Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2024-0727
Vulnerability from cvelistv5
Published
2024-01-26 08:57
Modified
2024-10-14 14:55
Severity ?
EPSS score ?
Summary
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files in the PKCS12 format from untrusted
sources might terminate abruptly.
A file in PKCS12 format can contain certificates and keys and may come from an
untrusted source. The PKCS12 specification allows certain fields to be NULL, but
OpenSSL does not correctly check for this case. This can lead to a NULL pointer
dereference that results in OpenSSL crashing. If an application processes PKCS12
files from an untrusted source using the OpenSSL APIs then that application will
be vulnerable to this issue.
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(),
PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
function is related to writing data we do not consider it security significant.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T18:18:17.369Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "OpenSSL Advisory", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.openssl.org/news/secadv/20240125.txt" }, { "name": "3.2.1 git commit", "tags": [ "patch", "x_transferred" ], "url": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a" }, { "name": "3.1.5 git commit", "tags": [ "patch", "x_transferred" ], "url": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c" }, { "name": "3.0.13 git commit", "tags": [ "patch", "x_transferred" ], "url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2" }, { "name": "1.1.1x git commit", "tags": [ "patch", "x_transferred" ], "url": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8" }, { "name": "1.0.2zj git commit", "tags": [ "patch", "x_transferred" ], "url": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20240208-0006/" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/03/11/1" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "OpenSSL", "vendor": "OpenSSL", "versions": [ { "lessThan": "3.2.1", "status": "affected", "version": "3.2.0", "versionType": "semver" }, { "lessThan": "3.1.5", "status": "affected", "version": "3.1.0", "versionType": "semver" }, { "lessThan": "3.0.13", "status": "affected", "version": "3.0.0", "versionType": "semver" }, { "lessThan": "1.1.1x", "status": "affected", "version": "1.1.1", "versionType": "custom" }, { "lessThan": "1.0.2zj", "status": "affected", "version": "1.0.2", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Bahaa Naamneh (Crosspoint Labs)" }, { "lang": "en", "type": "remediation developer", "user": "00000000-0000-4000-9000-000000000000", "value": "Matt Caswell" } ], "datePublic": "2024-01-25T00:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\u003cbr\u003eto crash leading to a potential Denial of Service attack\u003cbr\u003e\u003cbr\u003eImpact summary: Applications loading files in the PKCS12 format from untrusted\u003cbr\u003esources might terminate abruptly.\u003cbr\u003e\u003cbr\u003eA file in PKCS12 format can contain certificates and keys and may come from an\u003cbr\u003euntrusted source. The PKCS12 specification allows certain fields to be NULL, but\u003cbr\u003eOpenSSL does not correctly check for this case. This can lead to a NULL pointer\u003cbr\u003edereference that results in OpenSSL crashing. If an application processes PKCS12\u003cbr\u003efiles from an untrusted source using the OpenSSL APIs then that application will\u003cbr\u003ebe vulnerable to this issue.\u003cbr\u003e\u003cbr\u003eOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\u003cbr\u003ePKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\u003cbr\u003eand PKCS12_newpass().\u003cbr\u003e\u003cbr\u003eWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\u003cbr\u003efunction is related to writing data we do not consider it security significant.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue." } ], "value": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue." } ], "metrics": [ { "format": "other", "other": { "content": { "text": "Low" }, "type": "https://www.openssl.org/policies/secpolicy.html" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-14T14:55:58.371Z", "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl" }, "references": [ { "name": "OpenSSL Advisory", "tags": [ "vendor-advisory" ], "url": "https://www.openssl.org/news/secadv/20240125.txt" }, { "name": "3.2.1 git commit", "tags": [ "patch" ], "url": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a" }, { "name": "3.1.5 git commit", "tags": [ "patch" ], "url": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c" }, { "name": "3.0.13 git commit", "tags": [ "patch" ], "url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2" }, { "name": "1.1.1x git commit", "tags": [ "patch" ], "url": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8" }, { "name": "1.0.2zj git commit", "tags": [ "patch" ], "url": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539" } ], "source": { "discovery": "UNKNOWN" }, "title": "PKCS12 Decoding crashes", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "assignerShortName": "openssl", "cveId": "CVE-2024-0727", "datePublished": "2024-01-26T08:57:19.579Z", "dateReserved": "2024-01-19T11:01:11.010Z", "dateUpdated": "2024-10-14T14:55:58.371Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-0727\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2024-01-26T09:15:07.637\",\"lastModified\":\"2024-11-21T08:47:13.723\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\\nto crash leading to a potential Denial of Service attack\\n\\nImpact summary: Applications loading files in the PKCS12 format from untrusted\\nsources might terminate abruptly.\\n\\nA file in PKCS12 format can contain certificates and keys and may come from an\\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\\ndereference that results in OpenSSL crashing. If an application processes PKCS12\\nfiles from an untrusted source using the OpenSSL APIs then that application will\\nbe vulnerable to this issue.\\n\\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\\nand PKCS12_newpass().\\n\\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\\nfunction is related to writing data we do not consider it security significant.\\n\\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.\"},{\"lang\":\"es\",\"value\":\"Resumen del problema: el procesamiento de un archivo PKCS12 con formato malintencionado puede hacer que OpenSSL falle y provoque un posible ataque de denegaci\u00f3n de servicio. Resumen de impacto: las aplicaciones que cargan archivos en formato PKCS12 desde fuentes que no son de confianza pueden finalizar abruptamente. Un archivo en formato PKCS12 puede contener certificados y claves y puede provenir de una fuente que no es de confianza. La especificaci\u00f3n PKCS12 permite que ciertos campos sean NULL, pero OpenSSL no verifica correctamente este caso. Esto puede provocar una desreferencia del puntero NULL que provoque el bloqueo de OpenSSL. Si una aplicaci\u00f3n procesa archivos PKCS12 de una fuente que no es de confianza utilizando las API de OpenSSL, esa aplicaci\u00f3n ser\u00e1 vulnerable a este problema. Las API de OpenSSL que son vulnerables a esto son: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() y PKCS12_newpass(). Tambi\u00e9n solucionamos un problema similar en SMIME_write_PKCS7(). Sin embargo, dado que esta funci\u00f3n est\u00e1 relacionada con la escritura de datos, no la consideramos importante para la seguridad. Los m\u00f3dulos FIPS en 3.2, 3.1 y 3.0 no se ven afectados por este problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"openssl-security@openssl.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0.2\",\"versionEndExcluding\":\"1.0.2zj\",\"matchCriteriaId\":\"E30B9424-68AA-4ED4-A1CB-3DA32A2350EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1.1\",\"versionEndExcluding\":\"1.1.1x\",\"matchCriteriaId\":\"93CF937D-2520-44AF-B40B-B41720BEAB36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"3.0.13\",\"matchCriteriaId\":\"21346C7C-ED3A-43D4-BBCB-41D62F7ACBF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.1.0\",\"versionEndExcluding\":\"3.1.5\",\"matchCriteriaId\":\"AAD34F57-90D2-415F-9544-70B594D04E53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:3.2.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA5220D8-3CAD-4524-BA73-1656FB437446\"}]}]}],\"references\":[{\"url\":\"https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://www.openssl.org/news/secadv/20240125.txt\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/03/11/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240208-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.openssl.org/news/secadv/20240125.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
ncsc-2025-0028
Vulnerability from csaf_ncscnl
Published
2025-01-22 13:36
Modified
2025-01-22 13:36
Summary
Kwetsbaarheden verholpen in Oracle Analytics
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Oracle heeft kwetsbaarheden verholpen in Oracle Analytics producten, zoals Business Intelligence, Analytics Desktop en BI Publisher.
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, of zich toegang te verschaffen tot gevoelige gegevens.
Oplossingen
Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-416
Use After Free
CWE-476
NULL Pointer Dereference
CWE-400
Uncontrolled Resource Consumption
CWE-770
Allocation of Resources Without Limits or Throttling
CWE-502
Deserialization of Untrusted Data
CWE-248
Uncaught Exception
CWE-674
Uncontrolled Recursion
CWE-611
Improper Restriction of XML External Entity Reference
CWE-787
Out-of-bounds Write
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-789
Memory Allocation with Excessive Size Value
CWE-20
Improper Input Validation
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1395
Dependency on Vulnerable Third-Party Component
CWE-670
Always-Incorrect Control Flow Implementation
CWE-399
CWE-399
CWE-326
Inadequate Encryption Strength
CWE-669
Incorrect Resource Transfer Between Spheres
CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-834
Excessive Iteration
CWE-311
Missing Encryption of Sensitive Data
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-125
Out-of-bounds Read
CWE-404
Improper Resource Shutdown or Release
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-1333
Inefficient Regular Expression Complexity
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Oracle heeft kwetsbaarheden verholpen in Oracle Analytics producten, zoals Business Intelligence, Analytics Desktop en BI Publisher.", "title": "Feiten" }, { "category": "description", "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, of zich toegang te verschaffen tot gevoelige gegevens.", "title": "Interpretaties" }, { "category": "description", "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Use After Free", "title": "CWE-416" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "general", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "general", "text": "Uncaught Exception", "title": "CWE-248" }, { "category": "general", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "general", "text": "Improper Restriction of XML External Entity Reference", "title": "CWE-611" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "Memory Allocation with Excessive Size Value", "title": "CWE-789" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "general", "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "title": "CWE-79" }, { "category": "general", "text": "Dependency on Vulnerable Third-Party Component", "title": "CWE-1395" }, { "category": "general", "text": "Always-Incorrect Control Flow Implementation", "title": "CWE-670" }, { "category": "general", "text": "CWE-399", "title": "CWE-399" }, { "category": "general", "text": "Inadequate Encryption Strength", "title": "CWE-326" }, { "category": "general", "text": "Incorrect Resource Transfer Between Spheres", "title": "CWE-669" }, { "category": "general", "text": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)", "title": "CWE-776" }, { "category": "general", "text": "Excessive Iteration", "title": "CWE-834" }, { "category": "general", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" }, { "category": "general", "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)", "title": "CWE-444" }, { "category": "general", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" }, { "category": "general", "text": "Inefficient Regular Expression Complexity", "title": "CWE-1333" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference - cveprojectv5; nvd; oracle", "url": "https://www.oracle.com/security-alerts/cpujan2025.html" } ], "title": "Kwetsbaarheden verholpen in Oracle Analytics", "tracking": { "current_release_date": "2025-01-22T13:36:58.196605Z", "id": "NCSC-2025-0028", "initial_release_date": "2025-01-22T13:36:58.196605Z", "revision_history": [ { "date": "2025-01-22T13:36:58.196605Z", "number": "0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "business_intelligence", "product": { "name": "business_intelligence", "product_id": "CSAFPID-1503296", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence", "product": { "name": "business_intelligence", "product_id": "CSAFPID-220360", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:*:enterprise:*:*" } } }, { "category": "product_name", "name": "business_intelligence", "product": { "name": "business_intelligence", "product_id": "CSAFPID-135810", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence", "product": { "name": "business_intelligence", "product_id": "CSAFPID-219994", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:enterprise:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence", "product": { "name": "business_intelligence", "product_id": "CSAFPID-219817", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence:6.4.0.0.0:enterprise:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence", "product": { "name": "business_intelligence", "product_id": "CSAFPID-1503297", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence:7.0.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence", "product": { "name": "business_intelligence", "product_id": "CSAFPID-257324", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence:7.0.0.0.0:*:*:*:enterprise:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence", "product": { "name": "business_intelligence", "product_id": "CSAFPID-1503298", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence:7.6.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence", "product": { "name": "business_intelligence", "product_id": "CSAFPID-1650736", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence:7.6.0.0.0:*:*:*:enterprise:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-765384", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:12.2.1.3.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764234", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:12.2.1.4.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-765387", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:5.5.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764778", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:5.9.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764929", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:5.9.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764235", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:6.4.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764930", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:6.4.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764236", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:7.0.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-1503574", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:7.6.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-1503573", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___12.2.1.4.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-765388", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___5.9.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764727", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___6.4.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764729", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_analytics_server___7.0.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-765383", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_bi_platform_security___12.2.1.3.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-765385", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_bi_platform_security___12.2.1.4.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-765389", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_bi_platform_security___5.9.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764725", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_presentation_services___12.2.1.4.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764728", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_presentation_services___6.4.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764730", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_presentation_services___7.0.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-764726", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_service_administration_ui___12.2.1.4.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "business_intelligence_enterprise_edition", "product": { "name": "business_intelligence_enterprise_edition", "product_id": "CSAFPID-765386", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:business_intelligence_enterprise_edition:_storage_service_integration___12.2.1.4.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "bi_publisher", "product": { "name": "bi_publisher", "product_id": "CSAFPID-9197", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "bi_publisher", "product": { "name": "bi_publisher", "product_id": "CSAFPID-9493", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "bi_publisher", "product": { "name": "bi_publisher", "product_id": "CSAFPID-220546", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:bi_publisher:5.9.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "bi_publisher", "product": { "name": "bi_publisher", "product_id": "CSAFPID-228391", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:bi_publisher:5.9.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "bi_publisher", "product": { "name": "bi_publisher", "product_id": "CSAFPID-220545", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:bi_publisher:6.4.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "bi_publisher", "product": { "name": "bi_publisher", "product_id": "CSAFPID-220560", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "bi_publisher", "product": { "name": "bi_publisher", "product_id": "CSAFPID-1673195", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:bi_publisher:7.6.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-816763", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-816761", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:6.4.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-816762", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:7.0.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-1751172", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:8.1.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-1650735", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:prior_to_7.8.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-1751157", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:prior_to_8.1.0:*:*:*:*:*:*:*" } } } ], "category": "vendor", "name": "oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-10000", "references": [ { "category": "self", "summary": "CVE-2016-10000", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2016/CVE-2016-10000.json" } ], "title": "CVE-2016-10000" }, { "cve": "CVE-2020-2849", "product_status": { "known_affected": [ "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2020-2849", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-2849.json" } ], "title": "CVE-2020-2849" }, { "cve": "CVE-2020-7760", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-9493", "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764235", "CSAFPID-764236", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-765383", "CSAFPID-765384", "CSAFPID-765385", "CSAFPID-765386", "CSAFPID-765387", "CSAFPID-765388", "CSAFPID-765389", "CSAFPID-764778", "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2020-7760", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-7760.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-9493", "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764235", "CSAFPID-764236", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-765383", "CSAFPID-765384", "CSAFPID-765385", "CSAFPID-765386", "CSAFPID-765387", "CSAFPID-765388", "CSAFPID-765389", "CSAFPID-764778", "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763", "CSAFPID-257324" ] } ], "title": "CVE-2020-7760" }, { "cve": "CVE-2020-13956", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-9493", "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764235", "CSAFPID-764236", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-228391", "CSAFPID-764778", "CSAFPID-220546", "CSAFPID-9197", "CSAFPID-764929", "CSAFPID-764930", "CSAFPID-765383", "CSAFPID-765384", "CSAFPID-765385", "CSAFPID-765386", "CSAFPID-765387", "CSAFPID-765388", "CSAFPID-765389", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-1503574", "CSAFPID-257324", "CSAFPID-135810" ] }, "references": [ { "category": "self", "summary": "CVE-2020-13956", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-13956.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-9493", "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764235", "CSAFPID-764236", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-228391", "CSAFPID-764778", "CSAFPID-220546", "CSAFPID-9197", "CSAFPID-764929", "CSAFPID-764930", "CSAFPID-765383", "CSAFPID-765384", "CSAFPID-765385", "CSAFPID-765386", "CSAFPID-765387", "CSAFPID-765388", "CSAFPID-765389", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-1503574", "CSAFPID-257324", "CSAFPID-135810" ] } ], "title": "CVE-2020-13956" }, { "cve": "CVE-2020-28975", "product_status": { "known_affected": [ "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2020-28975", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2020/CVE-2020-28975.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-257324" ] } ], "title": "CVE-2020-28975" }, { "cve": "CVE-2021-23926", "cwe": { "id": "CWE-776", "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)" }, "notes": [ { "category": "other", "text": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)", "title": "CWE-776" }, { "category": "other", "text": "Improper Restriction of XML External Entity Reference", "title": "CWE-611" } ], "product_status": { "known_affected": [ "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764234", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764235", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-764236", "CSAFPID-9493", "CSAFPID-764778", "CSAFPID-228391", "CSAFPID-135810", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-220546", "CSAFPID-9197", "CSAFPID-764929", "CSAFPID-764930" ] }, "references": [ { "category": "self", "summary": "CVE-2021-23926", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2021/CVE-2021-23926.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764234", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764235", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-764236", "CSAFPID-9493", "CSAFPID-764778", "CSAFPID-228391", "CSAFPID-135810", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-220546", "CSAFPID-9197", "CSAFPID-764929", "CSAFPID-764930" ] } ], "title": "CVE-2021-23926" }, { "cve": "CVE-2021-33813", "cwe": { "id": "CWE-611", "name": "Improper Restriction of XML External Entity Reference" }, "notes": [ { "category": "other", "text": "Improper Restriction of XML External Entity Reference", "title": "CWE-611" } ], "product_status": { "known_affected": [ "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764234", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764235", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-764236", "CSAFPID-9197", "CSAFPID-9493", "CSAFPID-228391", "CSAFPID-764778", "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763", "CSAFPID-765383", "CSAFPID-765384", "CSAFPID-765385", "CSAFPID-765386", "CSAFPID-765387", "CSAFPID-765388", "CSAFPID-765389", "CSAFPID-135810" ] }, "references": [ { "category": "self", "summary": "CVE-2021-33813", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2021/CVE-2021-33813.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764234", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764235", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-764236", "CSAFPID-9197", "CSAFPID-9493", "CSAFPID-228391", "CSAFPID-764778", "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763", "CSAFPID-765383", "CSAFPID-765384", "CSAFPID-765385", "CSAFPID-765386", "CSAFPID-765387", "CSAFPID-765388", "CSAFPID-765389", "CSAFPID-135810" ] } ], "title": "CVE-2021-33813" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764234", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764235", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-764236", "CSAFPID-9493", "CSAFPID-764778", "CSAFPID-228391", "CSAFPID-135810", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574" ] }, "references": [ { "category": "self", "summary": "CVE-2022-40150", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-40150.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764234", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764235", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-764236", "CSAFPID-9493", "CSAFPID-764778", "CSAFPID-228391", "CSAFPID-135810", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574" ] } ], "title": "CVE-2022-40150" }, { "cve": "CVE-2023-2976", "cwe": { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" }, "notes": [ { "category": "other", "text": "Files or Directories Accessible to External Parties", "title": "CWE-552" }, { "category": "other", "text": "Creation of Temporary File in Directory with Insecure Permissions", "title": "CWE-379" } ], "product_status": { "known_affected": [ "CSAFPID-9493", "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763", "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764235", "CSAFPID-764236", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-2976", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-2976.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-9493", "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763", "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764235", "CSAFPID-764236", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-257324" ] } ], "title": "CVE-2023-2976" }, { "cve": "CVE-2023-4785", "cwe": { "id": "CWE-248", "name": "Uncaught Exception" }, "notes": [ { "category": "other", "text": "Uncaught Exception", "title": "CWE-248" } ], "product_status": { "known_affected": [ "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-4785", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4785.json" } ], "title": "CVE-2023-4785" }, { "cve": "CVE-2023-7272", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" } ], "product_status": { "known_affected": [ "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-7272", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-7272.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-257324" ] } ], "title": "CVE-2023-7272" }, { "cve": "CVE-2023-24998", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "other", "text": "CWE-399", "title": "CWE-399" } ], "product_status": { "known_affected": [ "CSAFPID-9493", "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764235", "CSAFPID-764236", "CSAFPID-764778", "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763", "CSAFPID-764725", "CSAFPID-764726", "CSAFPID-764727", "CSAFPID-764728", "CSAFPID-764729", "CSAFPID-764730", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-135810" ] }, "references": [ { "category": "self", "summary": "CVE-2023-24998", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-24998.json" } ], "title": "CVE-2023-24998" }, { "cve": "CVE-2023-25399", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" } ], "product_status": { "known_affected": [ "CSAFPID-1650736", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-25399", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-25399.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1650736", "CSAFPID-257324" ] } ], "title": "CVE-2023-25399" }, { "cve": "CVE-2023-29824", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" } ], "product_status": { "known_affected": [ "CSAFPID-1650736", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-29824", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-29824.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1650736", "CSAFPID-257324" ] } ], "title": "CVE-2023-29824" }, { "cve": "CVE-2023-32732", "cwe": { "id": "CWE-440", "name": "Expected Behavior Violation" }, "notes": [ { "category": "other", "text": "Expected Behavior Violation", "title": "CWE-440" } ], "product_status": { "known_affected": [ "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32732", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32732.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-257324" ] } ], "title": "CVE-2023-32732" }, { "cve": "CVE-2023-33202", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-1650735", "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-33202", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-33202.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1650735", "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-257324" ] } ], "title": "CVE-2023-33202" }, { "cve": "CVE-2023-33953", "cwe": { "id": "CWE-834", "name": "Excessive Iteration" }, "notes": [ { "category": "other", "text": "Excessive Iteration", "title": "CWE-834" }, { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "other", "text": "Memory Allocation with Excessive Size Value", "title": "CWE-789" } ], "product_status": { "known_affected": [ "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-33953", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-33953.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-257324" ] } ], "title": "CVE-2023-33953" }, { "cve": "CVE-2023-43804", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" } ], "product_status": { "known_affected": [ "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-43804", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-43804.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-257324" ] } ], "title": "CVE-2023-43804" }, { "cve": "CVE-2023-44487", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-9493", "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764235", "CSAFPID-764236", "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-44487", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-44487.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-9493", "CSAFPID-220545", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764235", "CSAFPID-764236", "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-257324" ] } ], "title": "CVE-2023-44487" }, { "cve": "CVE-2023-45803", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" } ], "product_status": { "known_affected": [ "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-45803", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-45803.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-257324" ] } ], "title": "CVE-2023-45803" }, { "cve": "CVE-2023-50782", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "notes": [ { "category": "other", "text": "Observable Timing Discrepancy", "title": "CWE-208" }, { "category": "other", "text": "Observable Discrepancy", "title": "CWE-203" } ], "product_status": { "known_affected": [ "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2023-50782", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-50782.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-257324" ] } ], "title": "CVE-2023-50782" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-135810", "CSAFPID-1650736", "CSAFPID-257324", "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0727", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0727.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-135810", "CSAFPID-1650736", "CSAFPID-257324", "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-1135", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "notes": [ { "category": "other", "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)", "title": "CWE-444" } ], "product_status": { "known_affected": [ "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2024-1135", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-1135.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-257324" ] } ], "title": "CVE-2024-1135" }, { "cve": "CVE-2024-4741", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" } ], "product_status": { "known_affected": [ "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-1503574", "CSAFPID-1650736", "CSAFPID-257324", "CSAFPID-135810" ] }, "references": [ { "category": "self", "summary": "CVE-2024-4741", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4741.json" } ], "title": "CVE-2024-4741" }, { "cve": "CVE-2024-5535", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "other", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" }, { "category": "other", "text": "Dependency on Vulnerable Third-Party Component", "title": "CWE-1395" } ], "product_status": { "known_affected": [ "CSAFPID-135810", "CSAFPID-1650736", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2024-5535", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-5535.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-135810", "CSAFPID-1650736", "CSAFPID-257324" ] } ], "title": "CVE-2024-5535" }, { "cve": "CVE-2024-7254", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "other", "text": "Uncontrolled Recursion", "title": "CWE-674" } ], "product_status": { "known_affected": [ "CSAFPID-220560", "CSAFPID-1673195", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2024-7254", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-7254.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-220560", "CSAFPID-1673195", "CSAFPID-257324" ] } ], "title": "CVE-2024-7254" }, { "cve": "CVE-2024-22195", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "title": "CWE-79" } ], "product_status": { "known_affected": [ "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2024-22195", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22195.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-257324" ] } ], "title": "CVE-2024-22195" }, { "cve": "CVE-2024-26130", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" } ], "product_status": { "known_affected": [ "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2024-26130", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26130.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-9493", "CSAFPID-220560", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-1503574", "CSAFPID-257324" ] } ], "title": "CVE-2024-26130" }, { "cve": "CVE-2024-29025", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" } ], "product_status": { "known_affected": [ "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-1503574", "CSAFPID-220560", "CSAFPID-1673195" ] }, "references": [ { "category": "self", "summary": "CVE-2024-29025", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29025.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-1503574", "CSAFPID-220560", "CSAFPID-1673195" ] } ], "title": "CVE-2024-29025" }, { "cve": "CVE-2024-29131", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" } ], "product_status": { "known_affected": [ "CSAFPID-257324", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-1503574", "CSAFPID-1650736" ] }, "references": [ { "category": "self", "summary": "CVE-2024-29131", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29131.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-257324", "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-1503574", "CSAFPID-1650736" ] } ], "title": "CVE-2024-29131" }, { "cve": "CVE-2024-34064", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "title": "CWE-79" } ], "product_status": { "known_affected": [ "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-1503574", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2024-34064", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-34064.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-816763", "CSAFPID-1503573", "CSAFPID-765385", "CSAFPID-764234", "CSAFPID-764236", "CSAFPID-1503574", "CSAFPID-257324" ] } ], "title": "CVE-2024-34064" }, { "cve": "CVE-2024-35195", "cwe": { "id": "CWE-670", "name": "Always-Incorrect Control Flow Implementation" }, "notes": [ { "category": "other", "text": "Always-Incorrect Control Flow Implementation", "title": "CWE-670" } ], "product_status": { "known_affected": [ "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2024-35195", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-35195.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-257324" ] } ], "title": "CVE-2024-35195" }, { "cve": "CVE-2024-36114", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" } ], "product_status": { "known_affected": [ "CSAFPID-1650736", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2024-36114", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-36114.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1" }, "products": [ "CSAFPID-1650736", "CSAFPID-257324" ] } ], "title": "CVE-2024-36114" }, { "cve": "CVE-2024-37891", "cwe": { "id": "CWE-669", "name": "Incorrect Resource Transfer Between Spheres" }, "notes": [ { "category": "other", "text": "Incorrect Resource Transfer Between Spheres", "title": "CWE-669" } ], "product_status": { "known_affected": [ "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2024-37891", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-37891.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-257324" ] } ], "title": "CVE-2024-37891" }, { "cve": "CVE-2024-38809", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "notes": [ { "category": "other", "text": "Inefficient Regular Expression Complexity", "title": "CWE-1333" }, { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-220560", "CSAFPID-1673195", "CSAFPID-1650736", "CSAFPID-257324", "CSAFPID-135810" ] }, "references": [ { "category": "self", "summary": "CVE-2024-38809", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38809.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.0, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-220560", "CSAFPID-1673195", "CSAFPID-1650736", "CSAFPID-257324", "CSAFPID-135810" ] } ], "title": "CVE-2024-38809" }, { "cve": "CVE-2024-38820", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "other", "text": "Improper Access Control", "title": "CWE-284" }, { "category": "other", "text": "Improper Handling of Case Sensitivity", "title": "CWE-178" } ], "product_status": { "known_affected": [ "CSAFPID-220560", "CSAFPID-1673195" ] }, "references": [ { "category": "self", "summary": "CVE-2024-38820", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38820.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-220560", "CSAFPID-1673195" ] } ], "title": "CVE-2024-38820" }, { "cve": "CVE-2024-43382", "cwe": { "id": "CWE-311", "name": "Missing Encryption of Sensitive Data" }, "notes": [ { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" }, { "category": "other", "text": "Inadequate Encryption Strength", "title": "CWE-326" } ], "product_status": { "known_affected": [ "CSAFPID-220560", "CSAFPID-1673195" ] }, "references": [ { "category": "self", "summary": "CVE-2024-43382", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-43382.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-220560", "CSAFPID-1673195" ] } ], "title": "CVE-2024-43382" }, { "cve": "CVE-2024-47561", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" } ], "product_status": { "known_affected": [ "CSAFPID-1650736", "CSAFPID-257324" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47561", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47561.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1650736", "CSAFPID-257324" ] } ], "title": "CVE-2024-47561" }, { "cve": "CVE-2025-21532", "product_status": { "known_affected": [ "CSAFPID-1751157" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21532", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21532.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751157" ] } ], "title": "CVE-2025-21532" } ] }
ncsc-2025-0026
Vulnerability from csaf_ncscnl
Published
2025-01-22 13:34
Modified
2025-01-22 13:34
Summary
Kwetsbaarheden verholpen in Oracle JD Edwards
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Oracle heeft kwetsbaarheden verholpen in JD Edwards EnterpriseOne Tools (specifiek voor versies prior tot 9.2.9.2).
Interpretaties
De kwetsbaarheden in Oracle JD Edwards EnterpriseOne Tools stellen ongeauthenticeerde kwaadwillenden in staat om het systeem te compromitteren via HTTP-verzoeken. Dit kan leiden tot ongeautoriseerde toegang tot kritieke gegevens en gegevenswijzigingen.
