CVE-2019-19290

CVE-2019-19290 affects Siemens/SINVR CCS (Control Center Server) prior to v1.5.0. A path traversal vulnerability in the CCS web interface DOWNLOADS area could allow an authenticated remote attacker to access/download arbitrary server files. The issue is explicitly tied to CCS versions

CVE-2019-19294

CVE-2019-19294 (Siemens CCS) : The Control Center Server (CCS) web interface contains multiple stored XSS vulnerabilities in several input fields for all versions before 1.5.0. An authenticated remote attacker could inject malicious JavaScript that executes in other users’ browsers when they view...

CVE-2019-19293

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The web interface of the Control Center Server CCS contains a reflected Cross-site Scripting XSS vulnerability that could allow an unauthenticated remote attacker to steal sensitive data or execute administrativ...

CVE-2019-19295

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS does not enforce logging of security-relevant activities in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. An authenticated remote...

CVE-2019-19293

CVE-2019-19293 is a reflected cross-site scripting (XSS) vulnerability in the Control Center Server (CCS) web interface affecting all CCS versions prior to v1.5.0. An unauthenticated remote attacker could steal sensitive data or execute administrative actions on behalf of a CCS administrator. Roo...

CVE-2019-19295

Summary of CVE-2019-19295 (CVE List entry): The vulnerability affects Siemens/Sinogram CCS (Control Center Server) prior to v1.5.0, where the XML-based communication protocol on ports 5444/tcp and 5440/tcp does not enforce logging of security-relevant activities by default. An authenticated remot...

CVE-2019-19292

CVE-2019-19292 affects Siemens CCS (Control Center Server): SQL injection in the XML-based protocol on ports 5444/TCP and 5440/TCP affecting all CCS versions before v1.5.0. An authenticated remote attacker could read/modify the CCS database and potentially perform administrative database operatio...

CVE-2019-18337

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS contains an authentication bypass vulnerability in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. A remote attacker with network access ...

Design/Logic Flaw

A vulnerability has been identified in Control Center Server CCS All versions = V1.5.0, SiNVR/SiVMS Video Server All versions = V5.0.0. Both the SiVMS/SiNVR Video Server and the Control Center Server CCS store user and device passwords by applying weak cryptography. A local attacker could exploit...

CVE-2019-18342

CVE-2019-18342 affects Siemens/PKE Control Center Server (CCS). All versions prior to v1.5.0 are vulnerable. The CCS SFTP service on port 22 does not properly limit its capabilities to the intended function. In conjunction with CVE-2019-18341, an unauthenticated remote attacker with network acces...

CVE-2019-18338

CVE-2019-18338 describes a directory traversal vulnerability in Siemens/SiNVR CCS, affecting all versions before v1.5.0. The flaw exists in the XML-based communication protocol exposed by default on ports 5444/tcp and 5440/tcp, allowing an authenticated remote attacker with network access to list...

CVE-2019-18337

CVE-2019-18337 affects Siemens/CCS: an authentication bypass in CCS’s XML-based protocol (default ports 5444/5440) allows remote attackers to read the CCS user database, including obfuscated passwords, for all versions

CVE-2019-18341

CVE-2019-18341 / 18342 (Siemens CCS) affects Control Center Server (CCS) with versions prior to 1.5.0. The SFTP service (default port 22) contains an authentication bypass (CVE-2019-18341) and, combined with CVE-2019-18342, an issue where capabilities are not properly limited, enabling an unauthe...

CVE-2019-18340

The CVE-2019-18340 vulnerability concerns weak cryptography used to store user and device passwords in both Siemens/ PKE SiNVR/SiVMS Video Server and the Control Center Server (CCS). A local attacker could extract passwords from the user database or device configuration files. Affected products i...

CVE-2019-18337

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS contains an authentication bypass vulnerability in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. A remote attacker with network access ...

CVE-2019-13947

Summary (CVE-2019-13947) : In Siemens/SiNVR/CCS Control Center Server, versions prior to v1.5.0 expose a vulnerability where the web GUI transfers user passwords in clear text to the browser. An authenticated administrator can read other users’ passwords, not just reset them. The issue is documen...

CVE-2019-13415

Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...

Cross site scripting

Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote clusters...

CVE-2019-13415

Search Guard versions before 24.3 had an issue when Cross Cluster Search CCS was enabled, authenticated users can gain read access to data they are not authorized to see...

CVE-2019-13415

CVE-2019-13415 affects floragunn Search Guard (pre-24.3) where Cross Cluster Search (CCS) enabled allows authenticated users to read data they are not authorized to see. Root cause is an authorization issue in versions before 24.3; impact is unauthorized data exposure when CCS is used. Connected ...