Design/Logic Flaw

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown strin...

Design/Logic Flaw

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains a misconfiguration in the APT update. This could allow an attacker to add insecure packages to the application...

Authentication flaw

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application creates temporary user credentials for UMC User Management Component users. An attacker could use these temporary credentials for authentication bypass in certain scenarios...

Code injection

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks a...

Command injection

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains a file upload server that is vulnerable to command injection. An attacker could use this to achieve arbitrary code execution...

Design/Logic Flaw

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker...

Cross site scripting

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting XSS attacks...

Authentication flaw

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions of any user and gain the privileges of an...

Input validation

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. Due to improper input validation, the OpenSSL certificate's password could be printed to a file reachable by an attacker...

Code injection

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. Affected application is missing general HTTP security headers in the web server configured on port 6220. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks...

Information disclosure

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to limited information...

Information disclosure

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to low privileged users accessing privileged information...

Information disclosure

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for information disclosure...

CVE-2022-32262

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains a file upload server that is vulnerable to command injection. An attacker could use this to achieve arbitrary code execution...

CVE-2022-32262

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains a file upload server that is vulnerable to command injection. An attacker could use this to achieve arbitrary code execution...

CVE-2022-32262

The CVE-2022-32262 issue affects Siemens SINEMA Remote Connect Server (all versions prior to 3.1). The vulnerability arises from a file upload server that is vulnerable to command injection, enabling arbitrary code execution. Impact is high, with remote exploitation possible and no authentication...

CVE-2022-32261

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains a misconfiguration in the APT update. This could allow an attacker to add insecure packages to the application...

CVE-2022-32261

CVE-2022-32261 affects Siemens SINEMA Remote Connect Server (all versions prior to V3.1). The vulnerability stems from a misconfiguration in the APT update mechanism that could allow an attacker to add insecure update packages to the application. The issue is documented across multiple sources an...

CVE-2022-32261

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains a misconfiguration in the APT update. This could allow an attacker to add insecure packages to the application...

CVE-2022-32260

CVE-2022-32260 affects Siemens SINEMA Remote Connect Server: all versions prior to 3.2 SP1 create temporary UMC user credentials, which could allow authentication bypass in certain scenarios. The affected component is the User Management Component (UMC) within SINEMA Remote Connect Server. Impact...