Oplossingen
Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-222
Truncation of Security-relevant Information
CWE-328
Use of Weak Hash
CWE-126
Buffer Over-read
CWE-379
Creation of Temporary File in Directory with Insecure Permissions
CWE-440
Expected Behavior Violation
CWE-1286
Improper Validation of Syntactic Correctness of Input
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
CWE-354
Improper Validation of Integrity Check Value
CWE-552
Files or Directories Accessible to External Parties
CWE-757
Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CWE-327
Use of a Broken or Risky Cryptographic Algorithm
CWE-400
Uncontrolled Resource Consumption
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-787
Out-of-bounds Write
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-606
Unchecked Input for Loop Condition
CWE-1322
Use of Blocking Code in Single-threaded, Non-blocking Context
CWE-280
Improper Handling of Insufficient Permissions or Privileges
CWE-754
Improper Check for Unusual or Exceptional Conditions
CWE-325
Missing Cryptographic Step
CWE-125
Out-of-bounds Read
CWE-404
Improper Resource Shutdown or Release
CWE-476
NULL Pointer Dereference
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-502
Deserialization of Untrusted Data
CWE-122
Heap-based Buffer Overflow
CWE-20
Improper Input Validation
CWE-276
Incorrect Default Permissions
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Oracle heeft kwetsbaarheden verholpen in JD Edwards EnterpriseOne Tools (specifiek voor versies prior tot 9.2.9.2).", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden in Oracle JD Edwards EnterpriseOne Tools stellen ongeauthenticeerde kwaadwillenden in staat om het systeem te compromitteren via HTTP-verzoeken. Dit kan leiden tot ongeautoriseerde toegang tot kritieke gegevens en gegevenswijzigingen.", "title": "Interpretaties" }, { "category": "description", "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Truncation of Security-relevant Information", "title": "CWE-222" }, { "category": "general", "text": "Use of Weak Hash", "title": "CWE-328" }, { "category": "general", "text": "Buffer Over-read", "title": "CWE-126" }, { "category": "general", "text": "Creation of Temporary File in Directory with Insecure Permissions", "title": "CWE-379" }, { "category": "general", "text": "Expected Behavior Violation", "title": "CWE-440" }, { "category": "general", "text": "Improper Validation of Syntactic Correctness of Input", "title": "CWE-1286" }, { "category": "general", "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)", "title": "CWE-601" }, { "category": "general", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" }, { "category": "general", "text": "Files or Directories Accessible to External Parties", "title": "CWE-552" }, { "category": "general", "text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)", "title": "CWE-757" }, { "category": "general", "text": "Use of a Broken or Risky Cryptographic Algorithm", "title": "CWE-327" }, { "category": "general", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)", "title": "CWE-120" }, { "category": "general", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "general", "text": "Use of Blocking Code in Single-threaded, Non-blocking Context", "title": "CWE-1322" }, { "category": "general", "text": "Improper Handling of Insufficient Permissions or Privileges ", "title": "CWE-280" }, { "category": "general", "text": "Improper Check for Unusual or Exceptional Conditions", "title": "CWE-754" }, { "category": "general", "text": "Missing Cryptographic Step", "title": "CWE-325" }, { "category": "general", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)", "title": "CWE-94" }, { "category": "general", "text": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)", "title": "CWE-74" }, { "category": "general", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "general", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "general", "text": "Incorrect Default Permissions", "title": "CWE-276" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference - cveprojectv5; nvd; oracle", "url": "https://www.oracle.com/security-alerts/cpujan2025.html" } ], "title": "Kwetsbaarheden verholpen in Oracle JD Edwards", "tracking": { "current_release_date": "2025-01-22T13:34:42.937250Z", "id": "NCSC-2025-0026", "initial_release_date": "2025-01-22T13:34:42.937250Z", "revision_history": [ { "date": "2025-01-22T13:34:42.937250Z", "number": "0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "jd_edwards_enterpriseone_orchestrator", "product": { "name": "jd_edwards_enterpriseone_orchestrator", "product_id": "CSAFPID-266143", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "jd_edwards_enterpriseone_orchestrator", "product": { "name": "jd_edwards_enterpriseone_orchestrator", "product_id": "CSAFPID-1751193", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2.9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "jd_edwards_enterpriseone_orchestrator", "product": { "name": "jd_edwards_enterpriseone_orchestrator", "product_id": "CSAFPID-1751158", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:prior_to_9.2.9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "jd_edwards_enterpriseone_tools", "product": { "name": "jd_edwards_enterpriseone_tools", "product_id": "CSAFPID-266526", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "jd_edwards_enterpriseone_tools", "product": { "name": "jd_edwards_enterpriseone_tools", "product_id": "CSAFPID-611382", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.7:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "jd_edwards_enterpriseone_tools", "product": { "name": "jd_edwards_enterpriseone_tools", "product_id": "CSAFPID-1751099", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.9.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "jd_edwards_enterpriseone_tools", "product": { "name": "jd_edwards_enterpriseone_tools", "product_id": "CSAFPID-1751092", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "jd_edwards_enterpriseone_tools", "product": { "name": "jd_edwards_enterpriseone_tools", "product_id": "CSAFPID-1650738", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:prior_to_9.2.8.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "jd_edwards_enterpriseone_tools", "product": { "name": "jd_edwards_enterpriseone_tools", "product_id": "CSAFPID-1751123", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:prior_to_9.2.9.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "jd_edwards_enterpriseone_tools", "product": { "name": "jd_edwards_enterpriseone_tools", "product_id": "CSAFPID-1751154", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:prior_to_9.2.9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "jd_edwards_world_security", "product": { "name": "jd_edwards_world_security", "product_id": "CSAFPID-41391", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*" } } } ], "category": "vendor", "name": "oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-2976", "cwe": { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" }, "notes": [ { "category": "other", "text": "Files or Directories Accessible to External Parties", "title": "CWE-552" }, { "category": "other", "text": "Creation of Temporary File in Directory with Insecure Permissions", "title": "CWE-379" } ], "product_status": { "known_affected": [ "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-611382", "CSAFPID-41391", "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2023-2976", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-2976.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-611382", "CSAFPID-41391", "CSAFPID-1751123" ] } ], "title": "CVE-2023-2976" }, { "cve": "CVE-2023-3961", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2023-3961", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3961.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751154" ] } ], "title": "CVE-2023-3961" }, { "cve": "CVE-2023-4091", "cwe": { "id": "CWE-276", "name": "Incorrect Default Permissions" }, "notes": [ { "category": "other", "text": "Incorrect Default Permissions", "title": "CWE-276" }, { "category": "other", "text": "Improper Handling of Insufficient Permissions or Privileges ", "title": "CWE-280" } ], "product_status": { "known_affected": [ "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2023-4091", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4091.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751154" ] } ], "title": "CVE-2023-4091" }, { "cve": "CVE-2023-4782", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2023-4782", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4782.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751154" ] } ], "title": "CVE-2023-4782" }, { "cve": "CVE-2023-5678", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "other", "text": "Improper Check for Unusual or Exceptional Conditions", "title": "CWE-754" }, { "category": "other", "text": "Missing Cryptographic Step", "title": "CWE-325" }, { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2023-5678", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5678.json" } ], "title": "CVE-2023-5678" }, { "cve": "CVE-2023-6129", "cwe": { "id": "CWE-328", "name": "Use of Weak Hash" }, "notes": [ { "category": "other", "text": "Use of Weak Hash", "title": "CWE-328" }, { "category": "other", "text": "Expected Behavior Violation", "title": "CWE-440" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "other", "text": "Use of a Broken or Risky Cryptographic Algorithm", "title": "CWE-327" } ], "product_status": { "known_affected": [ "CSAFPID-41391", "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2023-6129", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-6129.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "CSAFPID-41391", "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-1751123" ] } ], "title": "CVE-2023-6129" }, { "cve": "CVE-2023-38552", "cwe": { "id": "CWE-354", "name": "Improper Validation of Integrity Check Value" }, "notes": [ { "category": "other", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1650738", "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2023-38552", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-38552.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "CSAFPID-1650738", "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751154" ] } ], "title": "CVE-2023-38552" }, { "cve": "CVE-2023-39017", "product_status": { "known_affected": [ "CSAFPID-611382" ] }, "references": [ { "category": "self", "summary": "CVE-2023-39017", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39017.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-611382" ] } ], "title": "CVE-2023-39017" }, { "cve": "CVE-2023-42669", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Use of Blocking Code in Single-threaded, Non-blocking Context", "title": "CWE-1322" } ], "product_status": { "known_affected": [ "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2023-42669", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-42669.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751154" ] } ], "title": "CVE-2023-42669" }, { "cve": "CVE-2023-48795", "cwe": { "id": "CWE-222", "name": "Truncation of Security-relevant Information" }, "notes": [ { "category": "other", "text": "Truncation of Security-relevant Information", "title": "CWE-222" }, { "category": "other", "text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)", "title": "CWE-757" }, { "category": "other", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" } ], "product_status": { "known_affected": [ "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2023-48795", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-48795.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751123" ] } ], "title": "CVE-2023-48795" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0727", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0727.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751123" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-21245", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21245", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21245.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2024-21245" }, { "cve": "CVE-2024-22019", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" } ], "product_status": { "known_affected": [ "CSAFPID-1751154", "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391" ] }, "references": [ { "category": "self", "summary": "CVE-2024-22019", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22019.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751154", "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391" ] } ], "title": "CVE-2024-22019" }, { "cve": "CVE-2024-22020", "product_status": { "known_affected": [ "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2024-22020", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22020.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751154" ] } ], "title": "CVE-2024-22020" }, { "cve": "CVE-2024-27280", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "notes": [ { "category": "other", "text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)", "title": "CWE-120" }, { "category": "other", "text": "Buffer Over-read", "title": "CWE-126" } ], "product_status": { "known_affected": [ "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2024-27280", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27280.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751154" ] } ], "title": "CVE-2024-27280" }, { "cve": "CVE-2024-27281", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)", "title": "CWE-94" }, { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "other", "text": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)", "title": "CWE-74" } ], "product_status": { "known_affected": [ "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2024-27281", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27281.json" } ], "title": "CVE-2024-27281" }, { "cve": "CVE-2024-27282", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" } ], "product_status": { "known_affected": [ "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2024-27282", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27282.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751154" ] } ], "title": "CVE-2024-27282" }, { "cve": "CVE-2024-27983", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-1650738", "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2024-27983", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27983.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "CSAFPID-1650738", "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751154" ] } ], "title": "CVE-2024-27983" }, { "cve": "CVE-2024-29041", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "notes": [ { "category": "other", "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)", "title": "CWE-601" }, { "category": "other", "text": "Improper Validation of Syntactic Correctness of Input", "title": "CWE-1286" } ], "product_status": { "known_affected": [ "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2024-29041", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29041.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-266143", "CSAFPID-266526", "CSAFPID-41391", "CSAFPID-1751154" ] } ], "title": "CVE-2024-29041" }, { "cve": "CVE-2025-21507", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21507", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21507.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21507" }, { "cve": "CVE-2025-21508", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21508", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21508.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21508" }, { "cve": "CVE-2025-21509", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21509", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21509.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21509" }, { "cve": "CVE-2025-21510", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21510", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21510.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21510" }, { "cve": "CVE-2025-21511", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21511", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21511.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21511" }, { "cve": "CVE-2025-21512", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21512", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21512.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21512" }, { "cve": "CVE-2025-21513", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21513", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21513.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21513" }, { "cve": "CVE-2025-21514", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21514", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21514.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21514" }, { "cve": "CVE-2025-21515", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21515", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21515.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21515" }, { "cve": "CVE-2025-21517", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21517", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21517.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21517" }, { "cve": "CVE-2025-21524", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21524", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21524.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21524" }, { "cve": "CVE-2025-21527", "product_status": { "known_affected": [ "CSAFPID-1751123" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21527", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21527.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751123" ] } ], "title": "CVE-2025-21527" }, { "cve": "CVE-2025-21538", "product_status": { "known_affected": [ "CSAFPID-1751154" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21538", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21538.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751154" ] } ], "title": "CVE-2025-21538" }, { "cve": "CVE-2025-21552", "product_status": { "known_affected": [ "CSAFPID-1751158" ] }, "references": [ { "category": "self", "summary": "CVE-2025-21552", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-21552.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-1751158" ] } ], "title": "CVE-2025-21552" } ] }
ncsc-2024-0412
Vulnerability from csaf_ncscnl
Published
2024-10-17 13:16
Modified
2024-10-17 13:16
Summary
Kwetsbaarheden verholpen in Oracle Peoplesoft
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Oracle heeft kwetsbaarheden verholpen in Peoplesoft.
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service (DoS) te veroorzaken, of om toegang te krijgen tot (persoons)gevoelige gegevens in de database en deze mogelijk te manipuleren.
Oplossingen
Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-405
Asymmetric Resource Consumption (Amplification)
CWE-450
Multiple Interpretations of UI Input
CWE-345
Insufficient Verification of Data Authenticity
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-416
Use After Free
CWE-476
NULL Pointer Dereference
CWE-295
Improper Certificate Validation
CWE-20
Improper Input Validation
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Oracle heeft kwetsbaarheden verholpen in Peoplesoft.", "title": "Feiten" }, { "category": "description", "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service (DoS) te veroorzaken, of om toegang te krijgen tot (persoons)gevoelige gegevens in de database en deze mogelijk te manipuleren.", "title": "Interpretaties" }, { "category": "description", "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Asymmetric Resource Consumption (Amplification)", "title": "CWE-405" }, { "category": "general", "text": "Multiple Interpretations of UI Input", "title": "CWE-450" }, { "category": "general", "text": "Insufficient Verification of Data Authenticity", "title": "CWE-345" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)", "title": "CWE-77" }, { "category": "general", "text": "Use After Free", "title": "CWE-416" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference - cveprojectv5; hkcert; nvd; oracle; redhat", "url": "https://www.oracle.com/security-alerts/cpuoct2024.html" } ], "title": "Kwetsbaarheden verholpen in Oracle Peoplesoft", "tracking": { "current_release_date": "2024-10-17T13:16:18.175855Z", "id": "NCSC-2024-0412", "initial_release_date": "2024-10-17T13:16:18.175855Z", "revision_history": [ { "date": "2024-10-17T13:16:18.175855Z", "number": "0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "peoplesoft", "product": { "name": "peoplesoft", "product_id": "CSAFPID-1676099", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft:8.59:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft", "product": { "name": "peoplesoft", "product_id": "CSAFPID-1676097", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft:8.60:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft", "product": { "name": "peoplesoft", "product_id": "CSAFPID-1676096", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft:8.61:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft", "product": { "name": "peoplesoft", "product_id": "CSAFPID-1676098", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft___9.2.50", "product": { "name": "peoplesoft___9.2.50", "product_id": "CSAFPID-1676100", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft___9.2.50:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_cc_common_application_objects", "product": { "name": "peoplesoft_enterprise_cc_common_application_objects", "product_id": "CSAFPID-449779", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_crm_client_management", "product": { "name": "peoplesoft_enterprise_crm_client_management", "product_id": "CSAFPID-912607", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_crm_client_management:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_elm_enterprise_learning_management", "product": { "name": "peoplesoft_enterprise_elm_enterprise_learning_management", "product_id": "CSAFPID-1673472", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_elm_enterprise_learning_management:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_fin_expenses", "product": { "name": "peoplesoft_enterprise_fin_expenses", "product_id": "CSAFPID-172664", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_fin_expenses:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_benefits_administration", "product": { "name": "peoplesoft_enterprise_hcm_benefits_administration", "product_id": "CSAFPID-912052", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_benefits_administration:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673774", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673748", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.10:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673791", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.11:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673779", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.12:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673786", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.13:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673768", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.14:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673757", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.15:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673788", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.16:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673775", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.17:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673769", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.18:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673753", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.19:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673785", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673770", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.20:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673787", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.21:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673796", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.22:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673749", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.23:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673760", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.24:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673777", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.25:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673793", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.26:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673794", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.27:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673755", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.28:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673762", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.29:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673767", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673764", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.30:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673752", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.31:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673792", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.32:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673778", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.33:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673781", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.34:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673771", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.35:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673758", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.36:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673789", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.37:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673776", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.38:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673766", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.39:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673759", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.3:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673763", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.40:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673772", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.41:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673782", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.42:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673797", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.43:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673750", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.44:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673761", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.45:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673780", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.46:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673783", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.47:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673471", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.48-9.2.50:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673795", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.48:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673756", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.49:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673798", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.4:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673784", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.50:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673773", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.5:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673765", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.6:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673751", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.7:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673754", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.8:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673790", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.9:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_human_resources", "product": { "name": "peoplesoft_enterprise_hcm_human_resources", "product_id": "CSAFPID-172663", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_shared_components", "product": { "name": "peoplesoft_enterprise_hcm_shared_components", "product_id": "CSAFPID-607590", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_shared_components:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1682", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1681", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-816362", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503667", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.59:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503672", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.60:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503676", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.61:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503669", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_web_server___8.59:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503673", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_web_server___8.60:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503678", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_web_server___8.61:*:*:*:*:*:*:*" } } } ], "category": "vendor", "name": "oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-5752", "cwe": { "id": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)", "title": "CWE-77" } ], "product_status": { "known_affected": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607" ] }, "references": [ { "category": "self", "summary": "CVE-2023-5752", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5752.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607" ] } ], "title": "CVE-2023-5752" }, { "cve": "CVE-2023-37920", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "other", "text": "Insufficient Verification of Data Authenticity", "title": "CWE-345" } ], "product_status": { "known_affected": [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362" ] }, "references": [ { "category": "self", "summary": "CVE-2023-37920", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-37920.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362" ] } ], "title": "CVE-2023-37920" }, { "cve": "CVE-2024-0232", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" } ], "product_status": { "known_affected": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0232", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0232.json" } ], "title": "CVE-2024-0232" }, { "cve": "CVE-2024-0450", "cwe": { "id": "CWE-450", "name": "Multiple Interpretations of UI Input" }, "notes": [ { "category": "other", "text": "Multiple Interpretations of UI Input", "title": "CWE-450" }, { "category": "other", "text": "Asymmetric Resource Consumption (Amplification)", "title": "CWE-405" } ], "product_status": { "known_affected": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0450", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0450.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362" ] } ], "title": "CVE-2024-0450" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0727", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0727.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-21202", "product_status": { "known_affected": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21202", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21202.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21202" }, { "cve": "CVE-2024-21214", "product_status": { "known_affected": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21214", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21214.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21214" }, { "cve": "CVE-2024-21249", "product_status": { "known_affected": [ "CSAFPID-172664", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21249", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21249.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-172664", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21249" }, { "cve": "CVE-2024-21255", "product_status": { "known_affected": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21255", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21255.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21255" }, { "cve": "CVE-2024-21264", "product_status": { "known_affected": [ "CSAFPID-449779", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21264", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21264.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-449779", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21264" }, { "cve": "CVE-2024-21283", "product_status": { "known_affected": [ "CSAFPID-1673471", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21283", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21283.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-1673471", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21283" }, { "cve": "CVE-2024-21286", "product_status": { "known_affected": [ "CSAFPID-1673472", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21286", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21286.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1673472", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21286" }, { "cve": "CVE-2024-26130", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" } ], "product_status": { "known_affected": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678" ] }, "references": [ { "category": "self", "summary": "CVE-2024-26130", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26130.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678" ] } ], "title": "CVE-2024-26130" } ] }
NCSC-2024-0412
Vulnerability from csaf_ncscnl
Published
2024-10-17 13:16
Modified
2024-10-17 13:16
Summary
Kwetsbaarheden verholpen in Oracle Peoplesoft
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Oracle heeft kwetsbaarheden verholpen in Peoplesoft.
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service (DoS) te veroorzaken, of om toegang te krijgen tot (persoons)gevoelige gegevens in de database en deze mogelijk te manipuleren.
Oplossingen
Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-405
Asymmetric Resource Consumption (Amplification)
CWE-450
Multiple Interpretations of UI Input
CWE-345
Insufficient Verification of Data Authenticity
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-416
Use After Free
CWE-476
NULL Pointer Dereference
CWE-295
Improper Certificate Validation
CWE-20
Improper Input Validation
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Oracle heeft kwetsbaarheden verholpen in Peoplesoft.", "title": "Feiten" }, { "category": "description", "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service (DoS) te veroorzaken, of om toegang te krijgen tot (persoons)gevoelige gegevens in de database en deze mogelijk te manipuleren.", "title": "Interpretaties" }, { "category": "description", "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Asymmetric Resource Consumption (Amplification)", "title": "CWE-405" }, { "category": "general", "text": "Multiple Interpretations of UI Input", "title": "CWE-450" }, { "category": "general", "text": "Insufficient Verification of Data Authenticity", "title": "CWE-345" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)", "title": "CWE-77" }, { "category": "general", "text": "Use After Free", "title": "CWE-416" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference - cveprojectv5; hkcert; nvd; oracle; redhat", "url": "https://www.oracle.com/security-alerts/cpuoct2024.html" } ], "title": "Kwetsbaarheden verholpen in Oracle Peoplesoft", "tracking": { "current_release_date": "2024-10-17T13:16:18.175855Z", "id": "NCSC-2024-0412", "initial_release_date": "2024-10-17T13:16:18.175855Z", "revision_history": [ { "date": "2024-10-17T13:16:18.175855Z", "number": "0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "peoplesoft", "product": { "name": "peoplesoft", "product_id": "CSAFPID-1676099", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft:8.59:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft", "product": { "name": "peoplesoft", "product_id": "CSAFPID-1676097", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft:8.60:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft", "product": { "name": "peoplesoft", "product_id": "CSAFPID-1676096", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft:8.61:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft", "product": { "name": "peoplesoft", "product_id": "CSAFPID-1676098", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft___9.2.50", "product": { "name": "peoplesoft___9.2.50", "product_id": "CSAFPID-1676100", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft___9.2.50:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_cc_common_application_objects", "product": { "name": "peoplesoft_enterprise_cc_common_application_objects", "product_id": "CSAFPID-449779", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_crm_client_management", "product": { "name": "peoplesoft_enterprise_crm_client_management", "product_id": "CSAFPID-912607", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_crm_client_management:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_elm_enterprise_learning_management", "product": { "name": "peoplesoft_enterprise_elm_enterprise_learning_management", "product_id": "CSAFPID-1673472", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_elm_enterprise_learning_management:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_fin_expenses", "product": { "name": "peoplesoft_enterprise_fin_expenses", "product_id": "CSAFPID-172664", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_fin_expenses:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_benefits_administration", "product": { "name": "peoplesoft_enterprise_hcm_benefits_administration", "product_id": "CSAFPID-912052", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_benefits_administration:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673774", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673748", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.10:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673791", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.11:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673779", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.12:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673786", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.13:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673768", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.14:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673757", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.15:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673788", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.16:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673775", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.17:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673769", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.18:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673753", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.19:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673785", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673770", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.20:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673787", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.21:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673796", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.22:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673749", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.23:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673760", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.24:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673777", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.25:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673793", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.26:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673794", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.27:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673755", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.28:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673762", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.29:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673767", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673764", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.30:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673752", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.31:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673792", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.32:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673778", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.33:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673781", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.34:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673771", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.35:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673758", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.36:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673789", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.37:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673776", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.38:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673766", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.39:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673759", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.3:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673763", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.40:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673772", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.41:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673782", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.42:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673797", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.43:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673750", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.44:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673761", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.45:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673780", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.46:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673783", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.47:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673471", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.48-9.2.50:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673795", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.48:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673756", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.49:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673798", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.4:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673784", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.50:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673773", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.5:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673765", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.6:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673751", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.7:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673754", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.8:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product": { "name": "peoplesoft_enterprise_hcm_global_payroll_core", "product_id": "CSAFPID-1673790", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_core:9.2.9:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_human_resources", "product": { "name": "peoplesoft_enterprise_hcm_human_resources", "product_id": "CSAFPID-172663", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_hcm_shared_components", "product": { "name": "peoplesoft_enterprise_hcm_shared_components", "product_id": "CSAFPID-607590", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_shared_components:9.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1682", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1681", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-816362", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503667", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.59:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503672", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.60:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503676", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_opensearch___8.61:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503669", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_web_server___8.59:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503673", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_web_server___8.60:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "peoplesoft_enterprise_peopletools", "product": { "name": "peoplesoft_enterprise_peopletools", "product_id": "CSAFPID-1503678", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:_web_server___8.61:*:*:*:*:*:*:*" } } } ], "category": "vendor", "name": "oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-5752", "cwe": { "id": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)", "title": "CWE-77" } ], "product_status": { "known_affected": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607" ] }, "references": [ { "category": "self", "summary": "CVE-2023-5752", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5752.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607" ] } ], "title": "CVE-2023-5752" }, { "cve": "CVE-2023-37920", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "other", "text": "Insufficient Verification of Data Authenticity", "title": "CWE-345" } ], "product_status": { "known_affected": [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362" ] }, "references": [ { "category": "self", "summary": "CVE-2023-37920", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-37920.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362" ] } ], "title": "CVE-2023-37920" }, { "cve": "CVE-2024-0232", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" } ], "product_status": { "known_affected": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0232", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0232.json" } ], "title": "CVE-2024-0232" }, { "cve": "CVE-2024-0450", "cwe": { "id": "CWE-450", "name": "Multiple Interpretations of UI Input" }, "notes": [ { "category": "other", "text": "Multiple Interpretations of UI Input", "title": "CWE-450" }, { "category": "other", "text": "Asymmetric Resource Consumption (Amplification)", "title": "CWE-405" } ], "product_status": { "known_affected": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0450", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0450.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1682", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1681", "CSAFPID-1503676", "CSAFPID-1503678", "CSAFPID-816362" ] } ], "title": "CVE-2024-0450" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0727", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0727.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-21202", "product_status": { "known_affected": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21202", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21202.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21202" }, { "cve": "CVE-2024-21214", "product_status": { "known_affected": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21214", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21214.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21214" }, { "cve": "CVE-2024-21249", "product_status": { "known_affected": [ "CSAFPID-172664", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21249", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21249.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-172664", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21249" }, { "cve": "CVE-2024-21255", "product_status": { "known_affected": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21255", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21255.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-816362", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21255" }, { "cve": "CVE-2024-21264", "product_status": { "known_affected": [ "CSAFPID-449779", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21264", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21264.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-449779", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21264" }, { "cve": "CVE-2024-21283", "product_status": { "known_affected": [ "CSAFPID-1673471", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21283", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21283.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-1673471", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21283" }, { "cve": "CVE-2024-21286", "product_status": { "known_affected": [ "CSAFPID-1673472", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21286", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21286.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1673472", "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100" ] } ], "title": "CVE-2024-21286" }, { "cve": "CVE-2024-26130", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" } ], "product_status": { "known_affected": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678" ] }, "references": [ { "category": "self", "summary": "CVE-2024-26130", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26130.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1676096", "CSAFPID-1676097", "CSAFPID-1676098", "CSAFPID-1676099", "CSAFPID-1676100", "CSAFPID-1681", "CSAFPID-1682", "CSAFPID-816362", "CSAFPID-912052", "CSAFPID-912607", "CSAFPID-172663", "CSAFPID-607590", "CSAFPID-1503667", "CSAFPID-1503669", "CSAFPID-1503672", "CSAFPID-1503673", "CSAFPID-1503676", "CSAFPID-1503678" ] } ], "title": "CVE-2024-26130" } ] }
NCSC-2024-0433
Vulnerability from csaf_ncscnl
Published
2024-11-12 14:19
Modified
2024-11-12 14:19
Summary
Kwetsbaarheden verholpen in Siemens producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDCOM, SCALANCE, SIMATIC en SINEC.
Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Cross-Site-Scripting (XSS)
- Manipulatie van gegevens
- Omzeilen van een beveiligingsmaatregel
- Omzeilen van authenticatie
- (Remote) code execution (Administrator/Root rechten)
- (Remote) code execution (Gebruikersrechten)
- Toegang tot systeemgegevens
- Verhoogde gebruikersrechten
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
Oplossingen
Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-606
Unchecked Input for Loop Condition
CWE-1240
Use of a Cryptographic Primitive with a Risky Implementation
CWE-115
Misinterpretation of Input
CWE-1059
Insufficient Technical Documentation
CWE-1325
Improperly Controlled Sequential Memory Allocation
CWE-222
Truncation of Security-relevant Information
CWE-310
CWE-310
CWE-328
Use of Weak Hash
CWE-1284
Improper Validation of Specified Quantity in Input
CWE-213
Exposure of Sensitive Information Due to Incompatible Policies
CWE-1268
Policy Privileges are not Assigned Consistently Between Control and Data Agents
CWE-684
Incorrect Provision of Specified Functionality
CWE-772
Missing Release of Resource after Effective Lifetime
CWE-208
Observable Timing Discrepancy
CWE-201
Insertion of Sensitive Information Into Sent Data
CWE-834
Excessive Iteration
CWE-266
Incorrect Privilege Assignment
CWE-942
Permissive Cross-domain Policy with Untrusted Domains
CWE-271
Privilege Dropping / Lowering Errors
CWE-732
Incorrect Permission Assignment for Critical Resource
CWE-667
Improper Locking
CWE-440
Expected Behavior Violation
CWE-297
Improper Validation of Certificate with Host Mismatch
CWE-311
Missing Encryption of Sensitive Data
CWE-754
Improper Check for Unusual or Exceptional Conditions
CWE-617
Reachable Assertion
CWE-427
Uncontrolled Search Path Element
CWE-319
Cleartext Transmission of Sensitive Information
CWE-613
Insufficient Session Expiration
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-203
Observable Discrepancy
CWE-354
Improper Validation of Integrity Check Value
CWE-325
Missing Cryptographic Step
CWE-190
Integer Overflow or Wraparound
CWE-321
Use of Hard-coded Cryptographic Key
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-125
Out-of-bounds Read
CWE-404
Improper Resource Shutdown or Release
CWE-275
CWE-275
CWE-284
Improper Access Control
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-1333
Inefficient Regular Expression Complexity
CWE-416
Use After Free
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-401
Missing Release of Memory after Effective Lifetime
CWE-476
NULL Pointer Dereference
CWE-295
Improper Certificate Validation
CWE-757
Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-327
Use of a Broken or Risky Cryptographic Algorithm
CWE-436
Interpretation Conflict
CWE-400
Uncontrolled Resource Consumption
CWE-770
Allocation of Resources Without Limits or Throttling
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-502
Deserialization of Untrusted Data
CWE-918
Server-Side Request Forgery (SSRF)
CWE-863
Incorrect Authorization
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-787
Out-of-bounds Write
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-122
Heap-based Buffer Overflow
CWE-121
Stack-based Buffer Overflow
CWE-789
Memory Allocation with Excessive Size Value
CWE-269
Improper Privilege Management
CWE-20
Improper Input Validation
CWE-287
Improper Authentication
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDCOM, SCALANCE, SIMATIC en SINEC.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service (DoS)\n- Cross-Site-Scripting (XSS)\n- Manipulatie van gegevens\n- Omzeilen van een beveiligingsmaatregel\n- Omzeilen van authenticatie\n- (Remote) code execution (Administrator/Root rechten)\n- (Remote) code execution (Gebruikersrechten)\n- Toegang tot systeemgegevens\n- Verhoogde gebruikersrechten\n\nDe kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.", "title": "Interpretaties" }, { "category": "description", "text": "Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico\u0027s zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "general", "text": "Use of a Cryptographic Primitive with a Risky Implementation", "title": "CWE-1240" }, { "category": "general", "text": "Misinterpretation of Input", "title": "CWE-115" }, { "category": "general", "text": "Insufficient Technical Documentation", "title": "CWE-1059" }, { "category": "general", "text": "Improperly Controlled Sequential Memory Allocation", "title": "CWE-1325" }, { "category": "general", "text": "Truncation of Security-relevant Information", "title": "CWE-222" }, { "category": "general", "text": "CWE-310", "title": "CWE-310" }, { "category": "general", "text": "Use of Weak Hash", "title": "CWE-328" }, { "category": "general", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" }, { "category": "general", "text": "Exposure of Sensitive Information Due to Incompatible Policies", "title": "CWE-213" }, { "category": "general", "text": "Policy Privileges are not Assigned Consistently Between Control and Data Agents", "title": "CWE-1268" }, { "category": "general", "text": "Incorrect Provision of Specified Functionality", "title": "CWE-684" }, { "category": "general", "text": "Missing Release of Resource after Effective Lifetime", "title": "CWE-772" }, { "category": "general", "text": "Observable Timing Discrepancy", "title": "CWE-208" }, { "category": "general", "text": "Insertion of Sensitive Information Into Sent Data", "title": "CWE-201" }, { "category": "general", "text": "Excessive Iteration", "title": "CWE-834" }, { "category": "general", "text": "Incorrect Privilege Assignment", "title": "CWE-266" }, { "category": "general", "text": "Permissive Cross-domain Policy with Untrusted Domains", "title": "CWE-942" }, { "category": "general", "text": "Privilege Dropping / Lowering Errors", "title": "CWE-271" }, { "category": "general", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" }, { "category": "general", "text": "Improper Locking", "title": "CWE-667" }, { "category": "general", "text": "Expected Behavior Violation", "title": "CWE-440" }, { "category": "general", "text": "Improper Validation of Certificate with Host Mismatch", "title": "CWE-297" }, { "category": "general", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" }, { "category": "general", "text": "Improper Check for Unusual or Exceptional Conditions", "title": "CWE-754" }, { "category": "general", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "general", "text": "Uncontrolled Search Path Element", "title": "CWE-427" }, { "category": "general", "text": "Cleartext Transmission of Sensitive Information", "title": "CWE-319" }, { "category": "general", "text": "Insufficient Session Expiration", "title": "CWE-613" }, { "category": "general", "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)", "title": "CWE-444" }, { "category": "general", "text": "Observable Discrepancy", "title": "CWE-203" }, { "category": "general", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" }, { "category": "general", "text": "Missing Cryptographic Step", "title": "CWE-325" }, { "category": "general", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "general", "text": "Use of Hard-coded Cryptographic Key", "title": "CWE-321" }, { "category": "general", "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)", "title": "CWE-362" }, { "category": "general", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "CWE-275", "title": "CWE-275" }, { "category": "general", "text": "Improper Access Control", "title": "CWE-284" }, { "category": "general", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" }, { "category": "general", "text": "Inefficient Regular Expression Complexity", "title": "CWE-1333" }, { "category": "general", "text": "Use After Free", "title": "CWE-416" }, { "category": "general", "text": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)", "title": "CWE-113" }, { "category": "general", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "general", "text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)", "title": "CWE-757" }, { "category": "general", "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)", "title": "CWE-94" }, { "category": "general", "text": "Use of a Broken or Risky Cryptographic Algorithm", "title": "CWE-327" }, { "category": "general", "text": "Interpretation Conflict", "title": "CWE-436" }, { "category": "general", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "general", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)", "title": "CWE-74" }, { "category": "general", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "general", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "general", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)", "title": "CWE-78" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "general", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "general", "text": "Memory Allocation with Excessive Size Value", "title": "CWE-789" }, { "category": "general", "text": "Improper Privilege Management", "title": "CWE-269" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "general", "text": "Improper Authentication", "title": "CWE-287" }, { "category": "general", "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "title": "CWE-79" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-000297.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-064257.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-230445.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-331112.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-351178.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-354112.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-454789.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-616032.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-654798.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-871035.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-914892.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-915275.pdf" } ], "title": "Kwetsbaarheden verholpen in Siemens producten", "tracking": { "current_release_date": "2024-11-12T14:19:20.051128Z", "id": "NCSC-2024-0433", "initial_release_date": "2024-11-12T14:19:20.051128Z", "revision_history": [ { "date": "2024-11-12T14:19:20.051128Z", "number": "0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "mendix_runtime_v10.12", "product": { "name": "mendix_runtime_v10.12", "product_id": "CSAFPID-1637623", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:mendix_runtime_v10.12:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "mendix_runtime_v10.6", "product": { "name": "mendix_runtime_v10.6", "product_id": "CSAFPID-1637624", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:mendix_runtime_v10.6:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "mendix_runtime_v10", "product": { "name": "mendix_runtime_v10", "product_id": "CSAFPID-1637622", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:mendix_runtime_v10:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "mendix_runtime_v8", "product": { "name": "mendix_runtime_v8", "product_id": "CSAFPID-1637625", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:mendix_runtime_v8:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "mendix_runtime_v9", "product": { "name": "mendix_runtime_v9", "product_id": "CSAFPID-1637626", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:mendix_runtime_v9:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ozw672", "product": { "name": "ozw672", "product_id": "CSAFPID-1712832", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:ozw672:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ozw772", "product": { "name": "ozw772", "product_id": "CSAFPID-1712833", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:ozw772:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "pp_telecontrol_server_basic_1000_to_5000_v3.1", "product": { "name": "pp_telecontrol_server_basic_1000_to_5000_v3.1", "product_id": "CSAFPID-1712834", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:pp_telecontrol_server_basic_1000_to_5000_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "pp_telecontrol_server_basic_256_to_1000_v3.1", "product": { "name": "pp_telecontrol_server_basic_256_to_1000_v3.1", "product_id": "CSAFPID-1712835", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:pp_telecontrol_server_basic_256_to_1000_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "pp_telecontrol_server_basic_32_to_64_v3.1", "product": { "name": "pp_telecontrol_server_basic_32_to_64_v3.1", "product_id": "CSAFPID-1712836", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:pp_telecontrol_server_basic_32_to_64_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "pp_telecontrol_server_basic_64_to_256_v3.1", "product": { "name": "pp_telecontrol_server_basic_64_to_256_v3.1", "product_id": "CSAFPID-1712837", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:pp_telecontrol_server_basic_64_to_256_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "pp_telecontrol_server_basic_8_to_32_v3.1", "product": { "name": "pp_telecontrol_server_basic_8_to_32_v3.1", "product_id": "CSAFPID-1712838", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:pp_telecontrol_server_basic_8_to_32_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ruggedcom_ape1808", "product": { "name": "ruggedcom_ape1808", "product_id": "CSAFPID-1615259", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:ruggedcom_ape1808:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ruggedcom_rm1224_lte_4g__eu", "product": { "name": "ruggedcom_rm1224_lte_4g__eu", "product_id": "CSAFPID-1702670", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:ruggedcom_rm1224_lte_4g__eu:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ruggedcom_rm1224_lte_4g__nam", "product": { "name": "ruggedcom_rm1224_lte_4g__nam", "product_id": "CSAFPID-1702671", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:ruggedcom_rm1224_lte_4g__nam:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "s7-pct", "product": { "name": "s7-pct", "product_id": "CSAFPID-1637909", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:s7-pct:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "s7-pct", "product": { "name": "s7-pct", "product_id": "CSAFPID-1470060", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:s7-pct:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "s7_port_configuration_tool", "product": { "name": "s7_port_configuration_tool", "product_id": "CSAFPID-1472074", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:s7_port_configuration_tool:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m804pb", "product": { "name": "scalance_m804pb", "product_id": "CSAFPID-1702672", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m804pb:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m812-1_adsl-router", "product": { "name": "scalance_m812-1_adsl-router", "product_id": "CSAFPID-1712749", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m812-1_adsl-router:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m816-1_adsl-router", "product": { "name": "scalance_m816-1_adsl-router", "product_id": "CSAFPID-1712750", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m816-1_adsl-router:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m826-2_shdsl-router", "product": { "name": "scalance_m826-2_shdsl-router", "product_id": "CSAFPID-1702677", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m826-2_shdsl-router:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m874-2", "product": { "name": "scalance_m874-2", "product_id": "CSAFPID-1702678", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m874-2:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m874-3", "product": { "name": "scalance_m874-3", "product_id": "CSAFPID-1702679", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m874-3:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m874-3_3g-router__cn_", "product": { "name": "scalance_m874-3_3g-router__cn_", "product_id": "CSAFPID-1712751", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m874-3_3g-router__cn_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m876-3", "product": { "name": "scalance_m876-3", "product_id": "CSAFPID-1712752", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m876-3:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m876-3__rok_", "product": { "name": "scalance_m876-3__rok_", "product_id": "CSAFPID-1702681", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m876-3__rok_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m876-4", "product": { "name": "scalance_m876-4", "product_id": "CSAFPID-1712753", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m876-4:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m876-4__eu_", "product": { "name": "scalance_m876-4__eu_", "product_id": "CSAFPID-1702682", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m876-4__eu_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m876-4__nam_", "product": { "name": "scalance_m876-4__nam_", "product_id": "CSAFPID-1702683", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m876-4__nam_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum853-1__a1_", "product": { "name": "scalance_mum853-1__a1_", "product_id": "CSAFPID-1712754", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum853-1__a1_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum853-1__b1_", "product": { "name": "scalance_mum853-1__b1_", "product_id": "CSAFPID-1712755", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum853-1__b1_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum853-1__eu_", "product": { "name": "scalance_mum853-1__eu_", "product_id": "CSAFPID-1712756", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum853-1__eu_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum856-1__a1_", "product": { "name": "scalance_mum856-1__a1_", "product_id": "CSAFPID-1712757", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum856-1__a1_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum856-1__b1_", "product": { "name": "scalance_mum856-1__b1_", "product_id": "CSAFPID-1712758", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum856-1__b1_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum856-1__cn_", "product": { "name": "scalance_mum856-1__cn_", "product_id": "CSAFPID-1712759", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum856-1__cn_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum856-1__eu_", "product": { "name": "scalance_mum856-1__eu_", "product_id": "CSAFPID-1702684", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum856-1__eu_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum856-1__row_", "product": { "name": "scalance_mum856-1__row_", "product_id": "CSAFPID-1702685", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum856-1__row_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_s615_eec_lan-router", "product": { "name": "scalance_s615_eec_lan-router", "product_id": "CSAFPID-1712760", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_s615_eec_lan-router:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_s615_lan-router", "product": { "name": "scalance_s615_lan-router", "product_id": "CSAFPID-1712761", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_s615_lan-router:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xch328__6gk5328-4ts01-2ec2_", "product": { "name": "scalance_xch328__6gk5328-4ts01-2ec2_", "product_id": "CSAFPID-1613504", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xch328__6gk5328-4ts01-2ec2_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xcm324__6gk5324-8ts01-2ac2_", "product": { "name": "scalance_xcm324__6gk5324-8ts01-2ac2_", "product_id": "CSAFPID-1613505", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xcm324__6gk5324-8ts01-2ac2_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xcm328__6gk5328-4ts01-2ac2_", "product": { "name": "scalance_xcm328__6gk5328-4ts01-2ac2_", "product_id": "CSAFPID-1613506", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xcm328__6gk5328-4ts01-2ac2_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xcm332__6gk5332-0ga01-2ac2_", "product": { "name": "scalance_xcm332__6gk5332-0ga01-2ac2_", "product_id": "CSAFPID-1613507", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xcm332__6gk5332-0ga01-2ac2_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrh334__24_v_dc__8xfo__cc___6gk5334-2ts01-2er3_", "product": { "name": "scalance_xrh334__24_v_dc__8xfo__cc___6gk5334-2ts01-2er3_", "product_id": "CSAFPID-1613592", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrh334__24_v_dc__8xfo__cc___6gk5334-2ts01-2er3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__230_v_ac__12xfo___6gk5334-3ts01-3ar3_", "product": { "name": "scalance_xrm334__230_v_ac__12xfo___6gk5334-3ts01-3ar3_", "product_id": "CSAFPID-1613593", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__230_v_ac__12xfo___6gk5334-3ts01-3ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__230_v_ac__8xfo___6gk5334-2ts01-3ar3_", "product": { "name": "scalance_xrm334__230_v_ac__8xfo___6gk5334-2ts01-3ar3_", "product_id": "CSAFPID-1613594", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__230_v_ac__8xfo___6gk5334-2ts01-3ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__24_v_dc__12xfo___6gk5334-3ts01-2ar3_", "product": { "name": "scalance_xrm334__24_v_dc__12xfo___6gk5334-3ts01-2ar3_", "product_id": "CSAFPID-1613595", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__24_v_dc__12xfo___6gk5334-3ts01-2ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__24_v_dc__8xfo___6gk5334-2ts01-2ar3_", "product": { "name": "scalance_xrm334__24_v_dc__8xfo___6gk5334-2ts01-2ar3_", "product_id": "CSAFPID-1613596", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__24_v_dc__8xfo___6gk5334-2ts01-2ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__2x230_v_ac__12xfo___6gk5334-3ts01-4ar3_", "product": { "name": "scalance_xrm334__2x230_v_ac__12xfo___6gk5334-3ts01-4ar3_", "product_id": "CSAFPID-1613597", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__2x230_v_ac__12xfo___6gk5334-3ts01-4ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__2x230_v_ac__8xfo___6gk5334-2ts01-4ar3_", "product": { "name": "scalance_xrm334__2x230_v_ac__8xfo___6gk5334-2ts01-4ar3_", "product_id": "CSAFPID-1613598", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__2x230_v_ac__8xfo___6gk5334-2ts01-4ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "security_configuration_tool", "product": { "name": "security_configuration_tool", "product_id": "CSAFPID-1625339", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:security_configuration_tool:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "security_configuration_tool__sct_", "product": { "name": "security_configuration_tool__sct_", "product_id": "CSAFPID-1637910", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:security_configuration_tool__sct_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "security_configuration_tool__sct_", "product": { "name": "security_configuration_tool__sct_", "product_id": "CSAFPID-1470061", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:security_configuration_tool__sct_:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_automation_tool", "product": { "name": "simatic_automation_tool", "product_id": "CSAFPID-1472069", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_automation_tool:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_automation_tool", "product": { "name": "simatic_automation_tool", "product_id": "CSAFPID-1637559", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_automation_tool:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_automation_tool", "product": { "name": "simatic_automation_tool", "product_id": "CSAFPID-1470062", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_automation_tool:all_versions:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_batch_v9.1", "product": { "name": "simatic_batch_v9.1", "product_id": "CSAFPID-1625340", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_batch_v9.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_batch_v9.1", "product": { "name": "simatic_batch_v9.1", "product_id": "CSAFPID-1470063", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_batch_v9.1:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_cp_1543-1_v4.0", "product": { "name": "simatic_cp_1543-1_v4.0", "product_id": "CSAFPID-1712748", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_cp_1543-1_v4.0:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_mv500_family", "product": { "name": "simatic_mv500_family", "product_id": "CSAFPID-1703073", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_mv500_family:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc-software", "product": { "name": "simatic_net_pc-software", "product_id": "CSAFPID-1625344", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc-software:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software", "product": { "name": "simatic_net_pc_software", "product_id": "CSAFPID-1470064", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v16", "product": { "name": "simatic_net_pc_software_v16", "product_id": "CSAFPID-1637849", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v16", "product": { "name": "simatic_net_pc_software_v16", "product_id": "CSAFPID-1457906", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v16:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v17", "product": { "name": "simatic_net_pc_software_v17", "product_id": "CSAFPID-1637850", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v17", "product": { "name": "simatic_net_pc_software_v17", "product_id": "CSAFPID-1457907", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v17:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v18", "product": { "name": "simatic_net_pc_software_v18", "product_id": "CSAFPID-1637851", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v18", "product": { "name": "simatic_net_pc_software_v18", "product_id": "CSAFPID-1457908", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v18:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v19", "product": { "name": "simatic_net_pc_software_v19", "product_id": "CSAFPID-1637911", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v19:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v19", "product": { "name": "simatic_net_pc_software_v19", "product_id": "CSAFPID-1637560", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v19:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pcs", "product": { "name": "simatic_pcs", "product_id": "CSAFPID-838530", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_pcs:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pcs_7_v9.1", "product": { "name": "simatic_pcs_7_v9.1", "product_id": "CSAFPID-1501190", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_pcs_7_v9.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pcs_7_v9.1", "product": { "name": "simatic_pcs_7_v9.1", "product_id": "CSAFPID-1457909", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_pcs_7_v9.1:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pdm_v9.2", "product": { "name": "simatic_pdm_v9.2", "product_id": "CSAFPID-1637912", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_pdm_v9.2:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pdm_v9.2", "product": { "name": "simatic_pdm_v9.2", "product_id": "CSAFPID-1470065", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_pdm_v9.2:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_route_control_", "product": { "name": "simatic_route_control_", "product_id": "CSAFPID-1625337", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_route_control_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_route_control_v9.1", "product": { "name": "simatic_route_control_v9.1", "product_id": "CSAFPID-1637856", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_route_control_v9.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_route_control_v9.1", "product": { "name": "simatic_route_control_v9.1", "product_id": "CSAFPID-1470066", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_route_control_v9.1:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager", "product": { "name": "simatic_rtls_locating_manager", "product_id": "CSAFPID-1691398", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager:3.0.1.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-0da00_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-0da00_", "product_id": "CSAFPID-1703180", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-0da00_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-0da10_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-0da10_", "product_id": "CSAFPID-1703181", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-0da10_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-0da20_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-0da20_", "product_id": "CSAFPID-1703182", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-0da20_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-0da30_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-0da30_", "product_id": "CSAFPID-1703183", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-0da30_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-1ea10_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-1ea10_", "product_id": "CSAFPID-1703184", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-1ea10_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-1ea20_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-1ea20_", "product_id": "CSAFPID-1703185", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-1ea20_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-1ea30_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-1ea30_", "product_id": "CSAFPID-1703186", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-1ea30_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ab0_", "product": { "name": "simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ab0_", "product_id": "CSAFPID-1615260", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ab0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ac0_", "product": { "name": "simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ac0_", "product_id": "CSAFPID-1615261", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ac0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ab0_", "product": { "name": "simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ab0_", "product_id": "CSAFPID-1615262", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ab0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ac0_", "product": { "name": "simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ac0_", "product_id": "CSAFPID-1615263", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ac0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_tm_mfp_-_gnu_linux_subsystem", "product": { "name": "simatic_s7-1500_tm_mfp_-_gnu_linux_subsystem", "product_id": "CSAFPID-1703131", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-1500_tm_mfp_-_gnu_linux_subsystem:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-plcsim_v16", "product": { "name": "simatic_s7-plcsim_v16", "product_id": "CSAFPID-1712825", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-plcsim_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-plcsim_v17", "product": { "name": "simatic_s7-plcsim_v17", "product_id": "CSAFPID-1712826", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-plcsim_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_safety_v16", "product": { "name": "simatic_step_7_safety_v16", "product_id": "CSAFPID-1703190", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_safety_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_safety_v17", "product": { "name": "simatic_step_7_safety_v17", "product_id": "CSAFPID-1703191", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_safety_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_safety_v18", "product": { "name": "simatic_step_7_safety_v18", "product_id": "CSAFPID-1500667", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_safety_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_v16", "product": { "name": "simatic_step_7_v16", "product_id": "CSAFPID-1703187", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_v17", "product": { "name": "simatic_step_7_v17", "product_id": "CSAFPID-1703188", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_v18", "product": { "name": "simatic_step_7_v18", "product_id": "CSAFPID-1703189", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_v5", "product": { "name": "simatic_step_7_v5", "product_id": "CSAFPID-1637913", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_v5:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_v5", "product": { "name": "simatic_step_7_v5", "product_id": "CSAFPID-1457855", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_v5:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc", "product": { "name": "simatic_wincc", "product_id": "CSAFPID-75563", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc", "product": { "name": "simatic_wincc", "product_id": "CSAFPID-1550826", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc:8.0:update_5:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.17", "product": { "name": "simatic_wincc_oa_v3.17", "product_id": "CSAFPID-1637914", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.17", "product": { "name": "simatic_wincc_oa_v3.17", "product_id": "CSAFPID-1457956", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.17:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.18", "product": { "name": "simatic_wincc_oa_v3.18", "product_id": "CSAFPID-1637915", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.18", "product": { "name": "simatic_wincc_oa_v3.18", "product_id": "CSAFPID-1457957", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.18:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.19", "product": { "name": "simatic_wincc_oa_v3.19", "product_id": "CSAFPID-1637916", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.19:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.19", "product": { "name": "simatic_wincc_oa_v3.19", "product_id": "CSAFPID-1457958", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.19:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_advanced", "product": { "name": "simatic_wincc_runtime_advanced", "product_id": "CSAFPID-766087", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_advanced", "product": { "name": "simatic_wincc_runtime_advanced", "product_id": "CSAFPID-1470067", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional", "product": { "name": "simatic_wincc_runtime_professional", "product_id": "CSAFPID-165765", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v16", "product": { "name": "simatic_wincc_runtime_professional_v16", "product_id": "CSAFPID-1637917", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v16", "product": { "name": "simatic_wincc_runtime_professional_v16", "product_id": "CSAFPID-1457960", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v16:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v17", "product": { "name": "simatic_wincc_runtime_professional_v17", "product_id": "CSAFPID-1637887", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v17", "product": { "name": "simatic_wincc_runtime_professional_v17", "product_id": "CSAFPID-1457961", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v17:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v18", "product": { "name": "simatic_wincc_runtime_professional_v18", "product_id": "CSAFPID-1501188", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v18", "product": { "name": "simatic_wincc_runtime_professional_v18", "product_id": "CSAFPID-1457962", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v18:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v19", "product": { "name": "simatic_wincc_runtime_professional_v19", "product_id": "CSAFPID-1501192", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v19:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v19", "product": { "name": "simatic_wincc_runtime_professional_v19", "product_id": "CSAFPID-1457963", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v19:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_pc_runtime", "product": { "name": "simatic_wincc_unified_pc_runtime", "product_id": "CSAFPID-744621", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_pc_runtime", "product": { "name": "simatic_wincc_unified_pc_runtime", "product_id": "CSAFPID-1470068", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_pc_runtime_v18", "product": { "name": "simatic_wincc_unified_pc_runtime_v18", "product_id": "CSAFPID-1637854", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_pc_runtime_v18", "product": { "name": "simatic_wincc_unified_pc_runtime_v18", "product_id": "CSAFPID-1637561", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime_v18:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_v16", "product": { "name": "simatic_wincc_unified_v16", "product_id": "CSAFPID-1703192", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_v17", "product": { "name": "simatic_wincc_unified_v17", "product_id": "CSAFPID-1703193", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_v18", "product": { "name": "simatic_wincc_unified_v18", "product_id": "CSAFPID-1703194", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v16", "product": { "name": "simatic_wincc_v16", "product_id": "CSAFPID-1702687", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v17", "product": { "name": "simatic_wincc_v17", "product_id": "CSAFPID-1702688", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v18", "product": { "name": "simatic_wincc_v18", "product_id": "CSAFPID-1703195", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v7.4", "product": { "name": "simatic_wincc_v7.4", "product_id": "CSAFPID-1501193", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v7.4:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v7.4", "product": { "name": "simatic_wincc_v7.4", "product_id": "CSAFPID-1457965", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v7.4:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v7.5", "product": { "name": "simatic_wincc_v7.5", "product_id": "CSAFPID-1501191", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v7.5:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v7.5", "product": { "name": "simatic_wincc_v7.5", "product_id": "CSAFPID-1457966", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v7.5:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v8.0", "product": { "name": "simatic_wincc_v8.0", "product_id": "CSAFPID-1501189", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v8.0:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v8.0", "product": { "name": "simatic_wincc_v8.0", "product_id": "CSAFPID-1457967", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v8.0:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simocode_es_v16", "product": { "name": "simocode_es_v16", "product_id": "CSAFPID-1702694", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simocode_es_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simocode_es_v17", "product": { "name": "simocode_es_v17", "product_id": "CSAFPID-1703196", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simocode_es_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simocode_es_v18", "product": { "name": "simocode_es_v18", "product_id": "CSAFPID-1703197", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simocode_es_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simotion_scout_tia_v5.4_sp1", "product": { "name": "simotion_scout_tia_v5.4_sp1", "product_id": "CSAFPID-1703198", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simotion_scout_tia_v5.4_sp1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simotion_scout_tia_v5.4_sp3", "product": { "name": "simotion_scout_tia_v5.4_sp3", "product_id": "CSAFPID-1703199", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simotion_scout_tia_v5.4_sp3:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simotion_scout_tia_v5.5_sp1", "product": { "name": "simotion_scout_tia_v5.5_sp1", "product_id": "CSAFPID-1703200", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simotion_scout_tia_v5.5_sp1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinamics_startdrive", "product": { "name": "sinamics_startdrive", "product_id": "CSAFPID-1625341", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinamics_startdrive:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinamics_startdrive", "product": { "name": "sinamics_startdrive", "product_id": "CSAFPID-1470069", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinamics_startdrive:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinamics_startdrive_v16", "product": { "name": "sinamics_startdrive_v16", "product_id": "CSAFPID-1703201", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinamics_startdrive_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinamics_startdrive_v17", "product": { "name": "sinamics_startdrive_v17", "product_id": "CSAFPID-1703202", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinamics_startdrive_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinamics_startdrive_v18", "product": { "name": "sinamics_startdrive_v18", "product_id": "CSAFPID-1703203", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinamics_startdrive_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_ins", "product": { "name": "sinec_ins", "product_id": "CSAFPID-746925", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_network_management_system", "product": { "name": "sinec_network_management_system", "product_id": "CSAFPID-1691397", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_network_management_system:2.0:sp1:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_nms", "product": { "name": "sinec_nms", "product_id": "CSAFPID-309392", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_nms", "product": { "name": "sinec_nms", "product_id": "CSAFPID-1458012", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_nms:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_nms", "product": { "name": "sinec_nms", "product_id": "CSAFPID-1693062", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_nms:2.0:sp2:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_nms", "product": { "name": "sinec_nms", "product_id": "CSAFPID-1691473", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_nms:3.