60f3\u4e0d\u5230\u7684\u5de5\u4f5c\u76ee\u5f55\u52a0\u8f7d\u7cfb\u7edf\u5e93\u6587\u4ef6\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://codereview.qt-project.org/c/qt/qtbase/+/396689",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-18530",
  "openTime": "2022-03-11",
  "patchDescription": "Qt\u662f\u632a\u5a01Qt\u516c\u53f8\u7684\u4e00\u4e2a\u8de8\u5e73\u53f0\u7684C++\u5e94\u7528\u7a0b\u5e8f\u5f00\u53d1\u6846\u67b6\u3002\u5e7f\u6cdb\u7528\u4e8e\u5f00\u53d1GUI\u7a0b\u5e8f\uff0c\u8fd9\u79cd\u60c5\u51b5\u4e0b\u53c8\u88ab\u79f0\u4e3a\u90e8\u4ef6\u5de5\u5177\u7bb1\u3002\u4e5f\u53ef\u7528\u4e8e\u5f00\u53d1\u975eGUI\u7a0b\u5e8f\uff0c\u4f8b\u5982\u63a7\u5236\u53f0\u5de5\u5177\u548c\u670d\u52a1\u5668\u3002\r\n\r\nQt 5.15.8\u4e4b\u524d\u7248\u672c\u548c6.X\u52306.2.3\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8f6f\u4ef6\u7f3a\u5c11\u5bf9\u4e8e\u76ee\u5f55\u7684\u9650\u5236\uff0c\u53ef\u4ee5\u4ece\u4e00\u4e2a\u610f\u60f3\u4e0d\u5230\u7684\u5de5\u4f5c\u76ee\u5f55\u52a0\u8f7d\u7cfb\u7edf\u5e93\u6587\u4ef6\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Qt\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Qt Qt \u003c=5.15.8",
      "Qt Qt \u003e=6.0.0\uff0c\u003c=6.2.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-25634",
  "serverity": "\u4e2d",
  "submitTime": "2022-03-04",
  "title": "Qt\u8def\u5f84\u904d\u5386\u6f0f\u6d1e"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-25634"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-02T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.",
  "id": "GHSA-33f2-544v-wh7x",
  "modified": "2022-03-17T00:04:13Z",
  "published": "2022-03-03T00:00:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25634"
    },
    {
      "type": "WEB",
      "url": "https://codereview.qt-project.org/c/qt/qtbase/+/396440"
    },
    {
      "type": "WEB",
      "url": "https://codereview.qt-project.org/c/qt/qtbase/+/396689"
    },
    {
      "type": "WEB",
      "url": "https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690"
    },
    {
      "type": "WEB",
      "url": "https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff"
    },
    {
      "type": "WEB",
      "url": "https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2022-25634",
    "description": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.",
    "id": "GSD-2022-25634",
    "references": [
      "https://www.suse.com/security/cve/CVE-2022-25634.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-25634"
      ],
      "details": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.",
      "id": "GSD-2022-25634",
      "modified": "2023-12-13T01:19:26.372783Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2022-25634",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://codereview.qt-project.org/c/qt/qtbase/+/396440",
            "refsource": "CONFIRM",
            "url": "https://codereview.qt-project.org/c/qt/qtbase/+/396440"
          },
          {
            "name": "https://codereview.qt-project.org/c/qt/qtbase/+/396689",
            "refsource": "CONFIRM",
            "url": "https://codereview.qt-project.org/c/qt/qtbase/+/396689"
          },
          {
            "name": "https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff",
            "refsource": "CONFIRM",
            "url": "https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff"
          },
          {
            "name": "https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690",
            "refsource": "CONFIRM",
            "url": "https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690"
          },
          {
            "name": "https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff",
            "refsource": "CONFIRM",
            "url": "https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5.15.8",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.2.3",
                "versionStartIncluding": "6.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-25634"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://codereview.qt-project.org/c/qt/qtbase/+/396689",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://codereview.qt-project.org/c/qt/qtbase/+/396689"
            },
            {
              "name": "https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff"
            },
            {
              "name": "https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff"
            },
            {
              "name": "https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690",
              "refsource": "CONFIRM",
              "tags": [
                "Broken Link"
              ],
              "url": "https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690"
            },
            {
              "name": "https://codereview.qt-project.org/c/qt/qtbase/+/396440",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://codereview.qt-project.org/c/qt/qtbase/+/396440"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-03-09T19:14Z",
      "publishedDate": "2022-03-02T15:15Z"
    }
  }
