CVE-2021-31894

CVE-2021-31894 affects Siemens SIMATIC PCS 7 family, PDM, STEP 7, and SINAMICS STARTER with write-permission metafiles. The issue stems from an incorrect permission assignment for a critical resource (metafile directory), allowing an attacker to alter metafile contents and subsequently influence ...

CVE-2021-31893

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3, SIMATIC PDM All versions V9.2, SIMATIC STEP 7 V5.X All versions V5.6 SP2 HF3, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 HF2. The affected software...

PT-2021-19568

Name of the Vulnerable Software and Affected Versions: SIMATIC PCS 7 versions 8.2 and earlier SIMATIC PCS 7 V9.0 versions prior to V9.0 SP3 SIMATIC PDM versions prior to V9.2 SIMATIC STEP 7 V5.X versions prior to V5.6 SP2 HF3 SINAMICS STARTER containing STEP 7 OEM version versions prior to V5.4 H...

CVE-2021-31893: Buffer Copy without Checking Size of Input

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3, SIMATIC PDM All versions V9.2, SIMATIC STEP 7 V5.X All versions V5.6 SP2 HF3, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 HF2. The affected software...

CVE-2021-31894: Incorrect Permission Assignment for Critical Resource

A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier All versions, SIMATIC PCS 7 V9.X All versions V9.1 SP2, SIMATIC PDM All versions V9.2 SP2, SIMATIC STEP 7 V5.X All versions V5.7, SINAMICS STARTER containing STEP 7 OEM version All versions V5.4 SP2 HF1. A directory containing...

Siemens SIMATIC PCS 7 安全漏洞

Siemens SIMATIC PCS 7 is a process control system from Siemens, Germany.SIMATIC STEP 7 V5.X is the classic engineering software for configuring and programming SIMATIC S7-300/S7-400/C7/WinAC controllers.STARTER is the drive engineering tool for parameterization and debugging. A remote code...

aero.champ:cargojson (1.0), ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8, <=0.1.12) +16722 more potentially affected by CVE-2017-5929 via ch.qos.logback:logback-core (>=1.0.0, <=1.1.11)

ch.qos.logback:logback-core MAVEN version =1.0.0, =0.1.8, =0.1.6, =0.1.4-sb1x, =0.11.0, =0.7.0, =0.6.1, =0.11.0, =0.6.1, =0.13.0 and more Source cves: CVE-2017-5929 Source advisory: OSV:GHSA-VMFG-RJJM-RJRJ...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (3.0.4), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (3.0.4) +285 more potentially affected by CVE-2021-23937 via org.apache.wicket:wicket-core (>=9.0.0, <=9.2.0)

org.apache.wicket:wicket-core MAVEN version =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.2.1 and more Source cves: CVE-2021-23937 Source advis...

com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=3.0.1-rc, <=3.0.3-rc), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=3.0.1-rc, <=3.0.3-rc) +271 more potentially affected by CVE-2020-11976 via org.apache.wicket:wicket-core (>=9.0.0-m1, <=9.0.0-m5)

org.apache.wicket:wicket-core MAVEN version =9.0.0-m1, =3.0.1-rc, =3.0.1-rc, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m5.1 - com.googlecode.wick...

io.undertow:undertow-servlet (1.1.9.final), io.undertow:undertow-websockets-jsr (1.1.9.final) +1 more potentially affected by CVE-2020-10719 via io.undertow:undertow-core (1.1.9.final)

io.undertow:undertow-core MAVEN version 1.1.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.9.final - io.undertow:undertow-websockets-jsr 1.1.9.final -...

io.undertow:undertow-servlet (1.1.7.final), io.undertow:undertow-websockets-jsr (1.1.7.final) +1 more potentially affected by CVE-2020-10719 via io.undertow:undertow-core (1.1.7.final)

io.undertow:undertow-core MAVEN version 1.1.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.7.final - io.undertow:undertow-websockets-jsr 1.1.7.final -...

io.undertow:undertow-servlet (1.3.28.final), io.undertow:undertow-websockets-jsr (1.3.28.final) +1 more potentially affected by CVE-2020-10719 via io.undertow:undertow-core (1.3.28.final)

io.undertow:undertow-core MAVEN version 1.3.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.28.final - io.undertow:undertow-websockets-jsr 1.3.28.final -...

com.alibaba.nacos:nacos-client (0.9.0), org.nutz:nutzboot-starter-nacos-config-client (>=2.3.1.v20190318, <=2.3.7.v20190731) potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.9.0)

com.alibaba.nacos:nacos-common MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.nacos:nacos-client 0.9.0 - org.nutz:nutzboot-starter-nacos-config-client...

org.smartboot.flow:smart-flow-admin (>=1.0.8, <=1.1.4), org.smartboot.servlet:smart-servlet-maven-plugin (>=0.1.9, <=0.6) +1 more potentially affected by CVE-2021-29425 via org.smartboot.servlet:servlet-core (>=0.1.9, <=0.6)

org.smartboot.servlet:servlet-core MAVEN version =0.1.9, =1.0.8, =0.1.9, =0.1.9, =0.6 Source cves: CVE-2021-29425 Source advisory: OSV:GHSA-GWRP-PVRQ-JMWV...

org.smartboot.flow:smart-flow-admin (>=1.0.8, <=1.1.4), org.smartboot.servlet:smart-servlet-maven-plugin (>=0.1.9, <=0.6) +1 more potentially affected by CVE-2021-29425 via org.smartboot.servlet:servlet-core (>=0.1.9, <=0.6)

org.smartboot.servlet:servlet-core MAVEN version =0.1.9, =1.0.8, =0.1.9, =0.1.9, =0.6 Source cves: CVE-2021-29425 Source advisory: GHSA-GWRP-PVRQ-JMWV...

Security Bulletin: IBM Security Verify Information Queue uses a Node.js proxy library that has a known vulnerability (183561)

Summary The web server in IBM Security Verify Information Queue ISIQ uses an older version of the http-proxy package that has a known vulnerability to a denial of service. As of v10.0.0, ISIQ has upgraded to a newer, secure version of http-proxy. Vulnerability Details Third Party Entry: 183561...

Security Bulletin: IBM Security Verify Information Queue does not properly encode error messages sent to web users (CVE-2021-20405)

Summary When an error occurs while using the IBM Security Verify Information Queue ISIQ web application, the status messages sent back to the user are not properly encoded. This could lead to information disclosure, which could then be leveraged in a phishing attack. As of v10.0.0, the ISIQ web...

Security Bulletin: IBM Security Verify Information Queue could reveal sensitive data in application error messages (CVE-2021-20402)

Summary In response to certain application errors, IBM Security Verify Information Queue ISIQ could output messages that contain sensitve data, which could then be used to gain unauthorized system access. As of v10.0.0, ISIQ no longer includes sensitve data when outputting error messages...

多款Siemens产品输入验证错误漏洞

Siemens SENTRON PAC3200 is a multifunctional power meter for industrial environments.Siemens SENTRON PAC4200 is a multifunctional power meter for industrial environments.Siemens SENTRON PAC4200 is a multifunctional power meter for industrial environments.Siemens SIRIUS 3RW5 is a soft start device...

org.hswebframework:hsweb-task-cluster (1.0.0-rc), org.hswebframework:hsweb-task-core (1.0.0-rc) +1 more potentially affected by CVE-2020-26238 via com.cronutils:cron-utils (7.0.5)

com.cronutils:cron-utils MAVEN version 7.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.cronutils:cron-utils and may be impacted: - org.hswebframework:hsweb-task-cluster 1.0.0-rc - org.hswebframework:hsweb-task-core 1.0.0-rc -...