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinema_remote_connect_client", "product": { "name": "sinema_remote_connect_client", "product_id": "CSAFPID-894438", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinema_remote_connect_client:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinumerik_one_virtual", "product": { "name": "sinumerik_one_virtual", "product_id": "CSAFPID-1625342", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinumerik_one_virtual:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinumerik_one_virtual", "product": { "name": "sinumerik_one_virtual", "product_id": "CSAFPID-1470070", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinumerik_one_virtual:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinumerik_plc_programming_tool", "product": { "name": "sinumerik_plc_programming_tool", "product_id": "CSAFPID-1625338", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinumerik_plc_programming_tool:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinumerik_plc_programming_tool", "product": { "name": "sinumerik_plc_programming_tool", "product_id": "CSAFPID-1470071", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinumerik_plc_programming_tool:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "siplus_s7-1500_cpu_1518-4_pn_dp_mfp__6ag1518-4ax00-4ac0_", "product": { "name": "siplus_s7-1500_cpu_1518-4_pn_dp_mfp__6ag1518-4ax00-4ac0_", "product_id": "CSAFPID-1615264", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:siplus_s7-1500_cpu_1518-4_pn_dp_mfp__6ag1518-4ax00-4ac0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "siport", "product": { "name": "siport", "product_id": "CSAFPID-1712847", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:siport:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sirius_safety_es_v17", "product": { "name": "sirius_safety_es_v17", "product_id": "CSAFPID-1703204", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sirius_safety_es_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sirius_safety_es_v18", "product": { "name": "sirius_safety_es_v18", "product_id": "CSAFPID-1703205", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sirius_safety_es_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sirius_soft_starter_es_v17", "product": { "name": "sirius_soft_starter_es_v17", "product_id": "CSAFPID-1703206", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sirius_soft_starter_es_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sirius_soft_starter_es_v18", "product": { "name": "sirius_soft_starter_es_v18", "product_id": "CSAFPID-1703207", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sirius_soft_starter_es_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "solid_edge_se2024", "product": { "name": "solid_edge_se2024", "product_id": "CSAFPID-1680248", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:solid_edge_se2024:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "spectrum_power_7", "product": { "name": "spectrum_power_7", "product_id": "CSAFPID-524281", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "st7_scadaconnect", "product": { "name": "st7_scadaconnect", "product_id": "CSAFPID-1691077", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:st7_scadaconnect:1.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "st7_scadaconnect__6nh7997-5da10-0aa0_", "product": { "name": "st7_scadaconnect__6nh7997-5da10-0aa0_", "product_id": "CSAFPID-1703173", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:st7_scadaconnect__6nh7997-5da10-0aa0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic", "product": { "name": "telecontrol_server_basic", "product_id": "CSAFPID-1691051", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic:3.1.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_1000_v3.1", "product": { "name": "telecontrol_server_basic_1000_v3.1", "product_id": "CSAFPID-1712839", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_1000_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_256_v3.1", "product": { "name": "telecontrol_server_basic_256_v3.1", "product_id": "CSAFPID-1712840", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_256_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_32_v3.1", "product": { "name": "telecontrol_server_basic_32_v3.1", "product_id": "CSAFPID-1712841", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_32_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_5000_v3.1", "product": { "name": "telecontrol_server_basic_5000_v3.1", "product_id": "CSAFPID-1712842", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_5000_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_64_v3.1", "product": { "name": "telecontrol_server_basic_64_v3.1", "product_id": "CSAFPID-1712843", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_64_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_8_v3.1", "product": { "name": "telecontrol_server_basic_8_v3.1", "product_id": "CSAFPID-1712844", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_8_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_serv_upgr", "product": { "name": "telecontrol_server_basic_serv_upgr", "product_id": "CSAFPID-1712845", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_serv_upgr:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_upgr_v3.1", "product": { "name": "telecontrol_server_basic_upgr_v3.1", "product_id": "CSAFPID-1712846", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_upgr_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_v3", "product": { "name": "telecontrol_server_basic_v3", "product_id": "CSAFPID-1637855", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_v3:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "tia_portal_cloud_connector", "product": { "name": "tia_portal_cloud_connector", "product_id": "CSAFPID-1625345", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:tia_portal_cloud_connector:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "tia_portal_cloud_connector", "product": { "name": "tia_portal_cloud_connector", "product_id": "CSAFPID-1470072", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:tia_portal_cloud_connector:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "tia_portal_cloud_v16", "product": { "name": "tia_portal_cloud_v16", "product_id": "CSAFPID-1712827", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:tia_portal_cloud_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "tia_portal_cloud_v17", "product": { "name": "tia_portal_cloud_v17", "product_id": "CSAFPID-1712828", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:tia_portal_cloud_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "tia_portal_cloud_v18", "product": { "name": "tia_portal_cloud_v18", "product_id": "CSAFPID-1712829", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:tia_portal_cloud_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal", "product": { "name": "totally_integrated_automation_portal", "product_id": "CSAFPID-74798", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal:15.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal", "product": { "name": "totally_integrated_automation_portal", "product_id": "CSAFPID-75533", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal:16:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal", "product": { "name": "totally_integrated_automation_portal", "product_id": "CSAFPID-74794", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal:17:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal", "product": { "name": "totally_integrated_automation_portal", "product_id": "CSAFPID-74792", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal:18:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal", "product": { "name": "totally_integrated_automation_portal", "product_id": "CSAFPID-1472073", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal:19:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v15.1", "product": { "name": "totally_integrated_automation_portal__tia_portal__v15.1", "product_id": "CSAFPID-1615531", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v15.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v15.1", "product": { "name": "totally_integrated_automation_portal__tia_portal__v15.1", "product_id": "CSAFPID-1458014", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v15.1:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v16", "product": { "name": "totally_integrated_automation_portal__tia_portal__v16", "product_id": "CSAFPID-1615256", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v16", "product": { "name": "totally_integrated_automation_portal__tia_portal__v16", "product_id": "CSAFPID-1458015", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v16:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v17", "product": { "name": "totally_integrated_automation_portal__tia_portal__v17", "product_id": "CSAFPID-1615257", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v17", "product": { "name": "totally_integrated_automation_portal__tia_portal__v17", "product_id": "CSAFPID-1458016", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v17:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v18", "product": { "name": "totally_integrated_automation_portal__tia_portal__v18", "product_id": "CSAFPID-1615258", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v18", "product": { "name": "totally_integrated_automation_portal__tia_portal__v18", "product_id": "CSAFPID-1458017", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v18:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v19", "product": { "name": "totally_integrated_automation_portal__tia_portal__v19", "product_id": "CSAFPID-1637618", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v19:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v19", "product": { "name": "totally_integrated_automation_portal__tia_portal__v19", "product_id": "CSAFPID-1470073", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v19:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "wincc", "product": { "name": "wincc", "product_id": "CSAFPID-1625343", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:wincc:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "wincc_tia_portal", "product": { "name": "wincc_tia_portal", "product_id": "CSAFPID-465667", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:wincc_tia_portal:11.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500", "product": { "name": "simatic_s7-1500", "product_id": "CSAFPID-715650", "product_identification_helper": { "cpe": "cpe:2.3:h:siemens:simatic_s7-1500:-:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7", "product": { "name": "simatic_s7", "product_id": "CSAFPID-1613729", "product_identification_helper": { "cpe": "cpe:2.3:h:siemens:simatic_s7:1500:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "cpu_1518f-4_pn\\/dp_mfp_firmware", "product": { "name": "cpu_1518f-4_pn\\/dp_mfp_firmware", "product_id": "CSAFPID-1691401", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:cpu_1518f-4_pn\\/dp_mfp_firmware:3.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "cpu_1518f-4_pn__dp_mfp_firmware", "product": { "name": "cpu_1518f-4_pn__dp_mfp_firmware", "product_id": "CSAFPID-715649", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:cpu_1518f-4_pn__dp_mfp_firmware:3.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ruggedcom_ape1808", "product": { "name": "ruggedcom_ape1808", "product_id": "CSAFPID-880853", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:ruggedcom_ape1808:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ruggedcom_ape1808_firmware", "product": { "name": "ruggedcom_ape1808_firmware", "product_id": "CSAFPID-542833", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "security_configuration_tool", "product": { "name": "security_configuration_tool", "product_id": "CSAFPID-540747", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:security_configuration_tool:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "siemens_simatic_s7-1500_tm_mfp", "product": { "name": "siemens_simatic_s7-1500_tm_mfp", "product_id": "CSAFPID-1693048", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:siemens_simatic_s7-1500_tm_mfp:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "siemens_simatic_s7_-1500_tm_mfp", "product": { "name": "siemens_simatic_s7_-1500_tm_mfp", "product_id": "CSAFPID-907212", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:siemens_simatic_s7_-1500_tm_mfp:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "siemens_telecontrol_server_basic", "product": { "name": "siemens_telecontrol_server_basic", "product_id": "CSAFPID-907211", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:siemens_telecontrol_server_basic:3:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_mv500_firmware", "product": { "name": "simatic_mv500_firmware", "product_id": "CSAFPID-1692274", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_mv500_firmware:3.3.5:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software", "product": { "name": "simatic_net_pc_software", "product_id": "CSAFPID-1472070", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_net_pc_software:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pcs_7", "product": { "name": "simatic_pcs_7", "product_id": "CSAFPID-1472067", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_pcs_7:9.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp_firmware", "product": { "name": "simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp_firmware", "product_id": "CSAFPID-1689769", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp_firmware:3.1.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518f-4_pn__dp_mfp_firmware", "product": { "name": "simatic_s7-1500_cpu_1518f-4_pn__dp_mfp_firmware", "product_id": "CSAFPID-766929", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn__dp_mfp_firmware:3.1.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_tm_mfp_firmware", "product": { "name": "simatic_s7-1500_tm_mfp_firmware", "product_id": "CSAFPID-717239", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:1.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_tm_mfp_firmware", "product": { "name": "simatic_s7-1500_tm_mfp_firmware", "product_id": "CSAFPID-905869", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:1.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7", "product": { "name": "simatic_step_7", "product_id": "CSAFPID-879652", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_step_7:5:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc", "product": { "name": "simatic_wincc", "product_id": "CSAFPID-1472068", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc", "product": { "name": "simatic_wincc", "product_id": "CSAFPID-1472066", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc", "product": { "name": "simatic_wincc", "product_id": "CSAFPID-1472072", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc:8.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa", "product": { "name": "simatic_wincc_oa", "product_id": "CSAFPID-1472071", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_oa:3.17:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_advanced", "product": { "name": "simatic_wincc_runtime_advanced", "product_id": "CSAFPID-886176", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional", "product": { "name": "simatic_wincc_runtime_professional", "product_id": "CSAFPID-165976", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_runtime_professional:16:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional", "product": { "name": "simatic_wincc_runtime_professional", "product_id": "CSAFPID-165974", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_runtime_professional:17:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional", "product": { "name": "simatic_wincc_runtime_professional", "product_id": "CSAFPID-855582", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_runtime_professional:18:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional", "product": { "name": "simatic_wincc_runtime_professional", "product_id": "CSAFPID-855580", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_runtime_professional:19:*:*:*:*:*:*:*" } } } ], "category": "vendor", "name": "siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3506", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" } ], "references": [ { "category": "self", "summary": "CVE-2021-3506", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2021/CVE-2021-3506.json" } ], "title": "CVE-2021-3506" }, { "cve": "CVE-2023-2975", "cwe": { "id": "CWE-287", "name": "Improper Authentication" }, "notes": [ { "category": "other", "text": "Improper Authentication", "title": "CWE-287" }, { "category": "other", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" }, { "category": "other", "text": "Use of a Broken or Risky Cryptographic Algorithm", "title": "CWE-327" } ], "product_status": { "known_affected": [ "CSAFPID-1703073", "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-2975", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-2975.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1703073", "CSAFPID-309392" ] } ], "title": "CVE-2023-2975" }, { "cve": "CVE-2023-3341", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "references": [ { "category": "self", "summary": "CVE-2023-3341", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3341.json" } ], "title": "CVE-2023-3341" }, { "cve": "CVE-2023-3446", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Inefficient Regular Expression Complexity", "title": "CWE-1333" }, { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "other", "text": "Use of a Cryptographic Primitive with a Risky Implementation", "title": "CWE-1240" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703073", "CSAFPID-309392", "CSAFPID-1637855", "CSAFPID-1703131", "CSAFPID-1703173" ] }, "references": [ { "category": "self", "summary": "CVE-2023-3446", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3446.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703073", "CSAFPID-309392", "CSAFPID-1637855", "CSAFPID-1703131", "CSAFPID-1703173" ] } ], "title": "CVE-2023-3446" }, { "cve": "CVE-2023-3817", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "other", "text": "Excessive Iteration", "title": "CWE-834" }, { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "other", "text": "Use of a Cryptographic Primitive with a Risky Implementation", "title": "CWE-1240" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1613729", "CSAFPID-1703073", "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-3817", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3817.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1613729", "CSAFPID-1703073", "CSAFPID-309392" ] } ], "title": "CVE-2023-3817" }, { "cve": "CVE-2023-4236", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" } ], "references": [ { "category": "self", "summary": "CVE-2023-4236", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4236.json" } ], "title": "CVE-2023-4236" }, { "cve": "CVE-2023-4408", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "references": [ { "category": "self", "summary": "CVE-2023-4408", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4408.json" } ], "title": "CVE-2023-4408" }, { "cve": "CVE-2023-4807", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "other", "text": "Expected Behavior Violation", "title": "CWE-440" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1637855", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] }, "references": [ { "category": "self", "summary": "CVE-2023-4807", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4807.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1637855", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] } ], "title": "CVE-2023-4807" }, { "cve": "CVE-2023-5363", "cwe": { "id": "CWE-325", "name": "Missing Cryptographic Step" }, "notes": [ { "category": "other", "text": "Missing Cryptographic Step", "title": "CWE-325" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "other", "text": "Incorrect Provision of Specified Functionality", "title": "CWE-684" } ], "product_status": { "known_affected": [ "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] }, "references": [ { "category": "self", "summary": "CVE-2023-5363", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5363.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] } ], "title": "CVE-2023-5363" }, { "cve": "CVE-2023-5517", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" } ], "references": [ { "category": "self", "summary": "CVE-2023-5517", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5517.json" } ], "title": "CVE-2023-5517" }, { "cve": "CVE-2023-5678", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "other", "text": "Improper Check for Unusual or Exceptional Conditions", "title": "CWE-754" }, { "category": "other", "text": "Missing Cryptographic Step", "title": "CWE-325" }, { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1613729", "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1637855", "CSAFPID-1703131", "CSAFPID-309392", "CSAFPID-1703173", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] }, "references": [ { "category": "self", "summary": "CVE-2023-5678", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5678.json" } ], "title": "CVE-2023-5678" }, { "cve": "CVE-2023-5679", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" } ], "references": [ { "category": "self", "summary": "CVE-2023-5679", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5679.json" } ], "title": "CVE-2023-5679" }, { "cve": "CVE-2023-5680", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "references": [ { "category": "self", "summary": "CVE-2023-5680", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5680.json" } ], "title": "CVE-2023-5680" }, { "cve": "CVE-2023-6129", "cwe": { "id": "CWE-328", "name": "Use of Weak Hash" }, "notes": [ { "category": "other", "text": "Use of Weak Hash", "title": "CWE-328" }, { "category": "other", "text": "Expected Behavior Violation", "title": "CWE-440" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "other", "text": "Use of a Broken or Risky Cryptographic Algorithm", "title": "CWE-327" } ], "references": [ { "category": "self", "summary": "CVE-2023-6129", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-6129.json" } ], "title": "CVE-2023-6129" }, { "cve": "CVE-2023-6237", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" } ], "references": [ { "category": "self", "summary": "CVE-2023-6237", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-6237.json" } ], "title": "CVE-2023-6237" }, { "cve": "CVE-2023-6516", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Memory Allocation with Excessive Size Value", "title": "CWE-789" } ], "references": [ { "category": "self", "summary": "CVE-2023-6516", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-6516.json" } ], "title": "CVE-2023-6516" }, { "cve": "CVE-2023-7104", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" } ], "product_status": { "known_affected": [ "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2023-7104", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-7104.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-1703131" ] } ], "title": "CVE-2023-7104" }, { "cve": "CVE-2023-28450", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" } ], "product_status": { "known_affected": [ "CSAFPID-1613504", "CSAFPID-1613505", "CSAFPID-1613506", "CSAFPID-1613507", "CSAFPID-1613592", "CSAFPID-1613593", "CSAFPID-1613594", "CSAFPID-1613595", "CSAFPID-1613596", "CSAFPID-1613597", "CSAFPID-1613598" ] }, "references": [ { "category": "self", "summary": "CVE-2023-28450", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-28450.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1613504", "CSAFPID-1613505", "CSAFPID-1613506", "CSAFPID-1613507", "CSAFPID-1613592", "CSAFPID-1613593", "CSAFPID-1613594", "CSAFPID-1613595", "CSAFPID-1613596", "CSAFPID-1613597", "CSAFPID-1613598" ] } ], "title": "CVE-2023-28450" }, { "cve": "CVE-2023-30584", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-30584", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-30584.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-30584" }, { "cve": "CVE-2023-32002", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" }, { "category": "other", "text": "Policy Privileges are not Assigned Consistently Between Control and Data Agents", "title": "CWE-1268" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32002", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32002.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-32002" }, { "cve": "CVE-2023-32003", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32003", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32003.json" } ], "title": "CVE-2023-32003" }, { "cve": "CVE-2023-32004", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32004", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32004.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-32004" }, { "cve": "CVE-2023-32005", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "other", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32005", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32005.json" } ], "title": "CVE-2023-32005" }, { "cve": "CVE-2023-32006", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "other", "text": "Exposure of Sensitive Information Due to Incompatible Policies", "title": "CWE-213" }, { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32006", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32006.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-32006" }, { "cve": "CVE-2023-32558", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32558", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32558.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-32558" }, { "cve": "CVE-2023-32559", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "other", "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)", "title": "CWE-94" }, { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32559", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32559.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-32559" }, { "cve": "CVE-2023-32736", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" } ], "product_status": { "known_affected": [ "CSAFPID-1712825", "CSAFPID-1712826", "CSAFPID-1703190", "CSAFPID-1703191", "CSAFPID-1500667", "CSAFPID-1703187", "CSAFPID-1703188", "CSAFPID-1703189", "CSAFPID-1703192", "CSAFPID-1703193", "CSAFPID-1703194", "CSAFPID-1702687", "CSAFPID-1702688", "CSAFPID-1703195", "CSAFPID-1702694", "CSAFPID-1703196", "CSAFPID-1703197", "CSAFPID-1703198", "CSAFPID-1703199", "CSAFPID-1703200", "CSAFPID-1703201", "CSAFPID-1703202", "CSAFPID-1703203", "CSAFPID-1703204", "CSAFPID-1703205", "CSAFPID-1703206", "CSAFPID-1703207", "CSAFPID-1712827", "CSAFPID-1712828", "CSAFPID-1712829" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32736", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32736.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-1712825", "CSAFPID-1712826", "CSAFPID-1703190", "CSAFPID-1703191", "CSAFPID-1500667", "CSAFPID-1703187", "CSAFPID-1703188", "CSAFPID-1703189", "CSAFPID-1703192", "CSAFPID-1703193", "CSAFPID-1703194", "CSAFPID-1702687", "CSAFPID-1702688", "CSAFPID-1703195", "CSAFPID-1702694", "CSAFPID-1703196", "CSAFPID-1703197", "CSAFPID-1703198", "CSAFPID-1703199", "CSAFPID-1703200", "CSAFPID-1703201", "CSAFPID-1703202", "CSAFPID-1703203", "CSAFPID-1703204", "CSAFPID-1703205", "CSAFPID-1703206", "CSAFPID-1703207", "CSAFPID-1712827", "CSAFPID-1712828", "CSAFPID-1712829" ] } ], "title": "CVE-2023-32736" }, { "cve": "CVE-2023-38552", "cwe": { "id": "CWE-354", "name": "Improper Validation of Integrity Check Value" }, "notes": [ { "category": "other", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" } ], "references": [ { "category": "self", "summary": "CVE-2023-38552", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-38552.json" } ], "title": "CVE-2023-38552" }, { "cve": "CVE-2023-38709", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)", "title": "CWE-113" }, { "category": "other", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" } ], "references": [ { "category": "self", "summary": "CVE-2023-38709", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-38709.json" } ], "title": "CVE-2023-38709" }, { "cve": "CVE-2023-39331", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "references": [ { "category": "self", "summary": "CVE-2023-39331", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39331.json" } ], "title": "CVE-2023-39331" }, { "cve": "CVE-2023-39332", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "references": [ { "category": "self", "summary": "CVE-2023-39332", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39332.json" } ], "title": "CVE-2023-39332" }, { "cve": "CVE-2023-39333", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)", "title": "CWE-94" } ], "references": [ { "category": "self", "summary": "CVE-2023-39333", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39333.json" } ], "title": "CVE-2023-39333" }, { "cve": "CVE-2023-44487", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-309392", "CSAFPID-1615259", "CSAFPID-1703173" ] }, "references": [ { "category": "self", "summary": "CVE-2023-44487", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-44487.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-309392", "CSAFPID-1615259", "CSAFPID-1703173" ] } ], "title": "CVE-2023-44487" }, { "cve": "CVE-2023-45143", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" } ], "references": [ { "category": "self", "summary": "CVE-2023-45143", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-45143.json" } ], "title": "CVE-2023-45143" }, { "cve": "CVE-2023-46218", "cwe": { "id": "CWE-201", "name": "Insertion of Sensitive Information Into Sent Data" }, "notes": [ { "category": "other", "text": "Insertion of Sensitive Information Into Sent Data", "title": "CWE-201" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] }, "references": [ { "category": "self", "summary": "CVE-2023-46218", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46218.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] } ], "title": "CVE-2023-46218" }, { "cve": "CVE-2023-46219", "cwe": { "id": "CWE-311", "name": "Missing Encryption of Sensitive Data" }, "notes": [ { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] }, "references": [ { "category": "self", "summary": "CVE-2023-46219", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46219.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] } ], "title": "CVE-2023-46219" }, { "cve": "CVE-2023-46280", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" } ], "product_status": { "known_affected": [ "CSAFPID-1458012", "CSAFPID-309392", "CSAFPID-1625338", "CSAFPID-1625340", "CSAFPID-1625341", "CSAFPID-75563", "CSAFPID-1625342", "CSAFPID-165765", "CSAFPID-1625345", "CSAFPID-766087", "CSAFPID-1637559", "CSAFPID-1637560", "CSAFPID-1637561", "CSAFPID-1637909", "CSAFPID-1637910", "CSAFPID-1637849", "CSAFPID-1637850", "CSAFPID-1637851", "CSAFPID-1637911", "CSAFPID-1501190", "CSAFPID-1637912", "CSAFPID-1637856", "CSAFPID-1637913", "CSAFPID-1637914", "CSAFPID-1637915", "CSAFPID-1637916", "CSAFPID-1637917", "CSAFPID-1637887", "CSAFPID-1501188", "CSAFPID-1501192", "CSAFPID-1637854", "CSAFPID-1501193", "CSAFPID-1501191", "CSAFPID-1501189", "CSAFPID-1615531", "CSAFPID-1615256", "CSAFPID-1615257", "CSAFPID-1615258", "CSAFPID-1637618", "CSAFPID-1470060", "CSAFPID-1470061", "CSAFPID-1470062", "CSAFPID-1470063", "CSAFPID-1470064", "CSAFPID-1457909", "CSAFPID-1470065", "CSAFPID-1470066", "CSAFPID-1457855", "CSAFPID-1457956", "CSAFPID-1457957", "CSAFPID-1457958", "CSAFPID-1470067", "CSAFPID-1457960", "CSAFPID-1457961", "CSAFPID-1457962", "CSAFPID-1457963", "CSAFPID-1470068", "CSAFPID-1457965", "CSAFPID-1457966", "CSAFPID-1457967", "CSAFPID-1470069", "CSAFPID-1470070", "CSAFPID-1470071", "CSAFPID-1470072", "CSAFPID-1458014", "CSAFPID-1458015", "CSAFPID-1458016", "CSAFPID-1458017", "CSAFPID-1470073", "CSAFPID-75533", "CSAFPID-1472069", "CSAFPID-1472073", "CSAFPID-74792", "CSAFPID-74794", "CSAFPID-1457906", "CSAFPID-1457907", "CSAFPID-1457908" ] }, "references": [ { "category": "self", "summary": "CVE-2023-46280", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46280.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-1458012", "CSAFPID-309392", "CSAFPID-1625338", "CSAFPID-1625340", "CSAFPID-1625341", "CSAFPID-75563", "CSAFPID-1625342", "CSAFPID-165765", "CSAFPID-1625345", "CSAFPID-766087", "CSAFPID-1637559", "CSAFPID-1637560", "CSAFPID-1637561", "CSAFPID-1637909", "CSAFPID-1637910", "CSAFPID-1637849", "CSAFPID-1637850", "CSAFPID-1637851", "CSAFPID-1637911", "CSAFPID-1501190", "CSAFPID-1637912", "CSAFPID-1637856", "CSAFPID-1637913", "CSAFPID-1637914", "CSAFPID-1637915", "CSAFPID-1637916", "CSAFPID-1637917", "CSAFPID-1637887", "CSAFPID-1501188", "CSAFPID-1501192", "CSAFPID-1637854", "CSAFPID-1501193", "CSAFPID-1501191", "CSAFPID-1501189", "CSAFPID-1615531", "CSAFPID-1615256", "CSAFPID-1615257", "CSAFPID-1615258", "CSAFPID-1637618", "CSAFPID-1470060", "CSAFPID-1470061", "CSAFPID-1470062", "CSAFPID-1470063", "CSAFPID-1470064", "CSAFPID-1457909", "CSAFPID-1470065", "CSAFPID-1470066", "CSAFPID-1457855", "CSAFPID-1457956", "CSAFPID-1457957", "CSAFPID-1457958", "CSAFPID-1470067", "CSAFPID-1457960", "CSAFPID-1457961", "CSAFPID-1457962", "CSAFPID-1457963", "CSAFPID-1470068", "CSAFPID-1457965", "CSAFPID-1457966", "CSAFPID-1457967", "CSAFPID-1470069", "CSAFPID-1470070", "CSAFPID-1470071", "CSAFPID-1470072", "CSAFPID-1458014", "CSAFPID-1458015", "CSAFPID-1458016", "CSAFPID-1458017", "CSAFPID-1470073", "CSAFPID-75533", "CSAFPID-1472069", "CSAFPID-1472073", "CSAFPID-74792", "CSAFPID-74794", "CSAFPID-1457906", "CSAFPID-1457907", "CSAFPID-1457908" ] } ], "title": "CVE-2023-46280" }, { "cve": "CVE-2023-46809", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "notes": [ { "category": "other", "text": "Observable Timing Discrepancy", "title": "CWE-208" } ], "references": [ { "category": "self", "summary": "CVE-2023-46809", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46809.json" } ], "title": "CVE-2023-46809" }, { "cve": "CVE-2023-47038", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" } ], "references": [ { "category": "self", "summary": "CVE-2023-47038", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-47038.json" } ], "title": "CVE-2023-47038" }, { "cve": "CVE-2023-47039", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" } ], "references": [ { "category": "self", "summary": "CVE-2023-47039", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-47039.json" } ], "title": "CVE-2023-47039" }, { "cve": "CVE-2023-47100", "references": [ { "category": "self", "summary": "CVE-2023-47100", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-47100.json" } ], "title": "CVE-2023-47100" }, { "cve": "CVE-2023-48795", "cwe": { "id": "CWE-222", "name": "Truncation of Security-relevant Information" }, "notes": [ { "category": "other", "text": "Truncation of Security-relevant Information", "title": "CWE-222" }, { "category": "other", "text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)", "title": "CWE-757" } ], "product_status": { "known_affected": [ "CSAFPID-1615259", "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2023-48795", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-48795.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-1615259", "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] } ], "title": "CVE-2023-48795" }, { "cve": "CVE-2023-49441", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" } ], "references": [ { "category": "self", "summary": "CVE-2023-49441", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-49441.json" } ], "title": "CVE-2023-49441" }, { "cve": "CVE-2023-50387", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "references": [ { "category": "self", "summary": "CVE-2023-50387", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-50387.json" } ], "title": "CVE-2023-50387" }, { "cve": "CVE-2023-50868", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "references": [ { "category": "self", "summary": "CVE-2023-50868", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-50868.json" } ], "title": "CVE-2023-50868" }, { "cve": "CVE-2023-52389", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" } ], "references": [ { "category": "self", "summary": "CVE-2023-52389", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-52389.json" } ], "title": "CVE-2023-52389" }, { "cve": "CVE-2024-0232", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" } ], "product_status": { "known_affected": [ "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0232", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0232.json" } ], "title": "CVE-2024-0232" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1613729", "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0727", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0727.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1613729", "CSAFPID-1703131" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-2004", "cwe": { "id": "CWE-319", "name": "Cleartext Transmission of Sensitive Information" }, "notes": [ { "category": "other", "text": "Cleartext Transmission of Sensitive Information", "title": "CWE-319" }, { "category": "other", "text": "Misinterpretation of Input", "title": "CWE-115" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "other", "text": "Interpretation Conflict", "title": "CWE-436" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] }, "references": [ { "category": "self", "summary": "CVE-2024-2004", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2004.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] } ], "title": "CVE-2024-2004" }, { "cve": "CVE-2024-2379", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] }, "references": [ { "category": "self", "summary": "CVE-2024-2379", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2379.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] } ], "title": "CVE-2024-2379" }, { "cve": "CVE-2024-2398", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Resource after Effective Lifetime", "title": "CWE-772" }, { "category": "other", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] }, "references": [ { "category": "self", "summary": "CVE-2024-2398", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2398.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] } ], "title": "CVE-2024-2398" }, { "cve": "CVE-2024-2466", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "other", "text": "Improper Validation of Certificate with Host Mismatch", "title": "CWE-297" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] }, "references": [ { "category": "self", "summary": "CVE-2024-2466", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2466.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] } ], "title": "CVE-2024-2466" }, { "cve": "CVE-2024-2511", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Improperly Controlled Sequential Memory Allocation", "title": "CWE-1325" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2024-2511", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2511.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] } ], "title": "CVE-2024-2511" }, { "cve": "CVE-2024-4603", "cwe": { "id": "CWE-606", "name": "Unchecked Input for Loop Condition" }, "notes": [ { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "other", "text": "Excessive Iteration", "title": "CWE-834" } ], "references": [ { "category": "self", "summary": "CVE-2024-4603", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4603.json" } ], "title": "CVE-2024-4603" }, { "cve": "CVE-2024-4741", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" } ], "references": [ { "category": "self", "summary": "CVE-2024-4741", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4741.json" } ], "title": "CVE-2024-4741" }, { "cve": "CVE-2024-5535", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "other", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2024-5535", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-5535.