CVE-2021-33723

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system...

CVE-2021-33722

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system has a Path Traversal vulnerability when exporting a firmware container. With this a privileged authenticated attacker could create arbitrary files on an affected system...

CVE-2021-33722

Siemens SINEC NMS (versions prior to 1.0 SP2 Update 1) is affected by a path traversal vulnerability when exporting a firmware container. The issue could allow a privileged, authenticated attacker to create arbitrary files on the device. Affected component is the firmware container export path; r...

Siemens SINEC NMS SQL注入漏洞

SINEC NMS is a network management system used by Siemens to monitor and manage industrial networks.A SQL injection vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1, which stems from a lack of validation and escaping of SQL parameter statements. An attacker could use this...

PT-2021-20303

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1 Description: A vulnerability has been identified that allows the upload of JSON objects which are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content, a privileg...

CVE-2021-33727: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could download the user profile of any user. With this, the attacker could leak confidential information of any user in the affected system...

PT-2021-20300

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1 Description: A vulnerability has been identified that allows the deletion of arbitrary files or directories under a user-controlled path. The affected system does not correctly check if the relati...

Siemens SINEC NMS SQL注入漏洞

SINEC NMS is a network management system from Siemens for monitoring and managing industrial networks.A SQL injection vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1, which could be exploited by an attacker with privileged credentials to execute arbitrary commands in the loca...

PT-2021-20298 · Siemens · Sinec Nms

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1 Description: A vulnerability has been identified that allows an authenticated attacker to change the user profile of any user without proper authorization, potentially enabling them to change the...

CVE-2021-33730: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33736: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33724: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. The affected system contains an Arbitrary File Deletion vulnerability that possibly allows to delete an arbitrary file or directory under a user controlled path...

Siemens SINEC NMS 代码问题漏洞

SINEC NMS is a network management system from Siemens for monitoring and managing industrial networks. a code issue vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1. The vulnerability stems from the fact that the affected system allows the upload of JSON objects deserialized t...

CVE-2021-33723: Improper Authorization

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could change the user profile of any user without proper authorization. With this, the attacker could change the password of any user in the affected system...

PT-2021-20304

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1 Description: A vulnerability has been identified that allows an authenticated attacker to execute arbitrary commands in the local database by importing firmware containers to an affected system...

PT-2021-20307

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1 Description: A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the "webserver" of the affected application. Recommendations:...

PT-2021-20309

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1 Description: A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the "webserver" of the affected application. Recommendations:...

PT-2021-20302

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1 Description: A vulnerability has been identified that allows an authenticated attacker to download the user profile of any user, potentially leaking confidential information of any user in the...

PT-2021-20299

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1 Description: A vulnerability has been identified that contains an Arbitrary File Deletion issue, which possibly allows the deletion of an arbitrary file or directory under a user-controlled path...

PT-2021-20297

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1 Description: A Path Traversal issue exists when exporting a firmware container, allowing a privileged authenticated attacker to create arbitrary files on the affected system. Recommendations: For...