CVE-2021-37198

Siemens COMOS Web Component CSRF vulnerability (CVE-2021-37198) affects COMOS Web when web components are used: v10.2 all versions; v10.3 all versions before 10.3.3.3; v10.4 all versions before 10.4.1. The issue stems from a flawed CSRF prevention implementation, enabling cross-site request forge...

CVE-2021-37198

A vulnerability has been identified in COMOS V10.2 All versions only if web components are used, COMOS V10.3 All versions V10.3.3.3 only if web components are used, COMOS V10.4 All versions V10.4.1 only if web components are used. The COMOS Web component of COMOS uses a flawed implementation of...

CVE-2021-37198

A vulnerability has been identified in COMOS V10.2 All versions only if web components are used, COMOS V10.3 All versions V10.3.3.3 only if web components are used, COMOS V10.4 All versions V10.4.1 only if web components are used. The COMOS Web component of COMOS uses a flawed implementation of...

CVE-2021-37197

Siemens COMOS Web component is affected by SQL injection (CVE-2021-37197). Affected: COMOS V10.2 (all versions when web components are used), V10.3 (all versions before 10.3.3.3 when web components are used), V10.4 (all versions before 10.4.1 when web components are used). Root cause: SQL injecti...

CVE-2021-37197

A vulnerability has been identified in COMOS V10.2 All versions only if web components are used, COMOS V10.3 All versions V10.3.3.3 only if web components are used, COMOS V10.4 All versions V10.4.1 only if web components are used. The COMOS Web component of COMOS is vulnerable to SQL injections...

CVE-2021-37195

A vulnerability has been identified in COMOS V10.2 All versions only if web components are used, COMOS V10.3 All versions V10.3.3.3 only if web components are used, COMOS V10.4 All versions V10.4.1 only if web components are used. The COMOS Web component of COMOS accepts arbitrary code as...

CVE-2021-37196

A vulnerability has been identified in COMOS V10.2 All versions only if web components are used, COMOS V10.3 All versions = V10.3.3.3 only if web components are used, COMOS V10.4 All versions V10.4.1 only if web components are used. The COMOS Web component of COMOS unpacks specially crafted archi...

CVE-2021-37195

CVE-2021-37195 affects Siemens COMOS Web component involving the loading of attachments in tasks. Affected: COMOS V10.2 (all versions when web components are used); V10.3 (all versions before 10.3.3.3, only if web components are used); V10.4 (all versions before 10.4.1, only if web components are...

CVE-2021-37196

Siemens COMOS Web component contains a path traversal vulnerability (CVE-2021-37196) affecting COMOS Web in V10.2 (all versions when web components are used), V10.3 (before 10.3.3.3; and all versions ≥ 10.3.3.3 if web components are used), and V10.4 (before 10.4.1 if web components are used). The...

CVE-2021-37198: Cross-Site Request Forgery (CSRF)

A vulnerability has been identified in COMOS V10.2 All versions only if web components are used, COMOS V10.3 All versions V10.3.3.3 only if web components are used, COMOS V10.4 All versions V10.4.1 only if web components are used. The COMOS Web component of COMOS uses a flawed implementation of...

PT-2022-10641

Name of the Vulnerable Software and Affected Versions COMOS versions V10.2 through V10.4.1, specifically versions V10.2, V10.3 through V10.3.3.3, and V10.4 through V10.4.1, when web components are used. Description A SQL injection issue has been identified in the COMOS Web component, allowing an...

Siemens Comos Cross-site Request Forgery Vulnerability

COMOS is a unified data platform for collaborative plant design, operations, and management that supports the collection, processing, preservation, and distribution of information throughout the plant lifecycle.A cross-site request forgery vulnerability exists in the Siemens COMOS Web component,...

Siemens Comos cross-site scripting vulnerability

COMOS is a unified data platform for collaborative plant design, operations, and management that supports the collection, processing, storage, and distribution of information throughout the plant lifecycle.A cross-site scripting vulnerability exists in the Siemens COMOS Web component that could b...

PT-2022-10640

Name of the Vulnerable Software and Affected Versions COMOS versions prior to 10.4.1 Description A vulnerability has been identified in the COMOS Web component, which unpacks specially crafted archive files to relative paths. This could allow an attacker to store files in any folder accessible by...

Siemens Comos path traversal vulnerability

COMOS is a unified data platform for collaborative plant design, operations, and management that supports the collection, processing, storage, and distribution of information throughout the plant lifecycle.A path traversal vulnerability exists in the Siemens COMOS Web component, which could be...

Siemens Comos SQL injection vulnerability

COMOS is a unified data platform for collaborative plant design, operations and management that supports the collection, processing, storage and distribution of information throughout the plant lifecycle.A SQL injection vulnerability exists in the Siemens COMOS Web component, which can be exploit...

PT-2022-10642

Name of the Vulnerable Software and Affected Versions COMOS versions V10.2 through V10.4.1, but only if web components are used, specifically: COMOS V10.2 COMOS versions V10.3 through V10.3.3.2 COMOS versions V10.4 through V10.4.0 Description A vulnerability has been identified in the COMOS Web...

Siemens COMOS Web (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: COMOS Vulnerabilities: Basic XSS, Relative Path Traversal, SQL Injection, Cross-site Request Forgery 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update...

PT-2022-10639

Name of the Vulnerable Software and Affected Versions COMOS versions V10.2 through V10.4.1, but only if web components are used, specifically: COMOS V10.2 COMOS versions V10.3 through V10.3.3.2 COMOS versions V10.4 through V10.4.0 Description A vulnerability has been identified in the COMOS Web...

CVE-2021-37196: Relative Path Traversal

A vulnerability has been identified in COMOS V10.2 All versions only if web components are used, COMOS V10.3 All versions = V10.3.3.3 only if web components are used, COMOS V10.4 All versions V10.4.1 only if web components are used. The COMOS Web component of COMOS unpacks specially crafted archi...