CVE-2019-18317

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could cause a Denial-of-Service condition by sending specifically crafted objects via RMI. This vulnerability is independent from...

CVE-2019-18317

CVE-2019-18317 relates to the SPPA-T3000 Application Server. All versions prior to Service Pack R8.2 SP2 are affected. The root issue is that an attacker who can access the server over the network can cause a Denial-of-Service by sending specially crafted objects via RMI. The Red Hat CVE entries ...

CVE-2019-18315

CVE-2019-18315 affects Siemens SPPA-T3000 Application Server (all versions prior to Service Pack R8.2 SP2). An attacker with network access can achieve remote code execution by sending specially crafted packets to port 8888/TCP. The issue stems from an improper/exposed interface on the Applicatio...

CVE-2019-18320

CVE-2019-18320 affects Siemens SPPA-T3000 Application Server (all versions prior to Service Pack R8.2 SP2). The vulnerability allows an attacker with network access to upload arbitrary files without authentication. Public exploits are not indicated in the provided documents; however, exploitation...

CVE-2019-18331

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could gain access to path and filenames on the server by sending specifically crafted packets to 1099/tcp. Please note that an attacke...

CVE-2019-18316

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with network access to the Application Server could gain remote code execution by sending specifically crafted packets to 1099/tcp. Please note that an attacker needs to have netwo...

CVE-2019-18331

CVE-2019-18331 affects Siemens SPPA-T3000 Application Server (all versions prior to Service Pack R8.2 SP2). The issue allows an unauthenticated attacker with network access to read path and filenames on the server by sending crafted packets to 1099/tcp. The vulnerability is classified as informat...

CVE-2019-18316

CVE-2019-18316 affects Siemens SPPA-T3000 Application Server (all versions prior to Service Pack R8.2 SP2). The root cause is a remote code execution vulnerability triggered by specially crafted packets sent to TCP port 1099, requiring the attacker to have network access to the Application Server...

CVE-2019-18283

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. The AdminService is available without authentication on the Application Server. An attacker can gain remote code execution by sending specifically crafted objects to one of its functions. Plea...

CVE-2019-18288

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. An attacker with valid authentication at the RMI interface could be able to gain remote code execution through an unsecured file upload. Please note that an attacker needs to have access to th...

CVE-2019-18286

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. The Application Server exposes directory listings and files containing sensitive information. This vulnerability is independent from CVE-2019-18287. Please note that an attacker needs to have...

CVE-2019-18286

CVE-2019-18286 affects the SPPA-T3000 Application Server (all versions

CVE-2019-18287

CVE-2019-18287 affects the SPPA-T3000 Application Server (all versions

CVE-2019-18285

A vulnerability has been identified in SPPA-T3000 Application Server All versions Service Pack R8.2 SP2. The RMI communication between the client and the Application Server is unencrypted. An attacker with access to the communication channel can read credentials of a valid user. Please note that ...

CVE-2019-18284

CVE-2019-18284 affects Siemens SPPA-T3000 Application Server (all versions before Service Pack R8.2 SP2). The AdminService is accessible without authentication, allowing an attacker to obtain password hashes and change passwords, requiring access to the Application Highway to exploit. Public expl...

CVE-2019-7004

A Cross-Site Scripting XSS vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not...

CVE-2019-7004

A Cross-Site Scripting XSS vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not...

Cross site scripting

A Cross-Site Scripting XSS vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not...

Siemens SPPA-T3000 Application Server Improper Authentication Vulnerability (CNVD-2019-45373)

SPPA-T3000 is a distributed control system mainly used in thermal power plants and large-scale renewable energy power plants.Application Server is the application server in it, which provides the main system services including access control, distribution of data to thin clients and archiving. A...

CVE-2019-7004

Avaya IP Office Application Server 11.x WebUI is vulnerable to Cross-Site Scripting (XSS) in the login page (via POST) due to improper input sanitization. Exploitation exists (POST username) and could execute arbitrary JavaScript in a user’s browser. Affected versions include 11.x up to 11.0 FP4 ...