CVE-2023-46098: Permissive Cross-domain Policy with Untrusted Domains

A vulnerability has been identified in SIMATIC PCS neo All versions V4.1. When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior...

PT-2023-6999 · Siemens · Simatic Pcs Neo

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions prior to V4.1 Description: A vulnerability has been identified in the PUD Manager of SIMATIC PCS neo, where it does not properly neutralize user-provided inputs. This could allow an authenticated adjacent attacker to...

Siemens SIMATIC PCS neo

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2023-6997 · Siemens · Simatic Pcs Neo

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo versions prior to V4.1 Description: The issue is related to the use of an overly permissive CORS policy when accessing the Information Server from affected products. This could allow an attacker to trick a legitimate user into...

CVE-2023-46099: Improper Neutralization of Input During Web Page Generation

A vulnerability has been identified in SIMATIC PCS neo All versions V4.1. There is a stored cross-site scripting vulnerability in the Administration Console of the affected product, that could allow an attacker with high privileges to inject Javascript code into the application that is later...

CVE-2023-46096: Missing Authentication for Critical Function

A vulnerability has been identified in SIMATIC PCS neo All versions V4.1. The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker to generate a privileged token and upload additional documents...

The vulnerability of the administration console of the SIMATIC PCS neo web-based system for managing technological processes allows a hacker to obtain the administrator’s Windows account credentials.

The vulnerability of the administration console of the SIMATIC PCS neo web-based process control system is related to the leakage of information about files and directories. Exploiting this vulnerability can allow an attacker to obtain administrator credentials for Windows...

Siemens SIMATIC PCS neo (Administration Console) Information Disclosure Vulnerability

SIMATIC PCS neo Administration Console is a distributed control system DCS. An information disclosure vulnerability exists in Siemens SIMATIC PCS neo Administration Console, which can be exploited by an attacker to obtain credentials and impersonate an administrator user to gain administrator...

CVE-2023-38558

A vulnerability has been identified in SIMATIC PCS neo Administration Console V4.0 All versions, SIMATIC PCS neo Administration Console V4.0 Update 1 All versions. The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the...

Design/Logic Flaw

A vulnerability has been identified in SIMATIC PCS neo Administration Console V4.0 All versions, SIMATIC PCS neo Administration Console V4.0 Update 1 All versions. The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the...

CVE-2023-38558

Summary of CVE-2023-38558 : Siemens SIMATIC PCS neo Administration Console (V4.0 and V4.0 Update 1) contains an information-disclosure vulnerability that leaks Windows admin credentials to an attacker with local access, enabling impersonation of an admin and potential access to other Windows syst...

CVE-2023-38558

A vulnerability has been identified in SIMATIC PCS neo Administration Console V4.0 All versions, SIMATIC PCS neo Administration Console V4.0 Update 1 All versions. The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the...

CVE-2023-38558

A vulnerability has been identified in SIMATIC PCS neo Administration Console V4.0 All versions, SIMATIC PCS neo Administration Console V4.0 Update 1 All versions. The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the...

PT-2023-5168 · Microsoft +1 · Windows +1

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS neo Administration Console versions V4.0 through V4.0 Update 1 Description: The issue is related to a leak of information about files and directories in the administration console of the SIMATIC PCS neo system, which can lead to t...

CVE-2023-38558: Insertion of Sensitive Information into Externally-Accessible File or Directory

A vulnerability has been identified in SIMATIC PCS neo Administration Console V4.0 All versions, SIMATIC PCS neo Administration Console V4.0 Update 1 All versions. The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the...

Siemens SIMATIC PCS neo Administration Console

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

neo-m.jp Cross Site Scripting vulnerability OBB-3580997

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Sync eCommerce NEO Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)

Software Sync eCommerce NEO Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9dbd1f3d1861 Credits Rafie Muhammad Patchstack Require...

Mexico-Based Hacker Targets Global Banks with Android Malware

An e-crime actor of Mexican provenance has been linked to an Android mobile malware campaign targeting financial institutions globally, but with a specific focus on Spanish and Chilean banks, from June 2021 to April 2023. The activity is being attributed to an actor codenamed NeoNet , according t...

User can call getReward multiple times causing 51% attack

Lines of code Vulnerability details Impact The Neo Tokyo staking program operates as follows: The staker is a competitive system where stakers compete for a fixed emission rate in each of the S1 Citizen, S2 Citizen, and LP token staking pools. Stakers "may" choose to lock their assets for some...