CVE-2025-30034

A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V3.3. Affected devices do not properly validate input sent to its listening port on the local loopback interface. This could allow an unauthenticated local attacker to cause a denial of service condition...

CVE-2024-54678

A vulnerability has been identified in SIMATIC PCS neo V4.1 All versions, SIMATIC PCS neo V5.0 All versions, SIMATIC PCS neo V6.0 All versions V6.0 SP1 Update 1, SIMATIC S7-PLCSIM V17 All versions, SIMATIC STEP 7 V17 All versions V17 Update 9, SIMATIC STEP 7 V18 All versions, SIMATIC STEP 7 V19 A...

CVE-2025-40752

A vulnerability has been identified in POWER METER SICAM Q100 7KG9501-0AA01-0AA1 All versions = V2.60 = V2.60 = V2.60 = V2.60 = V2.70 V2.80. Affected devices store the password for the SMTP account as plain text. This could allow an authenticated local attacker to extract it and use the configure...

CVE-2025-40752

CVE-2025-40752 affects Siemens POWER METER SICAM Q100/Q200 (Q100 variants 2.60–2.61/2.60–2.61 for certain SKUs) and SICAM Q200 (2.70–2.79) where SMTP password is stored in cleartext. This allows an authenticated local attacker to read the SMTP credentials from the device configuration and abuse t...

CVE-2025-40752

A vulnerability has been identified in POWER METER SICAM Q100 7KG9501-0AA01-0AA1 All versions = V2.60 = V2.60 = V2.60 = V2.60 = V2.70 V2.80. Affected devices store the password for the SMTP account as plain text. This could allow an authenticated local attacker to extract it and use the configure...

CVE-2025-40751

CVE-2025-40751 affects the Siemens SIMATIC RTLS Locating Manager (all versions

CVE-2025-40751

A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V3.3. Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credential...

CVE-2025-40751

A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V3.3. Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credential...

CVE-2024-54678

A vulnerability has been identified in SIMATIC PCS neo V4.1 All versions, SIMATIC PCS neo V5.0 All versions, SIMATIC PCS neo V6.0 All versions V6.0 SP1 Update 1, SIMATIC S7-PLCSIM V17 All versions, SIMATIC STEP 7 V17 All versions V17 Update 9, SIMATIC STEP 7 V18 All versions, SIMATIC STEP 7 V19 A...

CVE-2024-54678

CVE-2024-54678 affects a broad set of Siemens industrial products (e.g., SIMATIC PCS neo 4.1–6.0, STEP 7, WinCC, S7-PLCSIM, SIMATIC SIRIUS/SIMOCODE/SCOUT/STArtDrive, TIA Portal Cloud, etc.). The root cause is improper sanitization of Interprocess Communication input via a Windows Named Pipe that ...

CVE-2024-54678

A vulnerability has been identified in SIMATIC PCS neo V4.1 All versions, SIMATIC PCS neo V5.0 All versions, SIMATIC PCS neo V6.0 All versions V6.0 SP1 Update 1, SIMATIC S7-PLCSIM V17 All versions, SIMATIC STEP 7 V17 All versions V17 Update 9, SIMATIC STEP 7 V18 All versions, SIMATIC STEP 7 V19 A...

CVE-2025-41686

CVE-2025-41686 describes a local privilege escalation in which a low-privileged attacker can exploit improper permissions on nssm.exe to gain administrative access. The CVSS v3.1 vector is LOCAL, with LOW privileges required, no user interaction, and a base score of 7.8 (HIGH). Affected component...

Windows Push Notifications Apps Elevation of Privilege Vulnerability

Access of resource using incompatible type 'type confusion' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

Microsoft Word Information Disclosure Vulnerability

Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally...

Windows StateRepository API Server file Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally...

Windows Graphics Component Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

Desktop Window Manager Elevation of Privilege Vulnerability

Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally...

PT-2025-32656 · Siemens · Sicam Q100 +1

Name of the Vulnerable Software and Affected Versions: POWER METER SICAM Q100 versions 2.60 through 2.61 POWER METER SICAM Q200 versions 2.70 through 2.79 Description: Affected devices export the password for the SMTP account as plain text in the configuration file. This could allow an...

PT-2025-32831 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: A type confusion issue exists in Windows Push Notifications. This allows an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no information about ...

PT-2025-32680 · Ivanti · Ivanti Connect Secure +3

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.8 Ivanti Connect Secure versions prior to 22.8R2 Ivanti Policy Secure versions prior to 22.7R1.5 Ivanti ZTA Gateway versions prior to 22.8R2.3 Ivanti Neurons for Secure Access versions prior to...