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] } ], "title": "CVE-2024-5535" }, { "cve": "CVE-2024-5594", "references": [ { "category": "self", "summary": "CVE-2024-5594", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-5594.json" } ], "title": "CVE-2024-5594" }, { "cve": "CVE-2024-21890", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "other", "text": "Insufficient Technical Documentation", "title": "CWE-1059" } ], "references": [ { "category": "self", "summary": "CVE-2024-21890", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21890.json" } ], "title": "CVE-2024-21890" }, { "cve": "CVE-2024-21891", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "references": [ { "category": "self", "summary": "CVE-2024-21891", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21891.json" } ], "title": "CVE-2024-21891" }, { "cve": "CVE-2024-21892", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)", "title": "CWE-94" } ], "references": [ { "category": "self", "summary": "CVE-2024-21892", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21892.json" } ], "title": "CVE-2024-21892" }, { "cve": "CVE-2024-21896", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "references": [ { "category": "self", "summary": "CVE-2024-21896", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21896.json" } ], "title": "CVE-2024-21896" }, { "cve": "CVE-2024-22017", "cwe": { "id": "CWE-271", "name": "Privilege Dropping / Lowering Errors" }, "notes": [ { "category": "other", "text": "Privilege Dropping / Lowering Errors", "title": "CWE-271" }, { "category": "other", "text": "Improper Privilege Management", "title": "CWE-269" } ], "references": [ { "category": "self", "summary": "CVE-2024-22017", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22017.json" } ], "title": "CVE-2024-22017" }, { "cve": "CVE-2024-22019", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" } ], "references": [ { "category": "self", "summary": "CVE-2024-22019", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22019.json" } ], "title": "CVE-2024-22019" }, { "cve": "CVE-2024-22025", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" } ], "references": [ { "category": "self", "summary": "CVE-2024-22025", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22025.json" } ], "title": "CVE-2024-22025" }, { "cve": "CVE-2024-24758", "cwe": { "id": "CWE-942", "name": "Permissive Cross-domain Policy with Untrusted Domains" }, "notes": [ { "category": "other", "text": "Permissive Cross-domain Policy with Untrusted Domains", "title": "CWE-942" }, { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" } ], "references": [ { "category": "self", "summary": "CVE-2024-24758", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24758.json" } ], "title": "CVE-2024-24758" }, { "cve": "CVE-2024-24795", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)", "title": "CWE-113" } ], "references": [ { "category": "self", "summary": "CVE-2024-24795", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24795.json" } ], "title": "CVE-2024-24795" }, { "cve": "CVE-2024-24806", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" } ], "references": [ { "category": "self", "summary": "CVE-2024-24806", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24806.json" } ], "title": "CVE-2024-24806" }, { "cve": "CVE-2024-26306", "cwe": { "id": "CWE-310", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-310", "title": "CWE-310" }, { "category": "other", "text": "Observable Discrepancy", "title": "CWE-203" } ], "references": [ { "category": "self", "summary": "CVE-2024-26306", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26306.json" } ], "title": "CVE-2024-26306" }, { "cve": "CVE-2024-26925", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "other", "text": "Improper Access Control", "title": "CWE-284" }, { "category": "other", "text": "Improper Locking", "title": "CWE-667" } ], "references": [ { "category": "self", "summary": "CVE-2024-26925", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26925.json" } ], "title": "CVE-2024-26925" }, { "cve": "CVE-2024-27316", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" } ], "references": [ { "category": "self", "summary": "CVE-2024-27316", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27316.json" } ], "title": "CVE-2024-27316" }, { "cve": "CVE-2024-27980", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)", "title": "CWE-78" } ], "references": [ { "category": "self", "summary": "CVE-2024-27980", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27980.json" } ], "title": "CVE-2024-27980" }, { "cve": "CVE-2024-27982", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "notes": [ { "category": "other", "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)", "title": "CWE-444" } ], "references": [ { "category": "self", "summary": "CVE-2024-27982", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27982.json" } ], "title": "CVE-2024-27982" }, { "cve": "CVE-2024-27983", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "references": [ { "category": "self", "summary": "CVE-2024-27983", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27983.json" } ], "title": "CVE-2024-27983" }, { "cve": "CVE-2024-28882", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Resource after Effective Lifetime", "title": "CWE-772" } ], "references": [ { "category": "self", "summary": "CVE-2024-28882", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-28882.json" } ], "title": "CVE-2024-28882" }, { "cve": "CVE-2024-29119", "cwe": { "id": "CWE-266", "name": "Incorrect Privilege Assignment" }, "notes": [ { "category": "other", "text": "Incorrect Privilege Assignment", "title": "CWE-266" } ], "product_status": { "known_affected": [ "CSAFPID-524281" ] }, "references": [ { "category": "self", "summary": "CVE-2024-29119", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29119.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-524281" ] } ], "title": "CVE-2024-29119" }, { "cve": "CVE-2024-36140", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "title": "CWE-79" } ], "product_status": { "known_affected": [ "CSAFPID-1712832", "CSAFPID-1712833" ] }, "references": [ { "category": "self", "summary": "CVE-2024-36140", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-36140.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-1712832", "CSAFPID-1712833" ] } ], "title": "CVE-2024-36140" }, { "cve": "CVE-2024-44102", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" } ], "product_status": { "known_affected": [ "CSAFPID-1712834", "CSAFPID-1712835", "CSAFPID-1712836", "CSAFPID-1712837", "CSAFPID-1712838", "CSAFPID-1712839", "CSAFPID-1712840", "CSAFPID-1712841", "CSAFPID-1712842", "CSAFPID-1712843", "CSAFPID-1712844", "CSAFPID-1712845", "CSAFPID-1712846" ] }, "references": [ { "category": "self", "summary": "CVE-2024-44102", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-44102.json" } ], "scores": [ { "cvss_v3": { "baseScore": 10.0, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-1712834", "CSAFPID-1712835", "CSAFPID-1712836", "CSAFPID-1712837", "CSAFPID-1712838", "CSAFPID-1712839", "CSAFPID-1712840", "CSAFPID-1712841", "CSAFPID-1712842", "CSAFPID-1712843", "CSAFPID-1712844", "CSAFPID-1712845", "CSAFPID-1712846" ] } ], "title": "CVE-2024-44102" }, { "cve": "CVE-2024-46888", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46888", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46888.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46888" }, { "cve": "CVE-2024-46889", "cwe": { "id": "CWE-321", "name": "Use of Hard-coded Cryptographic Key" }, "notes": [ { "category": "other", "text": "Use of Hard-coded Cryptographic Key", "title": "CWE-321" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46889", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46889.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46889" }, { "cve": "CVE-2024-46890", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)", "title": "CWE-78" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46890", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46890.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46890" }, { "cve": "CVE-2024-46891", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46891", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46891.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46891" }, { "cve": "CVE-2024-46892", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "notes": [ { "category": "other", "text": "Insufficient Session Expiration", "title": "CWE-613" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46892", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46892.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46892" }, { "cve": "CVE-2024-46894", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46894", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46894.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46894" }, { "cve": "CVE-2024-47783", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "other", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" } ], "product_status": { "known_affected": [ "CSAFPID-1712847" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47783", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47783.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1712847" ] } ], "title": "CVE-2024-47783" }, { "cve": "CVE-2024-47808", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "other", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47808", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47808.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2024-47808" }, { "cve": "CVE-2024-47940", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" } ], "product_status": { "known_affected": [ "CSAFPID-1680248" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47940", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47940.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1680248" ] } ], "title": "CVE-2024-47940" }, { "cve": "CVE-2024-47941", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" } ], "product_status": { "known_affected": [ "CSAFPID-1680248" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47941", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47941.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1680248" ] } ], "title": "CVE-2024-47941" }, { "cve": "CVE-2024-47942", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "notes": [ { "category": "other", "text": "Uncontrolled Search Path Element", "title": "CWE-427" } ], "product_status": { "known_affected": [ "CSAFPID-1680248" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47942", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47942.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1680248" ] } ], "title": "CVE-2024-47942" }, { "cve": "CVE-2024-50310", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" } ], "product_status": { "known_affected": [ "CSAFPID-1712748" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50310", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50310.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-1712748" ] } ], "title": "CVE-2024-50310" }, { "cve": "CVE-2024-50313", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)", "title": "CWE-362" } ], "product_status": { "known_affected": [ "CSAFPID-1637622", "CSAFPID-1637623", "CSAFPID-1637624", "CSAFPID-1637625", "CSAFPID-1637626" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50313", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50313.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1637622", "CSAFPID-1637623", "CSAFPID-1637624", "CSAFPID-1637625", "CSAFPID-1637626" ] } ], "title": "CVE-2024-50313" }, { "cve": "CVE-2024-50557", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50557", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50557.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50557" }, { "cve": "CVE-2024-50558", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "other", "text": "Improper Access Control", "title": "CWE-284" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50558", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50558.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50558" }, { "cve": "CVE-2024-50559", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50559", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50559.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50559" }, { "cve": "CVE-2024-50560", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50560", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50560.json" } ], "scores": [ { "cvss_v3": { "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50560" }, { "cve": "CVE-2024-50561", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "title": "CWE-79" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50561", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50561.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50561" }, { "cve": "CVE-2024-50572", "cwe": { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)", "title": "CWE-74" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50572", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50572.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50572" } ] }
NCSC-2024-0299
Vulnerability from csaf_ncscnl
Published
2024-07-17 13:54
Modified
2024-07-17 13:54
Summary
Kwetsbaarheden verholpen in Oracle Analytics
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Er zijn kwetsbaarheden verholpen in Oracle Analytics.
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
* Denial-of-Service (DoS)
* Toegang tot gevoelige gegevens
* Toegang tot systeemgegevens
* Manipulatie van gegevens
* (Remote) code execution (Gebruikersrechten)
Oplossingen
Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.
Kans
medium
Schade
high
CWE-20
Improper Input Validation
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-222
Truncation of Security-relevant Information
CWE-285
Improper Authorization
CWE-400
Uncontrolled Resource Consumption
CWE-404
Improper Resource Shutdown or Release
CWE-426
Untrusted Search Path
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-476
NULL Pointer Dereference
CWE-674
Uncontrolled Recursion
CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-787
Out-of-bounds Write
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Er zijn kwetsbaarheden verholpen in Oracle Analytics.", "title": "Feiten" }, { "category": "description", "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n* Denial-of-Service (DoS)\n* Toegang tot gevoelige gegevens\n* Toegang tot systeemgegevens\n* Manipulatie van gegevens\n* (Remote) code execution (Gebruikersrechten)", "title": "Interpretaties" }, { "category": "description", "text": "Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "general", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "Truncation of Security-relevant Information", "title": "CWE-222" }, { "category": "general", "text": "Improper Authorization", "title": "CWE-285" }, { "category": "general", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "Untrusted Search Path", "title": "CWE-426" }, { "category": "general", "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)", "title": "CWE-444" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "general", "text": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)", "title": "CWE-776" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)", "title": "CWE-835" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23926" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21797" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1370" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1436" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26031" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33202" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48795" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49083" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52428" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0727" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21139" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" }, { "category": "external", "summary": "Reference - oracle", "url": "https://www.oracle.com/docs/tech/security-alerts/cpujul2024csaf.json" }, { "category": "external", "summary": "Reference - cveprojectv5; ibm; nvd; oracle", "url": "https://www.oracle.com/security-alerts/cpujul2024.html" } ], "title": " Kwetsbaarheden verholpen in Oracle Analytics", "tracking": { "current_release_date": "2024-07-17T13:54:03.545073Z", "id": "NCSC-2024-0299", "initial_release_date": "2024-07-17T13:54:03.545073Z", "revision_history": [ { "date": "2024-07-17T13:54:03.545073Z", "number": "0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-816763", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-816761", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:6.4.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-816762", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:7.0.0.0.0:*:*:*:*:*:*:*" } } } ], "category": "vendor", "name": "oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-23926", "cwe": { "id": "CWE-776", "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)" }, "notes": [ { "category": "other", "text": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)", "title": "CWE-776" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2021-23926", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2021/CVE-2021-23926.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2021-23926" }, { "cve": "CVE-2021-37533", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2021-37533", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2021/CVE-2021-37533.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2021-37533" }, { "cve": "CVE-2022-0239", "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2022-0239", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-0239.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2022-0239" }, { "cve": "CVE-2022-21797", "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2022-21797", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-21797.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2022-21797" }, { "cve": "CVE-2022-40152", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2022-40152", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-40152.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2022-40152" }, { "cve": "CVE-2023-1370", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "other", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-1370", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-1370.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2023-1370" }, { "cve": "CVE-2023-1436", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "other", "text": "Uncontrolled Recursion", "title": "CWE-674" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-1436", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-1436.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2023-1436" }, { "cve": "CVE-2023-26031", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "notes": [ { "category": "other", "text": "Untrusted Search Path", "title": "CWE-426" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-26031", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-26031.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2023-26031" }, { "cve": "CVE-2023-33202", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-33202", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-33202.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2023-33202" }, { "cve": "CVE-2023-46589", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "notes": [ { "category": "other", "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)", "title": "CWE-444" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-46589", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46589.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2023-46589" }, { "cve": "CVE-2023-48795", "cwe": { "id": "CWE-222", "name": "Truncation of Security-relevant Information" }, "notes": [ { "category": "other", "text": "Truncation of Security-relevant Information", "title": "CWE-222" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-48795", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-48795.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2023-48795" }, { "cve": "CVE-2023-49083", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-49083", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-49083.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2023-49083" }, { "cve": "CVE-2023-52428", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-52428", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-52428.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2023-52428" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0727", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0727.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-21139", "cwe": { "id": "CWE-285", "name": "Improper Authorization" }, "notes": [ { "category": "other", "text": "Improper Authorization", "title": "CWE-285" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21139", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21139.json" } ], "title": "CVE-2024-21139" }, { "cve": "CVE-2024-25710", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "notes": [ { "category": "other", "text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)", "title": "CWE-835" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2024-25710", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-25710.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2024-25710" } ] }
ncsc-2024-0299
Vulnerability from csaf_ncscnl
Published
2024-07-17 13:54
Modified
2024-07-17 13:54
Summary
Kwetsbaarheden verholpen in Oracle Analytics
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Er zijn kwetsbaarheden verholpen in Oracle Analytics.
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
* Denial-of-Service (DoS)
* Toegang tot gevoelige gegevens
* Toegang tot systeemgegevens
* Manipulatie van gegevens
* (Remote) code execution (Gebruikersrechten)
Oplossingen
Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.
Kans
medium
Schade
high
CWE-20
Improper Input Validation
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-222
Truncation of Security-relevant Information
CWE-285
Improper Authorization
CWE-400
Uncontrolled Resource Consumption
CWE-404
Improper Resource Shutdown or Release
CWE-426
Untrusted Search Path
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-476
NULL Pointer Dereference
CWE-674
Uncontrolled Recursion
CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-787
Out-of-bounds Write
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Er zijn kwetsbaarheden verholpen in Oracle Analytics.", "title": "Feiten" }, { "category": "description", "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n* Denial-of-Service (DoS)\n* Toegang tot gevoelige gegevens\n* Toegang tot systeemgegevens\n* Manipulatie van gegevens\n* (Remote) code execution (Gebruikersrechten)", "title": "Interpretaties" }, { "category": "description", "text": "Oracle heeft updates beschikbaar gesteld om de kwetsbaarheden te verhelpen. Zie de referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "general", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "Truncation of Security-relevant Information", "title": "CWE-222" }, { "category": "general", "text": "Improper Authorization", "title": "CWE-285" }, { "category": "general", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "Untrusted Search Path", "title": "CWE-426" }, { "category": "general", "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)", "title": "CWE-444" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "general", "text": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)", "title": "CWE-776" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)", "title": "CWE-835" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23926" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21797" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1370" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1436" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26031" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33202" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48795" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49083" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52428" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0727" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21139" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25710" }, { "category": "external", "summary": "Reference - oracle", "url": "https://www.oracle.com/docs/tech/security-alerts/cpujul2024csaf.json" }, { "category": "external", "summary": "Reference - cveprojectv5; ibm; nvd; oracle", "url": "https://www.oracle.com/security-alerts/cpujul2024.html" } ], "title": " Kwetsbaarheden verholpen in Oracle Analytics", "tracking": { "current_release_date": "2024-07-17T13:54:03.545073Z", "id": "NCSC-2024-0299", "initial_release_date": "2024-07-17T13:54:03.545073Z", "revision_history": [ { "date": "2024-07-17T13:54:03.545073Z", "number": "0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-816763", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-816761", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:6.4.0.0.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "analytics_desktop", "product": { "name": "analytics_desktop", "product_id": "CSAFPID-816762", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:analytics_desktop:7.0.0.0.0:*:*:*:*:*:*:*" } } } ], "category": "vendor", "name": "oracle" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-23926", "cwe": { "id": "CWE-776", "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)" }, "notes": [ { "category": "other", "text": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)", "title": "CWE-776" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2021-23926", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2021/CVE-2021-23926.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2021-23926" }, { "cve": "CVE-2021-37533", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2021-37533", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2021/CVE-2021-37533.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2021-37533" }, { "cve": "CVE-2022-0239", "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2022-0239", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-0239.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2022-0239" }, { "cve": "CVE-2022-21797", "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2022-21797", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-21797.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2022-21797" }, { "cve": "CVE-2022-40152", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2022-40152", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-40152.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2022-40152" }, { "cve": "CVE-2023-1370", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "other", "text": "Uncontrolled Recursion", "title": "CWE-674" }, { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-1370", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-1370.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2023-1370" }, { "cve": "CVE-2023-1436", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "other", "text": "Uncontrolled Recursion", "title": "CWE-674" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-1436", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-1436.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2023-1436" }, { "cve": "CVE-2023-26031", "cwe": { "id": "CWE-426", "name": "Untrusted Search Path" }, "notes": [ { "category": "other", "text": "Untrusted Search Path", "title": "CWE-426" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-26031", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-26031.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2023-26031" }, { "cve": "CVE-2023-33202", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-33202", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-33202.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2023-33202" }, { "cve": "CVE-2023-46589", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "notes": [ { "category": "other", "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)", "title": "CWE-444" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-46589", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46589.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2023-46589" }, { "cve": "CVE-2023-48795", "cwe": { "id": "CWE-222", "name": "Truncation of Security-relevant Information" }, "notes": [ { "category": "other", "text": "Truncation of Security-relevant Information", "title": "CWE-222" } ], "product_status": { "known_affected": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-48795", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-48795.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-816761", "CSAFPID-816762", "CSAFPID-816763" ] } ], "title": "CVE-2023-48795" }, { "cve": "CVE-2023-49083", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-49083", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-49083.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2023-49083" }, { "cve": "CVE-2023-52428", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2023-52428", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-52428.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2023-52428" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0727", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0727.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-21139", "cwe": { "id": "CWE-285", "name": "Improper Authorization" }, "notes": [ { "category": "other", "text": "Improper Authorization", "title": "CWE-285" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2024-21139", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21139.json" } ], "title": "CVE-2024-21139" }, { "cve": "CVE-2024-25710", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "notes": [ { "category": "other", "text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)", "title": "CWE-835" } ], "product_status": { "known_affected": [ "CSAFPID-816763" ] }, "references": [ { "category": "self", "summary": "CVE-2024-25710", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-25710.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-816763" ] } ], "title": "CVE-2024-25710" } ] }
ncsc-2024-0433
Vulnerability from csaf_ncscnl
Published
2024-11-12 14:19
Modified
2024-11-12 14:19
Summary
Kwetsbaarheden verholpen in Siemens producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDCOM, SCALANCE, SIMATIC en SINEC.
Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Cross-Site-Scripting (XSS)
- Manipulatie van gegevens
- Omzeilen van een beveiligingsmaatregel
- Omzeilen van authenticatie
- (Remote) code execution (Administrator/Root rechten)
- (Remote) code execution (Gebruikersrechten)
- Toegang tot systeemgegevens
- Verhoogde gebruikersrechten
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
Oplossingen
Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-606
Unchecked Input for Loop Condition
CWE-1240
Use of a Cryptographic Primitive with a Risky Implementation
CWE-115
Misinterpretation of Input
CWE-1059
Insufficient Technical Documentation
CWE-1325
Improperly Controlled Sequential Memory Allocation
CWE-222
Truncation of Security-relevant Information
CWE-310
CWE-310
CWE-328
Use of Weak Hash
CWE-1284
Improper Validation of Specified Quantity in Input
CWE-213
Exposure of Sensitive Information Due to Incompatible Policies
CWE-1268
Policy Privileges are not Assigned Consistently Between Control and Data Agents
CWE-684
Incorrect Provision of Specified Functionality
CWE-772
Missing Release of Resource after Effective Lifetime
CWE-208
Observable Timing Discrepancy
CWE-201
Insertion of Sensitive Information Into Sent Data
CWE-834
Excessive Iteration
CWE-266
Incorrect Privilege Assignment
CWE-942
Permissive Cross-domain Policy with Untrusted Domains
CWE-271
Privilege Dropping / Lowering Errors
CWE-732
Incorrect Permission Assignment for Critical Resource
CWE-667
Improper Locking
CWE-440
Expected Behavior Violation
CWE-297
Improper Validation of Certificate with Host Mismatch
CWE-311
Missing Encryption of Sensitive Data
CWE-754
Improper Check for Unusual or Exceptional Conditions
CWE-617
Reachable Assertion
CWE-427
Uncontrolled Search Path Element
CWE-319
Cleartext Transmission of Sensitive Information
CWE-613
Insufficient Session Expiration
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-203
Observable Discrepancy
CWE-354
Improper Validation of Integrity Check Value
CWE-325
Missing Cryptographic Step
CWE-190
Integer Overflow or Wraparound
CWE-321
Use of Hard-coded Cryptographic Key
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-125
Out-of-bounds Read
CWE-404
Improper Resource Shutdown or Release
CWE-275
CWE-275
CWE-284
Improper Access Control
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-1333
Inefficient Regular Expression Complexity
CWE-416
Use After Free
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-401
Missing Release of Memory after Effective Lifetime
CWE-476
NULL Pointer Dereference
CWE-295
Improper Certificate Validation
CWE-757
Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-327
Use of a Broken or Risky Cryptographic Algorithm
CWE-436
Interpretation Conflict
CWE-400
Uncontrolled Resource Consumption
CWE-770
Allocation of Resources Without Limits or Throttling
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-502
Deserialization of Untrusted Data
CWE-918
Server-Side Request Forgery (SSRF)
CWE-863
Incorrect Authorization
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-787
Out-of-bounds Write
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE-122
Heap-based Buffer Overflow
CWE-121
Stack-based Buffer Overflow
CWE-789
Memory Allocation with Excessive Size Value
CWE-269
Improper Privilege Management
CWE-20
Improper Input Validation
CWE-287
Improper Authentication
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDCOM, SCALANCE, SIMATIC en SINEC.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service (DoS)\n- Cross-Site-Scripting (XSS)\n- Manipulatie van gegevens\n- Omzeilen van een beveiligingsmaatregel\n- Omzeilen van authenticatie\n- (Remote) code execution (Administrator/Root rechten)\n- (Remote) code execution (Gebruikersrechten)\n- Toegang tot systeemgegevens\n- Verhoogde gebruikersrechten\n\nDe kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.", "title": "Interpretaties" }, { "category": "description", "text": "Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico\u0027s zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "general", "text": "Use of a Cryptographic Primitive with a Risky Implementation", "title": "CWE-1240" }, { "category": "general", "text": "Misinterpretation of Input", "title": "CWE-115" }, { "category": "general", "text": "Insufficient Technical Documentation", "title": "CWE-1059" }, { "category": "general", "text": "Improperly Controlled Sequential Memory Allocation", "title": "CWE-1325" }, { "category": "general", "text": "Truncation of Security-relevant Information", "title": "CWE-222" }, { "category": "general", "text": "CWE-310", "title": "CWE-310" }, { "category": "general", "text": "Use of Weak Hash", "title": "CWE-328" }, { "category": "general", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" }, { "category": "general", "text": "Exposure of Sensitive Information Due to Incompatible Policies", "title": "CWE-213" }, { "category": "general", "text": "Policy Privileges are not Assigned Consistently Between Control and Data Agents", "title": "CWE-1268" }, { "category": "general", "text": "Incorrect Provision of Specified Functionality", "title": "CWE-684" }, { "category": "general", "text": "Missing Release of Resource after Effective Lifetime", "title": "CWE-772" }, { "category": "general", "text": "Observable Timing Discrepancy", "title": "CWE-208" }, { "category": "general", "text": "Insertion of Sensitive Information Into Sent Data", "title": "CWE-201" }, { "category": "general", "text": "Excessive Iteration", "title": "CWE-834" }, { "category": "general", "text": "Incorrect Privilege Assignment", "title": "CWE-266" }, { "category": "general", "text": "Permissive Cross-domain Policy with Untrusted Domains", "title": "CWE-942" }, { "category": "general", "text": "Privilege Dropping / Lowering Errors", "title": "CWE-271" }, { "category": "general", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" }, { "category": "general", "text": "Improper Locking", "title": "CWE-667" }, { "category": "general", "text": "Expected Behavior Violation", "title": "CWE-440" }, { "category": "general", "text": "Improper Validation of Certificate with Host Mismatch", "title": "CWE-297" }, { "category": "general", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" }, { "category": "general", "text": "Improper Check for Unusual or Exceptional Conditions", "title": "CWE-754" }, { "category": "general", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "general", "text": "Uncontrolled Search Path Element", "title": "CWE-427" }, { "category": "general", "text": "Cleartext Transmission of Sensitive Information", "title": "CWE-319" }, { "category": "general", "text": "Insufficient Session Expiration", "title": "CWE-613" }, { "category": "general", "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)", "title": "CWE-444" }, { "category": "general", "text": "Observable Discrepancy", "title": "CWE-203" }, { "category": "general", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" }, { "category": "general", "text": "Missing Cryptographic Step", "title": "CWE-325" }, { "category": "general", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "general", "text": "Use of Hard-coded Cryptographic Key", "title": "CWE-321" }, { "category": "general", "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)", "title": "CWE-362" }, { "category": "general", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "general", "text": "CWE-275", "title": "CWE-275" }, { "category": "general", "text": "Improper Access Control", "title": "CWE-284" }, { "category": "general", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" }, { "category": "general", "text": "Inefficient Regular Expression Complexity", "title": "CWE-1333" }, { "category": "general", "text": "Use After Free", "title": "CWE-416" }, { "category": "general", "text": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)", "title": "CWE-113" }, { "category": "general", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "general", "text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)", "title": "CWE-757" }, { "category": "general", "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)", "title": "CWE-94" }, { "category": "general", "text": "Use of a Broken or Risky Cryptographic Algorithm", "title": "CWE-327" }, { "category": "general", "text": "Interpretation Conflict", "title": "CWE-436" }, { "category": "general", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "general", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)", "title": "CWE-74" }, { "category": "general", "text": "Deserialization of Untrusted Data", "title": "CWE-502" }, { "category": "general", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" }, { "category": "general", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)", "title": "CWE-78" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "general", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "general", "text": "Memory Allocation with Excessive Size Value", "title": "CWE-789" }, { "category": "general", "text": "Improper Privilege Management", "title": "CWE-269" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "general", "text": "Improper Authentication", "title": "CWE-287" }, { "category": "general", "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "title": "CWE-79" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-000297.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-064257.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-230445.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-331112.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-351178.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-354112.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-454789.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-616032.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-654798.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-871035.