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cul\u003e \u003cli\u003eSICAM TOOLBOX II versions ant\u00e9rieures \u00e0 07.10\u003c/li\u003e \u003cli\u003eP\u00e9riph\u00e9riques RUGGEDCOM ROS versions ant\u00e9rieures \u00e0 4.3.8\u003c/li\u003e \u003cli\u003eSolid Edge SE2023 versions ant\u00e9rieures \u00e0 223.0 Update 7\u003c/li\u003e \u003cli\u003eRUGGEDCOM CROSSBOW versions ant\u00e9rieures \u00e0 5.4\u003c/li\u003e \u003cli\u003eParasolid versions 34.1.x ant\u00e9rieures \u00e0 34.1.258\u003c/li\u003e \u003cli\u003eParasolid versions 35.0.x ant\u00e9rieures \u00e0 35.0.254\u003c/li\u003e \u003cli\u003eParasolid versions 35.1.x ant\u00e9rieures \u00e0 35.1.197\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 14.1.x, se r\u00e9f\u00e9rer \u00e0 l\u0027avis \u00e9diteur pour plus d\u0027information sur les mesures de contournement\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 14.2.x ant\u00e9rieures \u00e0 14.2.0.6\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 14.3.x, se r\u00e9f\u00e9rer \u00e0 l\u0027avis \u00e9diteur pour plus d\u0027information sur les mesures de contournement\u003c/li\u003e \u003cli\u003eSIMATIC contr\u00f4leur de disque CPU 1504D versions ant\u00e9rieures \u00e0 3.0.3\u003c/li\u003e \u003cli\u003eSIMATIC contr\u00f4leur de disque CPU 1507D versions ant\u00e9rieures \u00e0 3.0.3\u003c/li\u003e \u003cli\u003eSIMATIC ET toutes versions\u003c/li\u003e \u003cli\u003eSIMATIC IPC toutes versions\u003c/li\u003e \u003cli\u003eSIMATIC S7 versions ant\u00e9rieures \u00e0 3.0.3\u003c/li\u003e \u003cli\u003eSIPLUS ET versions ant\u00e9rieures \u00e0 3.3.19\u003c/li\u003e \u003cli\u003eSIPLUS S7 versions ant\u00e9rieures \u00e0 3.0.3\u003c/li\u003e \u003cli\u003eSiemens Software Center versions ant\u00e9rieures \u00e0 3.0\u003c/li\u003e \u003cli\u003eAPOGEE PXC Compact versions ant\u00e9rieures \u00e0 3.5.5\u003c/li\u003e \u003cli\u003eAPOGEE PXC Compact (P2 Ethernet) versions ant\u00e9rieures \u00e0 2.8.20\u003c/li\u003e \u003cli\u003eAPOGEE PXC Modular (BACnet) versions ant\u00e9rieures \u00e0 3.5.5\u003c/li\u003e \u003cli\u003eAPOGEE PXC Modular (P2 Ethernet) versions ant\u00e9rieures \u00e0 2.8.20\u003c/li\u003e \u003cli\u003eTALON TC Compact versions ant\u00e9rieures \u00e0 3.5.5\u003c/li\u003e \u003cli\u003eTALON TC Modular (BACnet) versions ant\u00e9rieures \u00e0 3.5.5\u003c/li\u003e \u003cli\u003eJT2Go versions ant\u00e9rieures \u00e0 14.2.0.5\u003c/li\u003e \u003cli\u003eSolid Edge SE2022 versions ant\u00e9rieures \u00e0 222.0 Update 13\u003c/li\u003e \u003cli\u003eSolid Edge SE2023 versions ant\u00e9rieures \u00e0 223.0 Update 4\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 13.2.x ant\u00e9rieures \u00e0 13.2.0.15\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 13.3.x ant\u00e9rieures \u00e0 13.3.0.11\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 14.1.x ant\u00e9rieures \u00e0 14.1.0.11\u003c/li\u003e \u003cli\u003eTeamcenter Visualization versions 14.2.x ant\u00e9rieures \u00e0 14.2.0.5\u003c/li\u003e \u003cli\u003eParasolid versions 35.0.x sans la proc\u00e9dure de r\u00e9installation\u003c/li\u003e \u003cli\u003eParasolid versions 35.1.x sans la proc\u00e9dure de r\u00e9installation\u003c/li\u003e \u003cli\u003eJT Open versions ant\u00e9rieures \u00e0 11.4\u003c/li\u003e \u003cli\u003eJT Utilities versions ant\u00e9rieures \u00e0 13.4\u003c/li\u003e \u003cli\u003eParasolid versions 34.0.x ant\u00e9rieures \u00e0 34.0.253\u003c/li\u003e \u003cli\u003eParasolid versions 34.1.x ant\u00e9rieures \u00e0 34.1.243\u003c/li\u003e \u003cli\u003eParasolid versions 35.0.x ant\u00e9rieures \u00e0 35.0.177\u003c/li\u003e \u003cli\u003eParasolid versions 35.1.x ant\u00e9rieures \u00e0 35.1.073\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eL\u0027\u00e9diteur ne propose pas de correctif pour certains produits RUGGEDCOM ROS, SIMATIC ou SIPLUS, se r\u00e9f\u00e9rer aux avis pour obtenir plus d\u0027informations sur les mesures de contournement.\u003c/p\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-27009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27009"
    },
    {
      "name": "CVE-2022-37971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-37971"
    },
    {
      "name": "CVE-2023-27411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27411"
    },
    {
      "name": "CVE-2020-28388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28388"
    },
    {
      "name": "CVE-2023-24845",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24845"
    },
    {
      "name": "CVE-2023-39419",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39419"
    },
    {
      "name": "CVE-2023-39183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39183"
    },
    {
      "name": "CVE-2022-4304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4304"
    },
    {
      "name": "CVE-2020-27736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27736"
    },
    {
      "name": "CVE-2023-39269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39269"
    },
    {
      "name": "CVE-2023-0286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-0286"
    },
    {
      "name": "CVE-2023-38526",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38526"
    },
    {
      "name": "CVE-2023-38641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38641"
    },
    {
