Design/Logic Flaw

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system...

Command injection

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

Path traversal

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system has a Path Traversal vulnerability when exporting a firmware container. With this a privileged authenticated attacker could create arbitrary files on an affected system...

CVE-2021-33722

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system has a Path Traversal vulnerability when exporting a firmware container. With this a privileged authenticated attacker could create arbitrary files on an affected system...

Arbitrary file deletion

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system contains an Arbitrary File Deletion vulnerability that possibly allows to delete an arbitrary file or directory under a user controlled path...

Command injection

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker that is able to import firmware containers to an affected system could execute arbitrary commands in the local database...

Command injection

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

Design/Logic Flaw

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system allows to delete arbitrary files or directories under a user controlled path and does not correctly check if the relative path is still within the intended target directory...

CVE-2021-33736

CVE-2021-33736 (SINEC NMS) affects Siemens SINEC NMS versions prior to 1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver. The Red Hat and NVD entries corroborate the same issue; Nessus lists it...

CVE-2021-33736

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33735

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33734

CVE-2021-33734 is a SQL‑injection/command‑execution vulnerability in Siemens SINEC NMS Server (all versions < 1.0 SP2 Update 1). A privileged authenticated attacker could send crafted requests to the web server to execute arbitrary commands in the local database. The issue is part of a broader...

CVE-2021-33735

CVE-2021-33735 affects Siemens SINEC NMS (all versions

CVE-2021-33734

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33733

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33733

CVE-2021-33733 affects Siemens SINEC NMS (versions prior to 1.0 SP2 Update 1). The vulnerability is an SQL injection in the web server that, when combined with authenticated access, could allow an attacker to execute arbitrary commands in the local database by sending crafted requests. Impact is ...

CVE-2021-33732

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33732

Siemens SINEC NMS is affected by CVE-2021-33732 (SQL Injection) in all versions prior to 1.0 SP2 Update 1. A privileged, authenticated attacker could send crafted requests to the web server and execute arbitrary commands in the local database. Remediation: update to v1.0 SP2 Update 1 or later. Th...

CVE-2021-33731

CVE-2021-33731 affects Siemens SINEC NMS versions prior to 1.0 SP2 Update 1. It is a SQL injection vulnerability in the web server that could allow a privileged, authenticated attacker to execute arbitrary commands in the local database by sending crafted requests. Glimpse of impact from sources:...

CVE-2021-33731

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...