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-914892.pdf" }, { "category": "external", "summary": "Reference - ncscclear", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-915275.pdf" } ], "title": "Kwetsbaarheden verholpen in Siemens producten", "tracking": { "current_release_date": "2024-11-12T14:19:20.051128Z", "id": "NCSC-2024-0433", "initial_release_date": "2024-11-12T14:19:20.051128Z", "revision_history": [ { "date": "2024-11-12T14:19:20.051128Z", "number": "0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "mendix_runtime_v10.12", "product": { "name": "mendix_runtime_v10.12", "product_id": "CSAFPID-1637623", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:mendix_runtime_v10.12:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "mendix_runtime_v10.6", "product": { "name": "mendix_runtime_v10.6", "product_id": "CSAFPID-1637624", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:mendix_runtime_v10.6:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "mendix_runtime_v10", "product": { "name": "mendix_runtime_v10", "product_id": "CSAFPID-1637622", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:mendix_runtime_v10:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "mendix_runtime_v8", "product": { "name": "mendix_runtime_v8", "product_id": "CSAFPID-1637625", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:mendix_runtime_v8:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "mendix_runtime_v9", "product": { "name": "mendix_runtime_v9", "product_id": "CSAFPID-1637626", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:mendix_runtime_v9:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ozw672", "product": { "name": "ozw672", "product_id": "CSAFPID-1712832", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:ozw672:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ozw772", "product": { "name": "ozw772", "product_id": "CSAFPID-1712833", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:ozw772:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "pp_telecontrol_server_basic_1000_to_5000_v3.1", "product": { "name": "pp_telecontrol_server_basic_1000_to_5000_v3.1", "product_id": "CSAFPID-1712834", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:pp_telecontrol_server_basic_1000_to_5000_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "pp_telecontrol_server_basic_256_to_1000_v3.1", "product": { "name": "pp_telecontrol_server_basic_256_to_1000_v3.1", "product_id": "CSAFPID-1712835", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:pp_telecontrol_server_basic_256_to_1000_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "pp_telecontrol_server_basic_32_to_64_v3.1", "product": { "name": "pp_telecontrol_server_basic_32_to_64_v3.1", "product_id": "CSAFPID-1712836", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:pp_telecontrol_server_basic_32_to_64_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "pp_telecontrol_server_basic_64_to_256_v3.1", "product": { "name": "pp_telecontrol_server_basic_64_to_256_v3.1", "product_id": "CSAFPID-1712837", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:pp_telecontrol_server_basic_64_to_256_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "pp_telecontrol_server_basic_8_to_32_v3.1", "product": { "name": "pp_telecontrol_server_basic_8_to_32_v3.1", "product_id": "CSAFPID-1712838", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:pp_telecontrol_server_basic_8_to_32_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ruggedcom_ape1808", "product": { "name": "ruggedcom_ape1808", "product_id": "CSAFPID-1615259", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:ruggedcom_ape1808:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ruggedcom_rm1224_lte_4g__eu", "product": { "name": "ruggedcom_rm1224_lte_4g__eu", "product_id": "CSAFPID-1702670", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:ruggedcom_rm1224_lte_4g__eu:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ruggedcom_rm1224_lte_4g__nam", "product": { "name": "ruggedcom_rm1224_lte_4g__nam", "product_id": "CSAFPID-1702671", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:ruggedcom_rm1224_lte_4g__nam:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "s7-pct", "product": { "name": "s7-pct", "product_id": "CSAFPID-1637909", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:s7-pct:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "s7-pct", "product": { "name": "s7-pct", "product_id": "CSAFPID-1470060", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:s7-pct:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "s7_port_configuration_tool", "product": { "name": "s7_port_configuration_tool", "product_id": "CSAFPID-1472074", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:s7_port_configuration_tool:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m804pb", "product": { "name": "scalance_m804pb", "product_id": "CSAFPID-1702672", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m804pb:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m812-1_adsl-router", "product": { "name": "scalance_m812-1_adsl-router", "product_id": "CSAFPID-1712749", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m812-1_adsl-router:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m816-1_adsl-router", "product": { "name": "scalance_m816-1_adsl-router", "product_id": "CSAFPID-1712750", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m816-1_adsl-router:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m826-2_shdsl-router", "product": { "name": "scalance_m826-2_shdsl-router", "product_id": "CSAFPID-1702677", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m826-2_shdsl-router:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m874-2", "product": { "name": "scalance_m874-2", "product_id": "CSAFPID-1702678", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m874-2:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m874-3", "product": { "name": "scalance_m874-3", "product_id": "CSAFPID-1702679", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m874-3:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m874-3_3g-router__cn_", "product": { "name": "scalance_m874-3_3g-router__cn_", "product_id": "CSAFPID-1712751", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m874-3_3g-router__cn_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m876-3", "product": { "name": "scalance_m876-3", "product_id": "CSAFPID-1712752", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m876-3:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m876-3__rok_", "product": { "name": "scalance_m876-3__rok_", "product_id": "CSAFPID-1702681", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m876-3__rok_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m876-4", "product": { "name": "scalance_m876-4", "product_id": "CSAFPID-1712753", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m876-4:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m876-4__eu_", "product": { "name": "scalance_m876-4__eu_", "product_id": "CSAFPID-1702682", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m876-4__eu_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_m876-4__nam_", "product": { "name": "scalance_m876-4__nam_", "product_id": "CSAFPID-1702683", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_m876-4__nam_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum853-1__a1_", "product": { "name": "scalance_mum853-1__a1_", "product_id": "CSAFPID-1712754", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum853-1__a1_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum853-1__b1_", "product": { "name": "scalance_mum853-1__b1_", "product_id": "CSAFPID-1712755", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum853-1__b1_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum853-1__eu_", "product": { "name": "scalance_mum853-1__eu_", "product_id": "CSAFPID-1712756", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum853-1__eu_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum856-1__a1_", "product": { "name": "scalance_mum856-1__a1_", "product_id": "CSAFPID-1712757", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum856-1__a1_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum856-1__b1_", "product": { "name": "scalance_mum856-1__b1_", "product_id": "CSAFPID-1712758", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum856-1__b1_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum856-1__cn_", "product": { "name": "scalance_mum856-1__cn_", "product_id": "CSAFPID-1712759", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum856-1__cn_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum856-1__eu_", "product": { "name": "scalance_mum856-1__eu_", "product_id": "CSAFPID-1702684", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum856-1__eu_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_mum856-1__row_", "product": { "name": "scalance_mum856-1__row_", "product_id": "CSAFPID-1702685", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_mum856-1__row_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_s615_eec_lan-router", "product": { "name": "scalance_s615_eec_lan-router", "product_id": "CSAFPID-1712760", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_s615_eec_lan-router:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_s615_lan-router", "product": { "name": "scalance_s615_lan-router", "product_id": "CSAFPID-1712761", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_s615_lan-router:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xch328__6gk5328-4ts01-2ec2_", "product": { "name": "scalance_xch328__6gk5328-4ts01-2ec2_", "product_id": "CSAFPID-1613504", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xch328__6gk5328-4ts01-2ec2_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xcm324__6gk5324-8ts01-2ac2_", "product": { "name": "scalance_xcm324__6gk5324-8ts01-2ac2_", "product_id": "CSAFPID-1613505", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xcm324__6gk5324-8ts01-2ac2_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xcm328__6gk5328-4ts01-2ac2_", "product": { "name": "scalance_xcm328__6gk5328-4ts01-2ac2_", "product_id": "CSAFPID-1613506", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xcm328__6gk5328-4ts01-2ac2_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xcm332__6gk5332-0ga01-2ac2_", "product": { "name": "scalance_xcm332__6gk5332-0ga01-2ac2_", "product_id": "CSAFPID-1613507", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xcm332__6gk5332-0ga01-2ac2_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrh334__24_v_dc__8xfo__cc___6gk5334-2ts01-2er3_", "product": { "name": "scalance_xrh334__24_v_dc__8xfo__cc___6gk5334-2ts01-2er3_", "product_id": "CSAFPID-1613592", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrh334__24_v_dc__8xfo__cc___6gk5334-2ts01-2er3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__230_v_ac__12xfo___6gk5334-3ts01-3ar3_", "product": { "name": "scalance_xrm334__230_v_ac__12xfo___6gk5334-3ts01-3ar3_", "product_id": "CSAFPID-1613593", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__230_v_ac__12xfo___6gk5334-3ts01-3ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__230_v_ac__8xfo___6gk5334-2ts01-3ar3_", "product": { "name": "scalance_xrm334__230_v_ac__8xfo___6gk5334-2ts01-3ar3_", "product_id": "CSAFPID-1613594", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__230_v_ac__8xfo___6gk5334-2ts01-3ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__24_v_dc__12xfo___6gk5334-3ts01-2ar3_", "product": { "name": "scalance_xrm334__24_v_dc__12xfo___6gk5334-3ts01-2ar3_", "product_id": "CSAFPID-1613595", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__24_v_dc__12xfo___6gk5334-3ts01-2ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__24_v_dc__8xfo___6gk5334-2ts01-2ar3_", "product": { "name": "scalance_xrm334__24_v_dc__8xfo___6gk5334-2ts01-2ar3_", "product_id": "CSAFPID-1613596", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__24_v_dc__8xfo___6gk5334-2ts01-2ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__2x230_v_ac__12xfo___6gk5334-3ts01-4ar3_", "product": { "name": "scalance_xrm334__2x230_v_ac__12xfo___6gk5334-3ts01-4ar3_", "product_id": "CSAFPID-1613597", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__2x230_v_ac__12xfo___6gk5334-3ts01-4ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "scalance_xrm334__2x230_v_ac__8xfo___6gk5334-2ts01-4ar3_", "product": { "name": "scalance_xrm334__2x230_v_ac__8xfo___6gk5334-2ts01-4ar3_", "product_id": "CSAFPID-1613598", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:scalance_xrm334__2x230_v_ac__8xfo___6gk5334-2ts01-4ar3_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "security_configuration_tool", "product": { "name": "security_configuration_tool", "product_id": "CSAFPID-1625339", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:security_configuration_tool:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "security_configuration_tool__sct_", "product": { "name": "security_configuration_tool__sct_", "product_id": "CSAFPID-1637910", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:security_configuration_tool__sct_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "security_configuration_tool__sct_", "product": { "name": "security_configuration_tool__sct_", "product_id": "CSAFPID-1470061", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:security_configuration_tool__sct_:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_automation_tool", "product": { "name": "simatic_automation_tool", "product_id": "CSAFPID-1472069", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_automation_tool:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_automation_tool", "product": { "name": "simatic_automation_tool", "product_id": "CSAFPID-1637559", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_automation_tool:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_automation_tool", "product": { "name": "simatic_automation_tool", "product_id": "CSAFPID-1470062", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_automation_tool:all_versions:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_batch_v9.1", "product": { "name": "simatic_batch_v9.1", "product_id": "CSAFPID-1625340", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_batch_v9.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_batch_v9.1", "product": { "name": "simatic_batch_v9.1", "product_id": "CSAFPID-1470063", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_batch_v9.1:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_cp_1543-1_v4.0", "product": { "name": "simatic_cp_1543-1_v4.0", "product_id": "CSAFPID-1712748", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_cp_1543-1_v4.0:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_mv500_family", "product": { "name": "simatic_mv500_family", "product_id": "CSAFPID-1703073", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_mv500_family:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc-software", "product": { "name": "simatic_net_pc-software", "product_id": "CSAFPID-1625344", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc-software:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software", "product": { "name": "simatic_net_pc_software", "product_id": "CSAFPID-1470064", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v16", "product": { "name": "simatic_net_pc_software_v16", "product_id": "CSAFPID-1637849", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v16", "product": { "name": "simatic_net_pc_software_v16", "product_id": "CSAFPID-1457906", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v16:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v17", "product": { "name": "simatic_net_pc_software_v17", "product_id": "CSAFPID-1637850", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v17", "product": { "name": "simatic_net_pc_software_v17", "product_id": "CSAFPID-1457907", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v17:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v18", "product": { "name": "simatic_net_pc_software_v18", "product_id": "CSAFPID-1637851", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v18", "product": { "name": "simatic_net_pc_software_v18", "product_id": "CSAFPID-1457908", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v18:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v19", "product": { "name": "simatic_net_pc_software_v19", "product_id": "CSAFPID-1637911", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v19:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software_v19", "product": { "name": "simatic_net_pc_software_v19", "product_id": "CSAFPID-1637560", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_net_pc_software_v19:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pcs", "product": { "name": "simatic_pcs", "product_id": "CSAFPID-838530", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_pcs:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pcs_7_v9.1", "product": { "name": "simatic_pcs_7_v9.1", "product_id": "CSAFPID-1501190", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_pcs_7_v9.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pcs_7_v9.1", "product": { "name": "simatic_pcs_7_v9.1", "product_id": "CSAFPID-1457909", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_pcs_7_v9.1:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pdm_v9.2", "product": { "name": "simatic_pdm_v9.2", "product_id": "CSAFPID-1637912", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_pdm_v9.2:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pdm_v9.2", "product": { "name": "simatic_pdm_v9.2", "product_id": "CSAFPID-1470065", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_pdm_v9.2:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_route_control_", "product": { "name": "simatic_route_control_", "product_id": "CSAFPID-1625337", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_route_control_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_route_control_v9.1", "product": { "name": "simatic_route_control_v9.1", "product_id": "CSAFPID-1637856", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_route_control_v9.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_route_control_v9.1", "product": { "name": "simatic_route_control_v9.1", "product_id": "CSAFPID-1470066", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_route_control_v9.1:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager", "product": { "name": "simatic_rtls_locating_manager", "product_id": "CSAFPID-1691398", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager:3.0.1.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-0da00_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-0da00_", "product_id": "CSAFPID-1703180", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-0da00_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-0da10_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-0da10_", "product_id": "CSAFPID-1703181", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-0da10_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-0da20_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-0da20_", "product_id": "CSAFPID-1703182", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-0da20_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-0da30_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-0da30_", "product_id": "CSAFPID-1703183", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-0da30_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-1ea10_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-1ea10_", "product_id": "CSAFPID-1703184", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-1ea10_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-1ea20_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-1ea20_", "product_id": "CSAFPID-1703185", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-1ea20_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_rtls_locating_manager__6gt2780-1ea30_", "product": { "name": "simatic_rtls_locating_manager__6gt2780-1ea30_", "product_id": "CSAFPID-1703186", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_rtls_locating_manager__6gt2780-1ea30_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ab0_", "product": { "name": "simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ab0_", "product_id": "CSAFPID-1615260", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ab0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ac0_", "product": { "name": "simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ac0_", "product_id": "CSAFPID-1615261", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-1500_cpu_1518-4_pn_dp_mfp__6es7518-4ax00-1ac0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ab0_", "product": { "name": "simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ab0_", "product_id": "CSAFPID-1615262", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ab0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ac0_", "product": { "name": "simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ac0_", "product_id": "CSAFPID-1615263", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-1500_cpu_1518f-4_pn_dp_mfp__6es7518-4fx00-1ac0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_tm_mfp_-_gnu_linux_subsystem", "product": { "name": "simatic_s7-1500_tm_mfp_-_gnu_linux_subsystem", "product_id": "CSAFPID-1703131", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-1500_tm_mfp_-_gnu_linux_subsystem:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-plcsim_v16", "product": { "name": "simatic_s7-plcsim_v16", "product_id": "CSAFPID-1712825", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-plcsim_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-plcsim_v17", "product": { "name": "simatic_s7-plcsim_v17", "product_id": "CSAFPID-1712826", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_s7-plcsim_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_safety_v16", "product": { "name": "simatic_step_7_safety_v16", "product_id": "CSAFPID-1703190", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_safety_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_safety_v17", "product": { "name": "simatic_step_7_safety_v17", "product_id": "CSAFPID-1703191", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_safety_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_safety_v18", "product": { "name": "simatic_step_7_safety_v18", "product_id": "CSAFPID-1500667", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_safety_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_v16", "product": { "name": "simatic_step_7_v16", "product_id": "CSAFPID-1703187", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_v17", "product": { "name": "simatic_step_7_v17", "product_id": "CSAFPID-1703188", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_v18", "product": { "name": "simatic_step_7_v18", "product_id": "CSAFPID-1703189", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_v5", "product": { "name": "simatic_step_7_v5", "product_id": "CSAFPID-1637913", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_v5:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7_v5", "product": { "name": "simatic_step_7_v5", "product_id": "CSAFPID-1457855", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_step_7_v5:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc", "product": { "name": "simatic_wincc", "product_id": "CSAFPID-75563", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc", "product": { "name": "simatic_wincc", "product_id": "CSAFPID-1550826", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc:8.0:update_5:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.17", "product": { "name": "simatic_wincc_oa_v3.17", "product_id": "CSAFPID-1637914", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.17", "product": { "name": "simatic_wincc_oa_v3.17", "product_id": "CSAFPID-1457956", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.17:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.18", "product": { "name": "simatic_wincc_oa_v3.18", "product_id": "CSAFPID-1637915", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.18", "product": { "name": "simatic_wincc_oa_v3.18", "product_id": "CSAFPID-1457957", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.18:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.19", "product": { "name": "simatic_wincc_oa_v3.19", "product_id": "CSAFPID-1637916", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.19:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa_v3.19", "product": { "name": "simatic_wincc_oa_v3.19", "product_id": "CSAFPID-1457958", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_oa_v3.19:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_advanced", "product": { "name": "simatic_wincc_runtime_advanced", "product_id": "CSAFPID-766087", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_advanced", "product": { "name": "simatic_wincc_runtime_advanced", "product_id": "CSAFPID-1470067", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional", "product": { "name": "simatic_wincc_runtime_professional", "product_id": "CSAFPID-165765", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v16", "product": { "name": "simatic_wincc_runtime_professional_v16", "product_id": "CSAFPID-1637917", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v16", "product": { "name": "simatic_wincc_runtime_professional_v16", "product_id": "CSAFPID-1457960", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v16:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v17", "product": { "name": "simatic_wincc_runtime_professional_v17", "product_id": "CSAFPID-1637887", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v17", "product": { "name": "simatic_wincc_runtime_professional_v17", "product_id": "CSAFPID-1457961", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v17:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v18", "product": { "name": "simatic_wincc_runtime_professional_v18", "product_id": "CSAFPID-1501188", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v18", "product": { "name": "simatic_wincc_runtime_professional_v18", "product_id": "CSAFPID-1457962", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v18:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v19", "product": { "name": "simatic_wincc_runtime_professional_v19", "product_id": "CSAFPID-1501192", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v19:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional_v19", "product": { "name": "simatic_wincc_runtime_professional_v19", "product_id": "CSAFPID-1457963", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_runtime_professional_v19:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_pc_runtime", "product": { "name": "simatic_wincc_unified_pc_runtime", "product_id": "CSAFPID-744621", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_pc_runtime", "product": { "name": "simatic_wincc_unified_pc_runtime", "product_id": "CSAFPID-1470068", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_pc_runtime_v18", "product": { "name": "simatic_wincc_unified_pc_runtime_v18", "product_id": "CSAFPID-1637854", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_pc_runtime_v18", "product": { "name": "simatic_wincc_unified_pc_runtime_v18", "product_id": "CSAFPID-1637561", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_pc_runtime_v18:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_v16", "product": { "name": "simatic_wincc_unified_v16", "product_id": "CSAFPID-1703192", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_v17", "product": { "name": "simatic_wincc_unified_v17", "product_id": "CSAFPID-1703193", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_unified_v18", "product": { "name": "simatic_wincc_unified_v18", "product_id": "CSAFPID-1703194", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_unified_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v16", "product": { "name": "simatic_wincc_v16", "product_id": "CSAFPID-1702687", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v17", "product": { "name": "simatic_wincc_v17", "product_id": "CSAFPID-1702688", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v18", "product": { "name": "simatic_wincc_v18", "product_id": "CSAFPID-1703195", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v7.4", "product": { "name": "simatic_wincc_v7.4", "product_id": "CSAFPID-1501193", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v7.4:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v7.4", "product": { "name": "simatic_wincc_v7.4", "product_id": "CSAFPID-1457965", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v7.4:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v7.5", "product": { "name": "simatic_wincc_v7.5", "product_id": "CSAFPID-1501191", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v7.5:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v7.5", "product": { "name": "simatic_wincc_v7.5", "product_id": "CSAFPID-1457966", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v7.5:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v8.0", "product": { "name": "simatic_wincc_v8.0", "product_id": "CSAFPID-1501189", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v8.0:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_v8.0", "product": { "name": "simatic_wincc_v8.0", "product_id": "CSAFPID-1457967", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simatic_wincc_v8.0:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simocode_es_v16", "product": { "name": "simocode_es_v16", "product_id": "CSAFPID-1702694", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simocode_es_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simocode_es_v17", "product": { "name": "simocode_es_v17", "product_id": "CSAFPID-1703196", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simocode_es_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simocode_es_v18", "product": { "name": "simocode_es_v18", "product_id": "CSAFPID-1703197", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simocode_es_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simotion_scout_tia_v5.4_sp1", "product": { "name": "simotion_scout_tia_v5.4_sp1", "product_id": "CSAFPID-1703198", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simotion_scout_tia_v5.4_sp1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simotion_scout_tia_v5.4_sp3", "product": { "name": "simotion_scout_tia_v5.4_sp3", "product_id": "CSAFPID-1703199", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simotion_scout_tia_v5.4_sp3:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simotion_scout_tia_v5.5_sp1", "product": { "name": "simotion_scout_tia_v5.5_sp1", "product_id": "CSAFPID-1703200", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:simotion_scout_tia_v5.5_sp1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinamics_startdrive", "product": { "name": "sinamics_startdrive", "product_id": "CSAFPID-1625341", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinamics_startdrive:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinamics_startdrive", "product": { "name": "sinamics_startdrive", "product_id": "CSAFPID-1470069", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinamics_startdrive:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinamics_startdrive_v16", "product": { "name": "sinamics_startdrive_v16", "product_id": "CSAFPID-1703201", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinamics_startdrive_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinamics_startdrive_v17", "product": { "name": "sinamics_startdrive_v17", "product_id": "CSAFPID-1703202", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinamics_startdrive_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinamics_startdrive_v18", "product": { "name": "sinamics_startdrive_v18", "product_id": "CSAFPID-1703203", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinamics_startdrive_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_ins", "product": { "name": "sinec_ins", "product_id": "CSAFPID-746925", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_network_management_system", "product": { "name": "sinec_network_management_system", "product_id": "CSAFPID-1691397", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_network_management_system:2.0:sp1:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_nms", "product": { "name": "sinec_nms", "product_id": "CSAFPID-309392", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_nms", "product": { "name": "sinec_nms", "product_id": "CSAFPID-1458012", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_nms:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_nms", "product": { "name": "sinec_nms", "product_id": "CSAFPID-1693062", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_nms:2.0:sp2:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinec_nms", "product": { "name": "sinec_nms", "product_id": "CSAFPID-1691473", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinec_nms:3.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinema_remote_connect_client", "product": { "name": "sinema_remote_connect_client", "product_id": "CSAFPID-894438", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinema_remote_connect_client:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinumerik_one_virtual", "product": { "name": "sinumerik_one_virtual", "product_id": "CSAFPID-1625342", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinumerik_one_virtual:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinumerik_one_virtual", "product": { "name": "sinumerik_one_virtual", "product_id": "CSAFPID-1470070", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinumerik_one_virtual:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinumerik_plc_programming_tool", "product": { "name": "sinumerik_plc_programming_tool", "product_id": "CSAFPID-1625338", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinumerik_plc_programming_tool:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sinumerik_plc_programming_tool", "product": { "name": "sinumerik_plc_programming_tool", "product_id": "CSAFPID-1470071", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sinumerik_plc_programming_tool:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "siplus_s7-1500_cpu_1518-4_pn_dp_mfp__6ag1518-4ax00-4ac0_", "product": { "name": "siplus_s7-1500_cpu_1518-4_pn_dp_mfp__6ag1518-4ax00-4ac0_", "product_id": "CSAFPID-1615264", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:siplus_s7-1500_cpu_1518-4_pn_dp_mfp__6ag1518-4ax00-4ac0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "siport", "product": { "name": "siport", "product_id": "CSAFPID-1712847", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:siport:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sirius_safety_es_v17", "product": { "name": "sirius_safety_es_v17", "product_id": "CSAFPID-1703204", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sirius_safety_es_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sirius_safety_es_v18", "product": { "name": "sirius_safety_es_v18", "product_id": "CSAFPID-1703205", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sirius_safety_es_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sirius_soft_starter_es_v17", "product": { "name": "sirius_soft_starter_es_v17", "product_id": "CSAFPID-1703206", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sirius_soft_starter_es_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "sirius_soft_starter_es_v18", "product": { "name": "sirius_soft_starter_es_v18", "product_id": "CSAFPID-1703207", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:sirius_soft_starter_es_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "solid_edge_se2024", "product": { "name": "solid_edge_se2024", "product_id": "CSAFPID-1680248", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:solid_edge_se2024:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "spectrum_power_7", "product": { "name": "spectrum_power_7", "product_id": "CSAFPID-524281", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "st7_scadaconnect", "product": { "name": "st7_scadaconnect", "product_id": "CSAFPID-1691077", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:st7_scadaconnect:1.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "st7_scadaconnect__6nh7997-5da10-0aa0_", "product": { "name": "st7_scadaconnect__6nh7997-5da10-0aa0_", "product_id": "CSAFPID-1703173", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:st7_scadaconnect__6nh7997-5da10-0aa0_:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic", "product": { "name": "telecontrol_server_basic", "product_id": "CSAFPID-1691051", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic:3.1.2:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_1000_v3.1", "product": { "name": "telecontrol_server_basic_1000_v3.1", "product_id": "CSAFPID-1712839", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_1000_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_256_v3.1", "product": { "name": "telecontrol_server_basic_256_v3.1", "product_id": "CSAFPID-1712840", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_256_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_32_v3.1", "product": { "name": "telecontrol_server_basic_32_v3.1", "product_id": "CSAFPID-1712841", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_32_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_5000_v3.1", "product": { "name": "telecontrol_server_basic_5000_v3.1", "product_id": "CSAFPID-1712842", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_5000_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_64_v3.1", "product": { "name": "telecontrol_server_basic_64_v3.1", "product_id": "CSAFPID-1712843", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_64_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_8_v3.1", "product": { "name": "telecontrol_server_basic_8_v3.1", "product_id": "CSAFPID-1712844", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_8_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_serv_upgr", "product": { "name": "telecontrol_server_basic_serv_upgr", "product_id": "CSAFPID-1712845", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_serv_upgr:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_upgr_v3.1", "product": { "name": "telecontrol_server_basic_upgr_v3.1", "product_id": "CSAFPID-1712846", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_upgr_v3.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "telecontrol_server_basic_v3", "product": { "name": "telecontrol_server_basic_v3", "product_id": "CSAFPID-1637855", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:telecontrol_server_basic_v3:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "tia_portal_cloud_connector", "product": { "name": "tia_portal_cloud_connector", "product_id": "CSAFPID-1625345", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:tia_portal_cloud_connector:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "tia_portal_cloud_connector", "product": { "name": "tia_portal_cloud_connector", "product_id": "CSAFPID-1470072", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:tia_portal_cloud_connector:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "tia_portal_cloud_v16", "product": { "name": "tia_portal_cloud_v16", "product_id": "CSAFPID-1712827", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:tia_portal_cloud_v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "tia_portal_cloud_v17", "product": { "name": "tia_portal_cloud_v17", "product_id": "CSAFPID-1712828", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:tia_portal_cloud_v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "tia_portal_cloud_v18", "product": { "name": "tia_portal_cloud_v18", "product_id": "CSAFPID-1712829", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:tia_portal_cloud_v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal", "product": { "name": "totally_integrated_automation_portal", "product_id": "CSAFPID-74798", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal:15.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal", "product": { "name": "totally_integrated_automation_portal", "product_id": "CSAFPID-75533", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal:16:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal", "product": { "name": "totally_integrated_automation_portal", "product_id": "CSAFPID-74794", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal:17:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal", "product": { "name": "totally_integrated_automation_portal", "product_id": "CSAFPID-74792", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal:18:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal", "product": { "name": "totally_integrated_automation_portal", "product_id": "CSAFPID-1472073", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal:19:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v15.1", "product": { "name": "totally_integrated_automation_portal__tia_portal__v15.1", "product_id": "CSAFPID-1615531", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v15.1:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v15.1", "product": { "name": "totally_integrated_automation_portal__tia_portal__v15.1", "product_id": "CSAFPID-1458014", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v15.1:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v16", "product": { "name": "totally_integrated_automation_portal__tia_portal__v16", "product_id": "CSAFPID-1615256", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v16:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v16", "product": { "name": "totally_integrated_automation_portal__tia_portal__v16", "product_id": "CSAFPID-1458015", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v16:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v17", "product": { "name": "totally_integrated_automation_portal__tia_portal__v17", "product_id": "CSAFPID-1615257", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v17:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v17", "product": { "name": "totally_integrated_automation_portal__tia_portal__v17", "product_id": "CSAFPID-1458016", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v17:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v18", "product": { "name": "totally_integrated_automation_portal__tia_portal__v18", "product_id": "CSAFPID-1615258", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v18:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v18", "product": { "name": "totally_integrated_automation_portal__tia_portal__v18", "product_id": "CSAFPID-1458017", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v18:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v19", "product": { "name": "totally_integrated_automation_portal__tia_portal__v19", "product_id": "CSAFPID-1637618", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v19:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "totally_integrated_automation_portal__tia_portal__v19", "product": { "name": "totally_integrated_automation_portal__tia_portal__v19", "product_id": "CSAFPID-1470073", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:totally_integrated_automation_portal__tia_portal__v19:0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "wincc", "product": { "name": "wincc", "product_id": "CSAFPID-1625343", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:wincc:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "wincc_tia_portal", "product": { "name": "wincc_tia_portal", "product_id": "CSAFPID-465667", "product_identification_helper": { "cpe": "cpe:2.3:a:siemens:wincc_tia_portal:11.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500", "product": { "name": "simatic_s7-1500", "product_id": "CSAFPID-715650", "product_identification_helper": { "cpe": "cpe:2.3:h:siemens:simatic_s7-1500:-:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7", "product": { "name": "simatic_s7", "product_id": "CSAFPID-1613729", "product_identification_helper": { "cpe": "cpe:2.3:h:siemens:simatic_s7:1500:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "cpu_1518f-4_pn\\/dp_mfp_firmware", "product": { "name": "cpu_1518f-4_pn\\/dp_mfp_firmware", "product_id": "CSAFPID-1691401", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:cpu_1518f-4_pn\\/dp_mfp_firmware:3.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "cpu_1518f-4_pn__dp_mfp_firmware", "product": { "name": "cpu_1518f-4_pn__dp_mfp_firmware", "product_id": "CSAFPID-715649", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:cpu_1518f-4_pn__dp_mfp_firmware:3.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ruggedcom_ape1808", "product": { "name": "ruggedcom_ape1808", "product_id": "CSAFPID-880853", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:ruggedcom_ape1808:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "ruggedcom_ape1808_firmware", "product": { "name": "ruggedcom_ape1808_firmware", "product_id": "CSAFPID-542833", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "security_configuration_tool", "product": { "name": "security_configuration_tool", "product_id": "CSAFPID-540747", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:security_configuration_tool:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "siemens_simatic_s7-1500_tm_mfp", "product": { "name": "siemens_simatic_s7-1500_tm_mfp", "product_id": "CSAFPID-1693048", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:siemens_simatic_s7-1500_tm_mfp:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "siemens_simatic_s7_-1500_tm_mfp", "product": { "name": "siemens_simatic_s7_-1500_tm_mfp", "product_id": "CSAFPID-907212", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:siemens_simatic_s7_-1500_tm_mfp:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "siemens_telecontrol_server_basic", "product": { "name": "siemens_telecontrol_server_basic", "product_id": "CSAFPID-907211", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:siemens_telecontrol_server_basic:3:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_mv500_firmware", "product": { "name": "simatic_mv500_firmware", "product_id": "CSAFPID-1692274", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_mv500_firmware:3.3.5:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_net_pc_software", "product": { "name": "simatic_net_pc_software", "product_id": "CSAFPID-1472070", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_net_pc_software:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_pcs_7", "product": { "name": "simatic_pcs_7", "product_id": "CSAFPID-1472067", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_pcs_7:9.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp_firmware", "product": { "name": "simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp_firmware", "product_id": "CSAFPID-1689769", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp_firmware:3.1.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_cpu_1518f-4_pn__dp_mfp_firmware", "product": { "name": "simatic_s7-1500_cpu_1518f-4_pn__dp_mfp_firmware", "product_id": "CSAFPID-766929", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn__dp_mfp_firmware:3.1.