      "name": "CVE-2023-39187",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39187"
    },
    {
      "name": "CVE-2023-39188",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39188"
    },
    {
      "name": "CVE-2020-15795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15795"
    },
    {
      "name": "CVE-2023-39185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39185"
    },
    {
      "name": "CVE-2022-39062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39062"
    },
    {
      "name": "CVE-2023-28830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28830"
    },
    {
      "name": "CVE-2023-38531",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38531"
    },
    {
      "name": "CVE-2023-38524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38524"
    },
    {
      "name": "CVE-2023-39186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39186"
    },
    {
      "name": "CVE-2023-37372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37372"
    },
    {
      "name": "CVE-2021-41544",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41544"
    },
    {
      "name": "CVE-2022-25634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25634"
    },
    {
      "name": "CVE-2023-39182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39182"
    },
    {
      "name": "CVE-2021-31239",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31239"
    },
    {
      "name": "CVE-2023-37373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37373"
    },
    {
      "name": "CVE-2023-39184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39184"
    },
    {
      "name": "CVE-2023-38525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38525"
    },
    {
      "name": "CVE-2020-27738",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27738"
    },
    {
      "name": "CVE-2023-30795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30795"
    },
    {
      "name": "CVE-2023-38530",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38530"
    },
    {
      "name": "CVE-2023-38527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38527"
    },
    {
      "name": "CVE-2022-45937",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45937"
    },
    {
      "name": "CVE-2023-37378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37378"
    },
    {
      "name": "CVE-2023-38528",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38528"
    },
    {
      "name": "CVE-2023-39181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39181"
    },
    {
      "name": "CVE-2023-4304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-4304"
    },
    {
      "name": "CVE-2023-38682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38682"
    },
    {
      "name": "CVE-2023-38532",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38532"
    },
    {
      "name": "CVE-2023-30796",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30796"
    },
    {
      "name": "CVE-2023-38529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38529"
    },
    {
      "name": "CVE-2023-38683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38683"
    },
    {
      "name": "CVE-2020-27737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-27737"
    },
    {
      "name": "CVE-2021-25677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-25677"
    }
  ],
  "initial_release_date": "2023-08-08T00:00:00",
  "last_revision_date": "2023-08-08T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0633",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-08-08T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-472630 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-472630.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-264815 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-264815.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-770902 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-770902.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-975961 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-975961.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-908185 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-908185.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-131450 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-131450.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-407785 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-407785.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-180579 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-180579.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-811403 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-811403.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-264814 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-264814.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-116172 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-116172.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-188491 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-188491.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-001569 du 8 ao\u00fbt 2023",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-001569.html"
    }
  ]
}