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_tm_mfp_firmware", "product": { "name": "simatic_s7-1500_tm_mfp_firmware", "product_id": "CSAFPID-717239", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:1.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_s7-1500_tm_mfp_firmware", "product": { "name": "simatic_s7-1500_tm_mfp_firmware", "product_id": "CSAFPID-905869", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:1.1:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_step_7", "product": { "name": "simatic_step_7", "product_id": "CSAFPID-879652", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_step_7:5:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc", "product": { "name": "simatic_wincc", "product_id": "CSAFPID-1472068", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc:7.4:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc", "product": { "name": "simatic_wincc", "product_id": "CSAFPID-1472066", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc:7.5:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc", "product": { "name": "simatic_wincc", "product_id": "CSAFPID-1472072", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc:8.0:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_oa", "product": { "name": "simatic_wincc_oa", "product_id": "CSAFPID-1472071", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_oa:3.17:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_advanced", "product": { "name": "simatic_wincc_runtime_advanced", "product_id": "CSAFPID-886176", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional", "product": { "name": "simatic_wincc_runtime_professional", "product_id": "CSAFPID-165976", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_runtime_professional:16:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional", "product": { "name": "simatic_wincc_runtime_professional", "product_id": "CSAFPID-165974", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_runtime_professional:17:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional", "product": { "name": "simatic_wincc_runtime_professional", "product_id": "CSAFPID-855582", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_runtime_professional:18:*:*:*:*:*:*:*" } } }, { "category": "product_name", "name": "simatic_wincc_runtime_professional", "product": { "name": "simatic_wincc_runtime_professional", "product_id": "CSAFPID-855580", "product_identification_helper": { "cpe": "cpe:2.3:o:siemens:simatic_wincc_runtime_professional:19:*:*:*:*:*:*:*" } } } ], "category": "vendor", "name": "siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3506", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" } ], "references": [ { "category": "self", "summary": "CVE-2021-3506", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2021/CVE-2021-3506.json" } ], "title": "CVE-2021-3506" }, { "cve": "CVE-2023-2975", "cwe": { "id": "CWE-287", "name": "Improper Authentication" }, "notes": [ { "category": "other", "text": "Improper Authentication", "title": "CWE-287" }, { "category": "other", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" }, { "category": "other", "text": "Use of a Broken or Risky Cryptographic Algorithm", "title": "CWE-327" } ], "product_status": { "known_affected": [ "CSAFPID-1703073", "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-2975", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-2975.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1703073", "CSAFPID-309392" ] } ], "title": "CVE-2023-2975" }, { "cve": "CVE-2023-3341", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "references": [ { "category": "self", "summary": "CVE-2023-3341", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3341.json" } ], "title": "CVE-2023-3341" }, { "cve": "CVE-2023-3446", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Inefficient Regular Expression Complexity", "title": "CWE-1333" }, { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "other", "text": "Use of a Cryptographic Primitive with a Risky Implementation", "title": "CWE-1240" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703073", "CSAFPID-309392", "CSAFPID-1637855", "CSAFPID-1703131", "CSAFPID-1703173" ] }, "references": [ { "category": "self", "summary": "CVE-2023-3446", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3446.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703073", "CSAFPID-309392", "CSAFPID-1637855", "CSAFPID-1703131", "CSAFPID-1703173" ] } ], "title": "CVE-2023-3446" }, { "cve": "CVE-2023-3817", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "other", "text": "Excessive Iteration", "title": "CWE-834" }, { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "other", "text": "Use of a Cryptographic Primitive with a Risky Implementation", "title": "CWE-1240" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1613729", "CSAFPID-1703073", "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-3817", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3817.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1613729", "CSAFPID-1703073", "CSAFPID-309392" ] } ], "title": "CVE-2023-3817" }, { "cve": "CVE-2023-4236", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" } ], "references": [ { "category": "self", "summary": "CVE-2023-4236", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4236.json" } ], "title": "CVE-2023-4236" }, { "cve": "CVE-2023-4408", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "references": [ { "category": "self", "summary": "CVE-2023-4408", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4408.json" } ], "title": "CVE-2023-4408" }, { "cve": "CVE-2023-4807", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "other", "text": "Expected Behavior Violation", "title": "CWE-440" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1637855", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] }, "references": [ { "category": "self", "summary": "CVE-2023-4807", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4807.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1637855", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] } ], "title": "CVE-2023-4807" }, { "cve": "CVE-2023-5363", "cwe": { "id": "CWE-325", "name": "Missing Cryptographic Step" }, "notes": [ { "category": "other", "text": "Missing Cryptographic Step", "title": "CWE-325" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "other", "text": "Incorrect Provision of Specified Functionality", "title": "CWE-684" } ], "product_status": { "known_affected": [ "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] }, "references": [ { "category": "self", "summary": "CVE-2023-5363", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5363.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] } ], "title": "CVE-2023-5363" }, { "cve": "CVE-2023-5517", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" } ], "references": [ { "category": "self", "summary": "CVE-2023-5517", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5517.json" } ], "title": "CVE-2023-5517" }, { "cve": "CVE-2023-5678", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "other", "text": "Improper Check for Unusual or Exceptional Conditions", "title": "CWE-754" }, { "category": "other", "text": "Missing Cryptographic Step", "title": "CWE-325" }, { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1613729", "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1637855", "CSAFPID-1703131", "CSAFPID-309392", "CSAFPID-1703173", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] }, "references": [ { "category": "self", "summary": "CVE-2023-5678", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5678.json" } ], "title": "CVE-2023-5678" }, { "cve": "CVE-2023-5679", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" } ], "references": [ { "category": "self", "summary": "CVE-2023-5679", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5679.json" } ], "title": "CVE-2023-5679" }, { "cve": "CVE-2023-5680", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "references": [ { "category": "self", "summary": "CVE-2023-5680", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5680.json" } ], "title": "CVE-2023-5680" }, { "cve": "CVE-2023-6129", "cwe": { "id": "CWE-328", "name": "Use of Weak Hash" }, "notes": [ { "category": "other", "text": "Use of Weak Hash", "title": "CWE-328" }, { "category": "other", "text": "Expected Behavior Violation", "title": "CWE-440" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "other", "text": "Use of a Broken or Risky Cryptographic Algorithm", "title": "CWE-327" } ], "references": [ { "category": "self", "summary": "CVE-2023-6129", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-6129.json" } ], "title": "CVE-2023-6129" }, { "cve": "CVE-2023-6237", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" } ], "references": [ { "category": "self", "summary": "CVE-2023-6237", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-6237.json" } ], "title": "CVE-2023-6237" }, { "cve": "CVE-2023-6516", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Memory Allocation with Excessive Size Value", "title": "CWE-789" } ], "references": [ { "category": "self", "summary": "CVE-2023-6516", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-6516.json" } ], "title": "CVE-2023-6516" }, { "cve": "CVE-2023-7104", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" } ], "product_status": { "known_affected": [ "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2023-7104", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-7104.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-1703131" ] } ], "title": "CVE-2023-7104" }, { "cve": "CVE-2023-28450", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" } ], "product_status": { "known_affected": [ "CSAFPID-1613504", "CSAFPID-1613505", "CSAFPID-1613506", "CSAFPID-1613507", "CSAFPID-1613592", "CSAFPID-1613593", "CSAFPID-1613594", "CSAFPID-1613595", "CSAFPID-1613596", "CSAFPID-1613597", "CSAFPID-1613598" ] }, "references": [ { "category": "self", "summary": "CVE-2023-28450", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-28450.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1613504", "CSAFPID-1613505", "CSAFPID-1613506", "CSAFPID-1613507", "CSAFPID-1613592", "CSAFPID-1613593", "CSAFPID-1613594", "CSAFPID-1613595", "CSAFPID-1613596", "CSAFPID-1613597", "CSAFPID-1613598" ] } ], "title": "CVE-2023-28450" }, { "cve": "CVE-2023-30584", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-30584", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-30584.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-30584" }, { "cve": "CVE-2023-32002", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" }, { "category": "other", "text": "Policy Privileges are not Assigned Consistently Between Control and Data Agents", "title": "CWE-1268" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32002", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32002.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-32002" }, { "cve": "CVE-2023-32003", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32003", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32003.json" } ], "title": "CVE-2023-32003" }, { "cve": "CVE-2023-32004", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32004", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32004.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-32004" }, { "cve": "CVE-2023-32005", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "other", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32005", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32005.json" } ], "title": "CVE-2023-32005" }, { "cve": "CVE-2023-32006", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "other", "text": "Exposure of Sensitive Information Due to Incompatible Policies", "title": "CWE-213" }, { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32006", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32006.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-32006" }, { "cve": "CVE-2023-32558", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32558", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32558.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-32558" }, { "cve": "CVE-2023-32559", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "other", "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)", "title": "CWE-94" }, { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32559", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32559.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2023-32559" }, { "cve": "CVE-2023-32736", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" } ], "product_status": { "known_affected": [ "CSAFPID-1712825", "CSAFPID-1712826", "CSAFPID-1703190", "CSAFPID-1703191", "CSAFPID-1500667", "CSAFPID-1703187", "CSAFPID-1703188", "CSAFPID-1703189", "CSAFPID-1703192", "CSAFPID-1703193", "CSAFPID-1703194", "CSAFPID-1702687", "CSAFPID-1702688", "CSAFPID-1703195", "CSAFPID-1702694", "CSAFPID-1703196", "CSAFPID-1703197", "CSAFPID-1703198", "CSAFPID-1703199", "CSAFPID-1703200", "CSAFPID-1703201", "CSAFPID-1703202", "CSAFPID-1703203", "CSAFPID-1703204", "CSAFPID-1703205", "CSAFPID-1703206", "CSAFPID-1703207", "CSAFPID-1712827", "CSAFPID-1712828", "CSAFPID-1712829" ] }, "references": [ { "category": "self", "summary": "CVE-2023-32736", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32736.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-1712825", "CSAFPID-1712826", "CSAFPID-1703190", "CSAFPID-1703191", "CSAFPID-1500667", "CSAFPID-1703187", "CSAFPID-1703188", "CSAFPID-1703189", "CSAFPID-1703192", "CSAFPID-1703193", "CSAFPID-1703194", "CSAFPID-1702687", "CSAFPID-1702688", "CSAFPID-1703195", "CSAFPID-1702694", "CSAFPID-1703196", "CSAFPID-1703197", "CSAFPID-1703198", "CSAFPID-1703199", "CSAFPID-1703200", "CSAFPID-1703201", "CSAFPID-1703202", "CSAFPID-1703203", "CSAFPID-1703204", "CSAFPID-1703205", "CSAFPID-1703206", "CSAFPID-1703207", "CSAFPID-1712827", "CSAFPID-1712828", "CSAFPID-1712829" ] } ], "title": "CVE-2023-32736" }, { "cve": "CVE-2023-38552", "cwe": { "id": "CWE-354", "name": "Improper Validation of Integrity Check Value" }, "notes": [ { "category": "other", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" } ], "references": [ { "category": "self", "summary": "CVE-2023-38552", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-38552.json" } ], "title": "CVE-2023-38552" }, { "cve": "CVE-2023-38709", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)", "title": "CWE-113" }, { "category": "other", "text": "Improper Validation of Specified Quantity in Input", "title": "CWE-1284" } ], "references": [ { "category": "self", "summary": "CVE-2023-38709", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-38709.json" } ], "title": "CVE-2023-38709" }, { "cve": "CVE-2023-39331", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "references": [ { "category": "self", "summary": "CVE-2023-39331", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39331.json" } ], "title": "CVE-2023-39331" }, { "cve": "CVE-2023-39332", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "references": [ { "category": "self", "summary": "CVE-2023-39332", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39332.json" } ], "title": "CVE-2023-39332" }, { "cve": "CVE-2023-39333", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)", "title": "CWE-94" } ], "references": [ { "category": "self", "summary": "CVE-2023-39333", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39333.json" } ], "title": "CVE-2023-39333" }, { "cve": "CVE-2023-44487", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-309392", "CSAFPID-1615259", "CSAFPID-1703173" ] }, "references": [ { "category": "self", "summary": "CVE-2023-44487", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-44487.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-309392", "CSAFPID-1615259", "CSAFPID-1703173" ] } ], "title": "CVE-2023-44487" }, { "cve": "CVE-2023-45143", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" } ], "references": [ { "category": "self", "summary": "CVE-2023-45143", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-45143.json" } ], "title": "CVE-2023-45143" }, { "cve": "CVE-2023-46218", "cwe": { "id": "CWE-201", "name": "Insertion of Sensitive Information Into Sent Data" }, "notes": [ { "category": "other", "text": "Insertion of Sensitive Information Into Sent Data", "title": "CWE-201" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] }, "references": [ { "category": "self", "summary": "CVE-2023-46218", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46218.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] } ], "title": "CVE-2023-46218" }, { "cve": "CVE-2023-46219", "cwe": { "id": "CWE-311", "name": "Missing Encryption of Sensitive Data" }, "notes": [ { "category": "other", "text": "Missing Encryption of Sensitive Data", "title": "CWE-311" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] }, "references": [ { "category": "self", "summary": "CVE-2023-46219", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46219.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703180", "CSAFPID-1703181", "CSAFPID-1703182", "CSAFPID-1703183", "CSAFPID-1703184", "CSAFPID-1703185", "CSAFPID-1703186" ] } ], "title": "CVE-2023-46219" }, { "cve": "CVE-2023-46280", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" } ], "product_status": { "known_affected": [ "CSAFPID-1458012", "CSAFPID-309392", "CSAFPID-1625338", "CSAFPID-1625340", "CSAFPID-1625341", "CSAFPID-75563", "CSAFPID-1625342", "CSAFPID-165765", "CSAFPID-1625345", "CSAFPID-766087", "CSAFPID-1637559", "CSAFPID-1637560", "CSAFPID-1637561", "CSAFPID-1637909", "CSAFPID-1637910", "CSAFPID-1637849", "CSAFPID-1637850", "CSAFPID-1637851", "CSAFPID-1637911", "CSAFPID-1501190", "CSAFPID-1637912", "CSAFPID-1637856", "CSAFPID-1637913", "CSAFPID-1637914", "CSAFPID-1637915", "CSAFPID-1637916", "CSAFPID-1637917", "CSAFPID-1637887", "CSAFPID-1501188", "CSAFPID-1501192", "CSAFPID-1637854", "CSAFPID-1501193", "CSAFPID-1501191", "CSAFPID-1501189", "CSAFPID-1615531", "CSAFPID-1615256", "CSAFPID-1615257", "CSAFPID-1615258", "CSAFPID-1637618", "CSAFPID-1470060", "CSAFPID-1470061", "CSAFPID-1470062", "CSAFPID-1470063", "CSAFPID-1470064", "CSAFPID-1457909", "CSAFPID-1470065", "CSAFPID-1470066", "CSAFPID-1457855", "CSAFPID-1457956", "CSAFPID-1457957", "CSAFPID-1457958", "CSAFPID-1470067", "CSAFPID-1457960", "CSAFPID-1457961", "CSAFPID-1457962", "CSAFPID-1457963", "CSAFPID-1470068", "CSAFPID-1457965", "CSAFPID-1457966", "CSAFPID-1457967", "CSAFPID-1470069", "CSAFPID-1470070", "CSAFPID-1470071", "CSAFPID-1470072", "CSAFPID-1458014", "CSAFPID-1458015", "CSAFPID-1458016", "CSAFPID-1458017", "CSAFPID-1470073", "CSAFPID-75533", "CSAFPID-1472069", "CSAFPID-1472073", "CSAFPID-74792", "CSAFPID-74794", "CSAFPID-1457906", "CSAFPID-1457907", "CSAFPID-1457908" ] }, "references": [ { "category": "self", "summary": "CVE-2023-46280", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46280.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-1458012", "CSAFPID-309392", "CSAFPID-1625338", "CSAFPID-1625340", "CSAFPID-1625341", "CSAFPID-75563", "CSAFPID-1625342", "CSAFPID-165765", "CSAFPID-1625345", "CSAFPID-766087", "CSAFPID-1637559", "CSAFPID-1637560", "CSAFPID-1637561", "CSAFPID-1637909", "CSAFPID-1637910", "CSAFPID-1637849", "CSAFPID-1637850", "CSAFPID-1637851", "CSAFPID-1637911", "CSAFPID-1501190", "CSAFPID-1637912", "CSAFPID-1637856", "CSAFPID-1637913", "CSAFPID-1637914", "CSAFPID-1637915", "CSAFPID-1637916", "CSAFPID-1637917", "CSAFPID-1637887", "CSAFPID-1501188", "CSAFPID-1501192", "CSAFPID-1637854", "CSAFPID-1501193", "CSAFPID-1501191", "CSAFPID-1501189", "CSAFPID-1615531", "CSAFPID-1615256", "CSAFPID-1615257", "CSAFPID-1615258", "CSAFPID-1637618", "CSAFPID-1470060", "CSAFPID-1470061", "CSAFPID-1470062", "CSAFPID-1470063", "CSAFPID-1470064", "CSAFPID-1457909", "CSAFPID-1470065", "CSAFPID-1470066", "CSAFPID-1457855", "CSAFPID-1457956", "CSAFPID-1457957", "CSAFPID-1457958", "CSAFPID-1470067", "CSAFPID-1457960", "CSAFPID-1457961", "CSAFPID-1457962", "CSAFPID-1457963", "CSAFPID-1470068", "CSAFPID-1457965", "CSAFPID-1457966", "CSAFPID-1457967", "CSAFPID-1470069", "CSAFPID-1470070", "CSAFPID-1470071", "CSAFPID-1470072", "CSAFPID-1458014", "CSAFPID-1458015", "CSAFPID-1458016", "CSAFPID-1458017", "CSAFPID-1470073", "CSAFPID-75533", "CSAFPID-1472069", "CSAFPID-1472073", "CSAFPID-74792", "CSAFPID-74794", "CSAFPID-1457906", "CSAFPID-1457907", "CSAFPID-1457908" ] } ], "title": "CVE-2023-46280" }, { "cve": "CVE-2023-46809", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "notes": [ { "category": "other", "text": "Observable Timing Discrepancy", "title": "CWE-208" } ], "references": [ { "category": "self", "summary": "CVE-2023-46809", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46809.json" } ], "title": "CVE-2023-46809" }, { "cve": "CVE-2023-47038", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" } ], "references": [ { "category": "self", "summary": "CVE-2023-47038", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-47038.json" } ], "title": "CVE-2023-47038" }, { "cve": "CVE-2023-47039", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" } ], "references": [ { "category": "self", "summary": "CVE-2023-47039", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-47039.json" } ], "title": "CVE-2023-47039" }, { "cve": "CVE-2023-47100", "references": [ { "category": "self", "summary": "CVE-2023-47100", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-47100.json" } ], "title": "CVE-2023-47100" }, { "cve": "CVE-2023-48795", "cwe": { "id": "CWE-222", "name": "Truncation of Security-relevant Information" }, "notes": [ { "category": "other", "text": "Truncation of Security-relevant Information", "title": "CWE-222" }, { "category": "other", "text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)", "title": "CWE-757" } ], "product_status": { "known_affected": [ "CSAFPID-1615259", "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2023-48795", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-48795.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-1615259", "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] } ], "title": "CVE-2023-48795" }, { "cve": "CVE-2023-49441", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" } ], "references": [ { "category": "self", "summary": "CVE-2023-49441", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-49441.json" } ], "title": "CVE-2023-49441" }, { "cve": "CVE-2023-50387", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "references": [ { "category": "self", "summary": "CVE-2023-50387", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-50387.json" } ], "title": "CVE-2023-50387" }, { "cve": "CVE-2023-50868", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "references": [ { "category": "self", "summary": "CVE-2023-50868", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-50868.json" } ], "title": "CVE-2023-50868" }, { "cve": "CVE-2023-52389", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" } ], "references": [ { "category": "self", "summary": "CVE-2023-52389", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-52389.json" } ], "title": "CVE-2023-52389" }, { "cve": "CVE-2024-0232", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" } ], "product_status": { "known_affected": [ "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0232", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0232.json" } ], "title": "CVE-2024-0232" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1613729", "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2024-0727", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0727.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1613729", "CSAFPID-1703131" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-2004", "cwe": { "id": "CWE-319", "name": "Cleartext Transmission of Sensitive Information" }, "notes": [ { "category": "other", "text": "Cleartext Transmission of Sensitive Information", "title": "CWE-319" }, { "category": "other", "text": "Misinterpretation of Input", "title": "CWE-115" }, { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "other", "text": "Interpretation Conflict", "title": "CWE-436" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] }, "references": [ { "category": "self", "summary": "CVE-2024-2004", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2004.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] } ], "title": "CVE-2024-2004" }, { "cve": "CVE-2024-2379", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] }, "references": [ { "category": "self", "summary": "CVE-2024-2379", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2379.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] } ], "title": "CVE-2024-2379" }, { "cve": "CVE-2024-2398", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Resource after Effective Lifetime", "title": "CWE-772" }, { "category": "other", "text": "Missing Release of Memory after Effective Lifetime", "title": "CWE-401" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] }, "references": [ { "category": "self", "summary": "CVE-2024-2398", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2398.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] } ], "title": "CVE-2024-2398" }, { "cve": "CVE-2024-2466", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "other", "text": "Improper Validation of Certificate with Host Mismatch", "title": "CWE-297" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] }, "references": [ { "category": "self", "summary": "CVE-2024-2466", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2466.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-894438" ] } ], "title": "CVE-2024-2466" }, { "cve": "CVE-2024-2511", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" }, { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Improperly Controlled Sequential Memory Allocation", "title": "CWE-1325" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2024-2511", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2511.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] } ], "title": "CVE-2024-2511" }, { "cve": "CVE-2024-4603", "cwe": { "id": "CWE-606", "name": "Unchecked Input for Loop Condition" }, "notes": [ { "category": "other", "text": "Unchecked Input for Loop Condition", "title": "CWE-606" }, { "category": "other", "text": "Excessive Iteration", "title": "CWE-834" } ], "references": [ { "category": "self", "summary": "CVE-2024-4603", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4603.json" } ], "title": "CVE-2024-4603" }, { "cve": "CVE-2024-4741", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" } ], "references": [ { "category": "self", "summary": "CVE-2024-4741", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4741.json" } ], "title": "CVE-2024-4741" }, { "cve": "CVE-2024-5535", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "other", "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer", "title": "CWE-119" } ], "product_status": { "known_affected": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] }, "references": [ { "category": "self", "summary": "CVE-2024-5535", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-5535.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-1615260", "CSAFPID-1615261", "CSAFPID-1615262", "CSAFPID-1615263", "CSAFPID-1615264", "CSAFPID-1703131" ] } ], "title": "CVE-2024-5535" }, { "cve": "CVE-2024-5594", "references": [ { "category": "self", "summary": "CVE-2024-5594", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-5594.json" } ], "title": "CVE-2024-5594" }, { "cve": "CVE-2024-21890", "cwe": { "id": "CWE-275", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-275", "title": "CWE-275" }, { "category": "other", "text": "Insufficient Technical Documentation", "title": "CWE-1059" } ], "references": [ { "category": "self", "summary": "CVE-2024-21890", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21890.json" } ], "title": "CVE-2024-21890" }, { "cve": "CVE-2024-21891", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "references": [ { "category": "self", "summary": "CVE-2024-21891", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21891.json" } ], "title": "CVE-2024-21891" }, { "cve": "CVE-2024-21892", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)", "title": "CWE-94" } ], "references": [ { "category": "self", "summary": "CVE-2024-21892", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21892.json" } ], "title": "CVE-2024-21892" }, { "cve": "CVE-2024-21896", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "references": [ { "category": "self", "summary": "CVE-2024-21896", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21896.json" } ], "title": "CVE-2024-21896" }, { "cve": "CVE-2024-22017", "cwe": { "id": "CWE-271", "name": "Privilege Dropping / Lowering Errors" }, "notes": [ { "category": "other", "text": "Privilege Dropping / Lowering Errors", "title": "CWE-271" }, { "category": "other", "text": "Improper Privilege Management", "title": "CWE-269" } ], "references": [ { "category": "self", "summary": "CVE-2024-22017", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22017.json" } ], "title": "CVE-2024-22017" }, { "cve": "CVE-2024-22019", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" } ], "references": [ { "category": "self", "summary": "CVE-2024-22019", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22019.json" } ], "title": "CVE-2024-22019" }, { "cve": "CVE-2024-22025", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Improper Resource Shutdown or Release", "title": "CWE-404" } ], "references": [ { "category": "self", "summary": "CVE-2024-22025", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-22025.json" } ], "title": "CVE-2024-22025" }, { "cve": "CVE-2024-24758", "cwe": { "id": "CWE-942", "name": "Permissive Cross-domain Policy with Untrusted Domains" }, "notes": [ { "category": "other", "text": "Permissive Cross-domain Policy with Untrusted Domains", "title": "CWE-942" }, { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" } ], "references": [ { "category": "self", "summary": "CVE-2024-24758", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24758.json" } ], "title": "CVE-2024-24758" }, { "cve": "CVE-2024-24795", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)", "title": "CWE-113" } ], "references": [ { "category": "self", "summary": "CVE-2024-24795", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24795.json" } ], "title": "CVE-2024-24795" }, { "cve": "CVE-2024-24806", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "other", "text": "Server-Side Request Forgery (SSRF)", "title": "CWE-918" } ], "references": [ { "category": "self", "summary": "CVE-2024-24806", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-24806.json" } ], "title": "CVE-2024-24806" }, { "cve": "CVE-2024-26306", "cwe": { "id": "CWE-310", "name": "-" }, "notes": [ { "category": "other", "text": "CWE-310", "title": "CWE-310" }, { "category": "other", "text": "Observable Discrepancy", "title": "CWE-203" } ], "references": [ { "category": "self", "summary": "CVE-2024-26306", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26306.json" } ], "title": "CVE-2024-26306" }, { "cve": "CVE-2024-26925", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "other", "text": "Improper Access Control", "title": "CWE-284" }, { "category": "other", "text": "Improper Locking", "title": "CWE-667" } ], "references": [ { "category": "self", "summary": "CVE-2024-26925", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26925.json" } ], "title": "CVE-2024-26925" }, { "cve": "CVE-2024-27316", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" }, { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" } ], "references": [ { "category": "self", "summary": "CVE-2024-27316", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27316.json" } ], "title": "CVE-2024-27316" }, { "cve": "CVE-2024-27980", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)", "title": "CWE-78" } ], "references": [ { "category": "self", "summary": "CVE-2024-27980", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27980.json" } ], "title": "CVE-2024-27980" }, { "cve": "CVE-2024-27982", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "notes": [ { "category": "other", "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)", "title": "CWE-444" } ], "references": [ { "category": "self", "summary": "CVE-2024-27982", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27982.json" } ], "title": "CVE-2024-27982" }, { "cve": "CVE-2024-27983", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "references": [ { "category": "self", "summary": "CVE-2024-27983", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-27983.json" } ], "title": "CVE-2024-27983" }, { "cve": "CVE-2024-28882", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Resource after Effective Lifetime", "title": "CWE-772" } ], "references": [ { "category": "self", "summary": "CVE-2024-28882", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-28882.json" } ], "title": "CVE-2024-28882" }, { "cve": "CVE-2024-29119", "cwe": { "id": "CWE-266", "name": "Incorrect Privilege Assignment" }, "notes": [ { "category": "other", "text": "Incorrect Privilege Assignment", "title": "CWE-266" } ], "product_status": { "known_affected": [ "CSAFPID-524281" ] }, "references": [ { "category": "self", "summary": "CVE-2024-29119", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-29119.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-524281" ] } ], "title": "CVE-2024-29119" }, { "cve": "CVE-2024-36140", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "title": "CWE-79" } ], "product_status": { "known_affected": [ "CSAFPID-1712832", "CSAFPID-1712833" ] }, "references": [ { "category": "self", "summary": "CVE-2024-36140", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-36140.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-1712832", "CSAFPID-1712833" ] } ], "title": "CVE-2024-36140" }, { "cve": "CVE-2024-44102", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "notes": [ { "category": "other", "text": "Deserialization of Untrusted Data", "title": "CWE-502" } ], "product_status": { "known_affected": [ "CSAFPID-1712834", "CSAFPID-1712835", "CSAFPID-1712836", "CSAFPID-1712837", "CSAFPID-1712838", "CSAFPID-1712839", "CSAFPID-1712840", "CSAFPID-1712841", "CSAFPID-1712842", "CSAFPID-1712843", "CSAFPID-1712844", "CSAFPID-1712845", "CSAFPID-1712846" ] }, "references": [ { "category": "self", "summary": "CVE-2024-44102", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-44102.json" } ], "scores": [ { "cvss_v3": { "baseScore": 10.0, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-1712834", "CSAFPID-1712835", "CSAFPID-1712836", "CSAFPID-1712837", "CSAFPID-1712838", "CSAFPID-1712839", "CSAFPID-1712840", "CSAFPID-1712841", "CSAFPID-1712842", "CSAFPID-1712843", "CSAFPID-1712844", "CSAFPID-1712845", "CSAFPID-1712846" ] } ], "title": "CVE-2024-44102" }, { "cve": "CVE-2024-46888", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46888", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46888.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.9, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46888" }, { "cve": "CVE-2024-46889", "cwe": { "id": "CWE-321", "name": "Use of Hard-coded Cryptographic Key" }, "notes": [ { "category": "other", "text": "Use of Hard-coded Cryptographic Key", "title": "CWE-321" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46889", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46889.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46889" }, { "cve": "CVE-2024-46890", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)", "title": "CWE-78" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46890", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46890.json" } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46890" }, { "cve": "CVE-2024-46891", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "other", "text": "Uncontrolled Resource Consumption", "title": "CWE-400" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46891", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46891.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46891" }, { "cve": "CVE-2024-46892", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "notes": [ { "category": "other", "text": "Insufficient Session Expiration", "title": "CWE-613" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46892", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46892.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46892" }, { "cve": "CVE-2024-46894", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" } ], "product_status": { "known_affected": [ "CSAFPID-746925" ] }, "references": [ { "category": "self", "summary": "CVE-2024-46894", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46894.json" } ], "scores": [ { "cvss_v3": { "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-746925" ] } ], "title": "CVE-2024-46894" }, { "cve": "CVE-2024-47783", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "other", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" } ], "product_status": { "known_affected": [ "CSAFPID-1712847" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47783", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47783.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1712847" ] } ], "title": "CVE-2024-47783" }, { "cve": "CVE-2024-47808", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "other", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" } ], "product_status": { "known_affected": [ "CSAFPID-309392" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47808", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47808.json" } ], "scores": [ { "cvss_v3": { "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-309392" ] } ], "title": "CVE-2024-47808" }, { "cve": "CVE-2024-47940", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" } ], "product_status": { "known_affected": [ "CSAFPID-1680248" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47940", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47940.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1680248" ] } ], "title": "CVE-2024-47940" }, { "cve": "CVE-2024-47941", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" } ], "product_status": { "known_affected": [ "CSAFPID-1680248" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47941", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47941.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1680248" ] } ], "title": "CVE-2024-47941" }, { "cve": "CVE-2024-47942", "cwe": { "id": "CWE-427", "name": "Uncontrolled Search Path Element" }, "notes": [ { "category": "other", "text": "Uncontrolled Search Path Element", "title": "CWE-427" } ], "product_status": { "known_affected": [ "CSAFPID-1680248" ] }, "references": [ { "category": "self", "summary": "CVE-2024-47942", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-47942.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1680248" ] } ], "title": "CVE-2024-47942" }, { "cve": "CVE-2024-50310", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" } ], "product_status": { "known_affected": [ "CSAFPID-1712748" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50310", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50310.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-1712748" ] } ], "title": "CVE-2024-50310" }, { "cve": "CVE-2024-50313", "cwe": { "id": "CWE-362", "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)" }, "notes": [ { "category": "other", "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)", "title": "CWE-362" } ], "product_status": { "known_affected": [ "CSAFPID-1637622", "CSAFPID-1637623", "CSAFPID-1637624", "CSAFPID-1637625", "CSAFPID-1637626" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50313", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50313.json" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1637622", "CSAFPID-1637623", "CSAFPID-1637624", "CSAFPID-1637625", "CSAFPID-1637626" ] } ], "title": "CVE-2024-50313" }, { "cve": "CVE-2024-50557", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50557", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50557.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50557" }, { "cve": "CVE-2024-50558", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "notes": [ { "category": "other", "text": "Improper Access Control", "title": "CWE-284" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50558", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50558.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50558" }, { "cve": "CVE-2024-50559", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)", "title": "CWE-22" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50559", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50559.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50559" }, { "cve": "CVE-2024-50560", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "other", "text": "Improper Input Validation", "title": "CWE-20" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50560", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50560.json" } ], "scores": [ { "cvss_v3": { "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50560" }, { "cve": "CVE-2024-50561", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "title": "CWE-79" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50561", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50561.json" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50561" }, { "cve": "CVE-2024-50572", "cwe": { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)", "title": "CWE-74" } ], "product_status": { "known_affected": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] }, "references": [ { "category": "self", "summary": "CVE-2024-50572", "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50572.json" } ], "scores": [ { "cvss_v3": { "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-1702670", "CSAFPID-1702671", "CSAFPID-1702672", "CSAFPID-1712749", "CSAFPID-1712750", "CSAFPID-1702677", "CSAFPID-1702678", "CSAFPID-1702679", "CSAFPID-1712751", "CSAFPID-1712752", "CSAFPID-1702681", "CSAFPID-1712753", "CSAFPID-1702682", "CSAFPID-1702683", "CSAFPID-1712754", "CSAFPID-1712755", "CSAFPID-1712756", "CSAFPID-1712757", "CSAFPID-1712758", "CSAFPID-1712759", "CSAFPID-1702684", "CSAFPID-1702685", "CSAFPID-1712760", "CSAFPID-1712761" ] } ], "title": "CVE-2024-50572" } ] }
ICSA-24-102-01
Vulnerability from csaf_cisa
Published
2024-04-09 00:00
Modified
2024-11-12 00:00
Summary
Siemens SIMATIC S7-1500
Notes
Summary
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.
Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reporting these vulnerabilities to CISA." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.\n\nSiemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Multiple", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1 - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json" }, { "category": "self", "summary": "SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1 - HTML Version", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "category": "self", "summary": "ICS Advisory ICSA-24-102-01 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json" }, { "category": "self", "summary": "ICS Advisory ICSA-24-102-01 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens SIMATIC S7-1500", "tracking": { "current_release_date": "2024-11-12T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-24-102-01", "initial_release_date": "2024-04-09T00:00:00.000000Z", "revision_history": [ { "date": "2024-04-09T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" }, { "date": "2024-05-14T00:00:00.000000Z", "legacy_version": "1.1", "number": "2", "summary": "Added CVE-2024-2511" }, { "date": "2024-07-09T00:00:00.000000Z", "legacy_version": "1.2", "number": "3", "summary": "Added CVE-2024-5535" }, { "date": "2024-11-12T00:00:00.000000Z", "legacy_version": "1.3", "number": "4", "summary": "Added CVE-2024-9143" } ], "status": "final", "version": "4" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIMATIC S7-1500 TM MFP -\u00a0GNU/Linux subsystem", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "SIMATIC S7-1500 TM MFP -\u00a0GNU/Linux subsystem" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-5678", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "summary", "text": "Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn\u0027t make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn\u0027t check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the \"-pubcheck\" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-5678" }, { "cve": "CVE-2023-6121", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6121" }, { "cve": "CVE-2023-6817", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "A use-after-free vulnerability in the Linux kernel\u0027s netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\nThe function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.\n\nWe recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6817" }, { "cve": "CVE-2023-6931", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "A heap out-of-bounds write vulnerability in the Linux kernel\u0027s Performance Events system component can be exploited to achieve local privilege escalation.\n\nA perf_event\u0027s read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().\n\nWe recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6931" }, { "cve": "CVE-2023-6932", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "A use-after-free vulnerability in the Linux kernel\u0027s ipv4: igmp component can be exploited to achieve local privilege escalation.\n\nA race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.\n\nWe recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6932" }, { "cve": "CVE-2023-45898", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-45898" }, { "cve": "CVE-2024-0584", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an igmp query packet, leading to a kernel information leak.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-0584" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\r\nto crash leading to a potential Denial of Service attack\r\n\r\nImpact summary: Applications loading files in the PKCS12 format from untrusted\r\nsources might terminate abruptly.\r\n\r\nA file in PKCS12 format can contain certificates and keys and may come from an\r\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\r\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\r\ndereference that results in OpenSSL crashing. If an application processes PKCS12\r\nfiles from an untrusted source using the OpenSSL APIs then that application will\r\nbe vulnerable to this issue.\r\n\r\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\r\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\r\nand PKCS12_newpass().\r\n\r\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\r\nfunction is related to writing data we do not consider it security significant.\r\n\r\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-2511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "summary", "text": "Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions\r\nImpact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-2511" }, { "cve": "CVE-2024-5535", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists). This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a \"no overlap\" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem. In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur. This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-5535" }, { "cve": "CVE-2024-9143", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "Use of the low-level GF(2m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we\u0027re aware of, either only \"named curves\" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2m)) curves that can\u0027t represent problematic input values. Thus the likelihood of existence of a vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any problematic use-cases would have to be using an \"exotic\" curve encoding. The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions. Applications working with \"exotic\" explicit binary (GF(2m)) curve parameters, that make it possible to represent invalid field polynomials with a zero constant term, via the above or similar APIs, may terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-9143" } ] }
icsa-24-102-01
Vulnerability from csaf_cisa
Published
2024-04-09 00:00
Modified
2024-11-12 00:00
Summary
Siemens SIMATIC S7-1500
Notes
Summary
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.
Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reporting these vulnerabilities to CISA." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.\n\nSiemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Multiple", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1 - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-265688.json" }, { "category": "self", "summary": "SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1 - HTML Version", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "category": "self", "summary": "ICS Advisory ICSA-24-102-01 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-01.json" }, { "category": "self", "summary": "ICS Advisory ICSA-24-102-01 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens SIMATIC S7-1500", "tracking": { "current_release_date": "2024-11-12T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-24-102-01", "initial_release_date": "2024-04-09T00:00:00.000000Z", "revision_history": [ { "date": "2024-04-09T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" }, { "date": "2024-05-14T00:00:00.000000Z", "legacy_version": "1.1", "number": "2", "summary": "Added CVE-2024-2511" }, { "date": "2024-07-09T00:00:00.000000Z", "legacy_version": "1.2", "number": "3", "summary": "Added CVE-2024-5535" }, { "date": "2024-11-12T00:00:00.000000Z", "legacy_version": "1.3", "number": "4", "summary": "Added CVE-2024-9143" } ], "status": "final", "version": "4" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:all/*", "product": { "name": "SIMATIC S7-1500 TM MFP -\u00a0GNU/Linux subsystem", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "SIMATIC S7-1500 TM MFP -\u00a0GNU/Linux subsystem" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-5678", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "summary", "text": "Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn\u0027t make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn\u0027t check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the \"-pubcheck\" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-5678" }, { "cve": "CVE-2023-6121", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6121" }, { "cve": "CVE-2023-6817", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "A use-after-free vulnerability in the Linux kernel\u0027s netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\nThe function nft_pipapo_walk did not skip inactive elements during set walk which could lead double deactivations of PIPAPO (Pile Packet Policies) elements, leading to use-after-free.\n\nWe recommend upgrading past commit 317eb9685095678f2c9f5a8189de698c5354316a.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6817" }, { "cve": "CVE-2023-6931", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "A heap out-of-bounds write vulnerability in the Linux kernel\u0027s Performance Events system component can be exploited to achieve local privilege escalation.\n\nA perf_event\u0027s read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().\n\nWe recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6931" }, { "cve": "CVE-2023-6932", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "A use-after-free vulnerability in the Linux kernel\u0027s ipv4: igmp component can be exploited to achieve local privilege escalation.\n\nA race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.\n\nWe recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6932" }, { "cve": "CVE-2023-45898", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-45898" }, { "cve": "CVE-2024-0584", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "summary", "text": "A use-after-free issue was found in igmp_start_timer in net/ipv4/igmp.c in the network sub-component in the Linux Kernel. This flaw allows a local user to observe a refcnt use-after-free issue when receiving an igmp query packet, leading to a kernel information leak.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-0584" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\r\nto crash leading to a potential Denial of Service attack\r\n\r\nImpact summary: Applications loading files in the PKCS12 format from untrusted\r\nsources might terminate abruptly.\r\n\r\nA file in PKCS12 format can contain certificates and keys and may come from an\r\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\r\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\r\ndereference that results in OpenSSL crashing. If an application processes PKCS12\r\nfiles from an untrusted source using the OpenSSL APIs then that application will\r\nbe vulnerable to this issue.\r\n\r\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\r\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\r\nand PKCS12_newpass().\r\n\r\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\r\nfunction is related to writing data we do not consider it security significant.\r\n\r\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-2511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "summary", "text": "Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions\r\nImpact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-2511" }, { "cve": "CVE-2024-5535", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "notes": [ { "category": "summary", "text": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists). This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a \"no overlap\" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem. In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur. This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-5535" }, { "cve": "CVE-2024-9143", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "Use of the low-level GF(2m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we\u0027re aware of, either only \"named curves\" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2m)) curves that can\u0027t represent problematic input values. Thus the likelihood of existence of a vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any problematic use-cases would have to be using an \"exotic\" curve encoding. The affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions. Applications working with \"exotic\" explicit binary (GF(2m)) curve parameters, that make it possible to represent invalid field polynomials with a zero constant term, via the above or similar APIs, may terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "mitigation", "details": "Only build and run applications from trusted sources", "product_ids": [ "CSAFPID-0001" ] }, { "category": "none_available", "details": "Currently no fix is available", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-9143" } ] }
icsa-24-319-04
Vulnerability from csaf_cisa
Published
2024-11-12 00:00
Modified
2024-11-12 00:00
Summary
Siemens SINEC NMS
Notes
Summary
SINEC NMS before V3.0 SP1 is affected by multiple vulnerabilities.
Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reporting these vulnerabilities to CISA." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "SINEC NMS before V3.0 SP1 is affected by multiple vulnerabilities.\n\nSiemens has released a new version for SINEC NMS and recommends to update to the latest version.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Multiple", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1 - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-331112.json" }, { "category": "self", "summary": "SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1 - HTML Version", "url": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html" }, { "category": "self", "summary": "ICS Advisory ICSA-24-319-04 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-319-04.json" }, { "category": "self", "summary": "ICS Advisory ICSA-24-319-04 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-04" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens SINEC NMS", "tracking": { "current_release_date": "2024-11-12T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-24-319-04", "initial_release_date": "2024-11-12T00:00:00.000000Z", "revision_history": [ { "date": "2024-11-12T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003cV3.0_SP1", "product": { "name": "SINEC NMS", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "SINEC NMS" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-4807", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-4807" }, { "cve": "CVE-2023-5363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers.\r\n\r\nImpact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes.\r\n\r\nWhen calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been established. Any alterations to the key length, via the \"keylen\" parameter or the IV length, via the \"ivlen\" parameter, within the OSSL_PARAM array will not take effect as intended, potentially causing truncation or overreading of these values. The following ciphers and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.\r\n\r\nFor the CCM, GCM and OCB cipher modes, truncation of the IV can result in loss of confidentiality. For example, when following NIST\u0027s SP 800-38D section 8.2.1 guidance for constructing a deterministic IV for AES in GCM mode, truncation of the counter portion could lead to IV reuse.\r\n\r\nBoth truncations and overruns of the key and overruns of the IV will produce incorrect results and could, in some cases, trigger a memory exception. However, these issues are not currently assessed as security critical.\r\n\r\nChanging the key and/or IV lengths is not considered to be a common operation and the vulnerable API was recently introduced. Furthermore it is likely that application developers will have spotted this problem during testing since decryption would fail unless both peers in the communication were similarly vulnerable. For these reasons we expect the probability of an application being vulnerable to this to be quite low. However if an application is vulnerable then this issue is considered very serious. For these reasons we have assessed this issue as Moderate severity overall.\r\n\r\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\r\n\r\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because the issue lies outside of the FIPS provider boundary.\r\n\r\nOpenSSL 3.1 and 3.0 are vulnerable to this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-5363" }, { "cve": "CVE-2023-5678", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "summary", "text": "Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn\u0027t make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn\u0027t check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the \"-pubcheck\" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-5678" }, { "cve": "CVE-2023-6129", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "Issue summary: The POLY1305 MAC (message authentication code) implementation\r\ncontains a bug that might corrupt the internal state of applications running\r\non PowerPC CPU based platforms if the CPU provides vector instructions.\r\n\r\nImpact summary: If an attacker can influence whether the POLY1305 MAC\r\nalgorithm is used, the application state might be corrupted with various\r\napplication dependent consequences.\r\n\r\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\r\nPowerPC CPUs restores the contents of vector registers in a different order\r\nthan they are saved. Thus the contents of some of these vector registers\r\nare corrupted when returning to the caller. The vulnerable code is used only\r\non newer PowerPC processors supporting the PowerISA 2.07 instructions.\r\n\r\nThe consequences of this kind of internal application state corruption can\r\nbe various - from no consequences, if the calling application does not\r\ndepend on the contents of non-volatile XMM registers at all, to the worst\r\nconsequences, where the attacker could get complete control of the application\r\nprocess. However unless the compiler uses the vector registers for storing\r\npointers, the most likely consequence, if any, would be an incorrect result\r\nof some application dependent calculations or a crash leading to a denial of\r\nservice.\r\n\r\nThe POLY1305 MAC algorithm is most frequently used as part of the\r\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\r\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\r\nversions 1.2 and 1.3. If this cipher is enabled on the server a malicious\r\nclient can influence whether this AEAD cipher is used. This implies that\r\nTLS server applications using OpenSSL can be potentially impacted. However\r\nwe are currently not aware of any concrete application that would be affected\r\nby this issue therefore we consider this a Low severity security issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6129" }, { "cve": "CVE-2023-6237", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "summary", "text": "Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service. When function EVP_PKEY_public_check() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is an overly large prime, then this computation would take a long time. An application that calls EVP_PKEY_public_check() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function EVP_PKEY_public_check() is not called from other OpenSSL functions however it is called from the OpenSSL pkey command line application. For that reason that application is also vulnerable if used with the \u0027-pubin\u0027 and \u0027-check\u0027 options on untrusted data. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6237" }, { "cve": "CVE-2023-38709", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "notes": [ { "category": "summary", "text": "Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-38709" }, { "cve": "CVE-2023-46218", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl\u0027s function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-46218" }, { "cve": "CVE-2023-46219", "cwe": { "id": "CWE-311", "name": "Missing Encryption of Sensitive Data" }, "notes": [ { "category": "summary", "text": "When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-46219" }, { "cve": "CVE-2023-46280", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "The affected applications contain an out of bounds read vulnerability. This could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-46280" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\r\nto crash leading to a potential Denial of Service attack\r\n\r\nImpact summary: Applications loading files in the PKCS12 format from untrusted\r\nsources might terminate abruptly.\r\n\r\nA file in PKCS12 format can contain certificates and keys and may come from an\r\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\r\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\r\ndereference that results in OpenSSL crashing. If an application processes PKCS12\r\nfiles from an untrusted source using the OpenSSL APIs then that application will\r\nbe vulnerable to this issue.\r\n\r\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\r\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\r\nand PKCS12_newpass().\r\n\r\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\r\nfunction is related to writing data we do not consider it security significant.\r\n\r\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-2004", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-2004" }, { "cve": "CVE-2024-2379", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "summary", "text": "libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-2379" }, { "cve": "CVE-2024-2398", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "summary", "text": "When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-2398" }, { "cve": "CVE-2024-2466", "cwe": { "id": "CWE-297", "name": "Improper Validation of Certificate with Host Mismatch" }, "notes": [ { "category": "summary", "text": "libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-2466" }, { "cve": "CVE-2024-24795", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "notes": [ { "category": "summary", "text": "HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-24795" }, { "cve": "CVE-2024-27316", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "summary", "text": "HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-27316" }, { "cve": "CVE-2024-47808", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "summary", "text": "The affected application contains a database function, that does not properly restrict the permissions of users to write to the filesystem of the host system.\r\nThis could allow an authenticated medium-privileged attacker to write arbitrary content to any location in the filesystem of the host system.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-47808" } ] }
ICSA-24-319-04
Vulnerability from csaf_cisa
Published
2024-11-12 00:00
Modified
2024-11-12 00:00
Summary
Siemens SINEC NMS
Notes
Summary
SINEC NMS before V3.0 SP1 is affected by multiple vulnerabilities.
Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reporting these vulnerabilities to CISA." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "SINEC NMS before V3.0 SP1 is affected by multiple vulnerabilities.\n\nSiemens has released a new version for SINEC NMS and recommends to update to the latest version.", "title": "Summary" }, { "category": "general", "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Multiple", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1 - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-331112.json" }, { "category": "self", "summary": "SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1 - HTML Version", "url": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html" }, { "category": "self", "summary": "ICS Advisory ICSA-24-319-04 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-319-04.json" }, { "category": "self", "summary": "ICS Advisory ICSA-24-319-04 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-04" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens SINEC NMS", "tracking": { "current_release_date": "2024-11-12T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-24-319-04", "initial_release_date": "2024-11-12T00:00:00.000000Z", "revision_history": [ { "date": "2024-11-12T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003cV3.0_SP1", "product": { "name": "SINEC NMS", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "SINEC NMS" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-4807", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this kind of internal application state corruption can be various - from no consequences, if the calling application does not depend on the contents of non-volatile XMM registers at all, to the worst consequences, where the attacker could get complete control of the application process. However given the contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most likely consequence, if any, would be an incorrect result of some application dependent calculations or a crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be potentially impacted. However we are currently not aware of any concrete application that would be affected by this issue therefore we consider this a Low severity security issue. As a workaround the AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-4807" }, { "cve": "CVE-2023-5363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers.\r\n\r\nImpact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes.\r\n\r\nWhen calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been established. Any alterations to the key length, via the \"keylen\" parameter or the IV length, via the \"ivlen\" parameter, within the OSSL_PARAM array will not take effect as intended, potentially causing truncation or overreading of these values. The following ciphers and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB.\r\n\r\nFor the CCM, GCM and OCB cipher modes, truncation of the IV can result in loss of confidentiality. For example, when following NIST\u0027s SP 800-38D section 8.2.1 guidance for constructing a deterministic IV for AES in GCM mode, truncation of the counter portion could lead to IV reuse.\r\n\r\nBoth truncations and overruns of the key and overruns of the IV will produce incorrect results and could, in some cases, trigger a memory exception. However, these issues are not currently assessed as security critical.\r\n\r\nChanging the key and/or IV lengths is not considered to be a common operation and the vulnerable API was recently introduced. Furthermore it is likely that application developers will have spotted this problem during testing since decryption would fail unless both peers in the communication were similarly vulnerable. For these reasons we expect the probability of an application being vulnerable to this to be quite low. However if an application is vulnerable then this issue is considered very serious. For these reasons we have assessed this issue as Moderate severity overall.\r\n\r\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\r\n\r\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because the issue lies outside of the FIPS provider boundary.\r\n\r\nOpenSSL 3.1 and 3.0 are vulnerable to this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-5363" }, { "cve": "CVE-2023-5678", "cwe": { "id": "CWE-754", "name": "Improper Check for Unusual or Exceptional Conditions" }, "notes": [ { "category": "summary", "text": "Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn\u0027t make any of these checks, and is therefore vulnerable for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn\u0027t check for an excessively large Q. An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line application when using the \"-pubcheck\" option, as well as the OpenSSL genpkey command line application. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-5678" }, { "cve": "CVE-2023-6129", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "summary", "text": "Issue summary: The POLY1305 MAC (message authentication code) implementation\r\ncontains a bug that might corrupt the internal state of applications running\r\non PowerPC CPU based platforms if the CPU provides vector instructions.\r\n\r\nImpact summary: If an attacker can influence whether the POLY1305 MAC\r\nalgorithm is used, the application state might be corrupted with various\r\napplication dependent consequences.\r\n\r\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\r\nPowerPC CPUs restores the contents of vector registers in a different order\r\nthan they are saved. Thus the contents of some of these vector registers\r\nare corrupted when returning to the caller. The vulnerable code is used only\r\non newer PowerPC processors supporting the PowerISA 2.07 instructions.\r\n\r\nThe consequences of this kind of internal application state corruption can\r\nbe various - from no consequences, if the calling application does not\r\ndepend on the contents of non-volatile XMM registers at all, to the worst\r\nconsequences, where the attacker could get complete control of the application\r\nprocess. However unless the compiler uses the vector registers for storing\r\npointers, the most likely consequence, if any, would be an incorrect result\r\nof some application dependent calculations or a crash leading to a denial of\r\nservice.\r\n\r\nThe POLY1305 MAC algorithm is most frequently used as part of the\r\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\r\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\r\nversions 1.2 and 1.3. If this cipher is enabled on the server a malicious\r\nclient can influence whether this AEAD cipher is used. This implies that\r\nTLS server applications using OpenSSL can be potentially impacted. However\r\nwe are currently not aware of any concrete application that would be affected\r\nby this issue therefore we consider this a Low severity security issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6129" }, { "cve": "CVE-2023-6237", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "summary", "text": "Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service. When function EVP_PKEY_public_check() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is an overly large prime, then this computation would take a long time. An application that calls EVP_PKEY_public_check() and supplies an RSA key obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function EVP_PKEY_public_check() is not called from other OpenSSL functions however it is called from the OpenSSL pkey command line application. For that reason that application is also vulnerable if used with the \u0027-pubin\u0027 and \u0027-check\u0027 options on untrusted data. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-6237" }, { "cve": "CVE-2023-38709", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "notes": [ { "category": "summary", "text": "Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-38709" }, { "cve": "CVE-2023-46218", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl\u0027s function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-46218" }, { "cve": "CVE-2023-46219", "cwe": { "id": "CWE-311", "name": "Missing Encryption of Sensitive Data" }, "notes": [ { "category": "summary", "text": "When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-46219" }, { "cve": "CVE-2023-46280", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "The affected applications contain an out of bounds read vulnerability. This could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2023-46280" }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\r\nto crash leading to a potential Denial of Service attack\r\n\r\nImpact summary: Applications loading files in the PKCS12 format from untrusted\r\nsources might terminate abruptly.\r\n\r\nA file in PKCS12 format can contain certificates and keys and may come from an\r\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\r\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\r\ndereference that results in OpenSSL crashing. If an application processes PKCS12\r\nfiles from an untrusted source using the OpenSSL APIs then that application will\r\nbe vulnerable to this issue.\r\n\r\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\r\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\r\nand PKCS12_newpass().\r\n\r\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\r\nfunction is related to writing data we do not consider it security significant.\r\n\r\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-0727" }, { "cve": "CVE-2024-2004", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "notes": [ { "category": "summary", "text": "When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-2004" }, { "cve": "CVE-2024-2379", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "summary", "text": "libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path accidentally skips the verification and returns OK, thus ignoring any certificate problems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-2379" }, { "cve": "CVE-2024-2398", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "summary", "text": "When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-2398" }, { "cve": "CVE-2024-2466", "cwe": { "id": "CWE-297", "name": "Improper Validation of Certificate with Host Mismatch" }, "notes": [ { "category": "summary", "text": "libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-2466" }, { "cve": "CVE-2024-24795", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "notes": [ { "category": "summary", "text": "HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-24795" }, { "cve": "CVE-2024-27316", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "summary", "text": "HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-27316" }, { "cve": "CVE-2024-47808", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "summary", "text": "The affected application contains a database function, that does not properly restrict the permissions of users to write to the filesystem of the host system.\r\nThis could allow an authenticated medium-privileged attacker to write arbitrary content to any location in the filesystem of the host system.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to V3.0 SP1 or later version", "product_ids": [ "CSAFPID-0001" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109974917/" } ], "scores": [ { "cvss_v3": { "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ], "title": "CVE-2024-47808" } ] }
icsa-24-275-02
Vulnerability from csaf_cisa
Published
2024-10-01 06:00
Modified
2024-10-01 06:00
Summary
Mitsubishi Electric MELSEC iQ-F FX5-OPC
Notes
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of service condition on the product by getting a legitimate user to import a specially crafted PKCS#12 format certificate.
Critical infrastructure sectors
Critical Manufacturing
Countries/areas deployed
Worldwide
Company headquarters location
Japan
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:
Recommended Practices
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
Recommended Practices
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
{ "document": { "acknowledgments": [ { "organization": "Mitsubishi Electric", "summary": "reporting this vulnerability to CISA" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "lang": "en-US", "notes": [ { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "summary", "text": "Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of service condition on the product by getting a legitimate user to import a specially crafted PKCS#12 format certificate.", "title": "Risk evaluation" }, { "category": "other", "text": "Critical Manufacturing", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Japan", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted C