CVE-2019-19291

CVE-2019-19291 affects Siemens CCS and SiNVR/SiVMS Video Server. The FTP services store login credentials in cleartext in log files, enabling authenticated remote attackers to extract credentials when FTP is enabled. Affected: CCS before v1.5.0 and Video Server before v5.0.0. Mitigation: upgrade ...

CVE-2019-19295

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS does not enforce logging of security-relevant activities in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. An authenticated remote...

CVE-2019-19295

Summary of CVE-2019-19295 (CVE List entry): The vulnerability affects Siemens/Sinogram CCS (Control Center Server) prior to v1.5.0, where the XML-based communication protocol on ports 5444/tcp and 5440/tcp does not enforce logging of security-relevant activities by default. An authenticated remot...

CVE-2019-19292

CVE-2019-19292 affects Siemens CCS (Control Center Server): SQL injection in the XML-based protocol on ports 5444/TCP and 5440/TCP affecting all CCS versions before v1.5.0. An authenticated remote attacker could read/modify the CCS database and potentially perform administrative database operatio...

CVE-2019-19293

CVE-2019-19293 is a reflected cross-site scripting (XSS) vulnerability in the Control Center Server (CCS) web interface affecting all CCS versions prior to v1.5.0. An unauthenticated remote attacker could steal sensitive data or execute administrative actions on behalf of a CCS administrator. Roo...

CVE-2019-19294

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The web interface of the Control Center Server CCS contains multiple stored Cross-site Scripting XSS vulnerabilities in several input fields. This could allow an authenticated remote attacker to inject malicious...

PT-2020-2443 · Siemens · Control Center Server +1

Name of the Vulnerable Software and Affected Versions: Control Center Server CCS versions prior to V1.5.0 SiNVR/SiVMS Video Server versions prior to V5.0.0 Description: A vulnerability has been identified where the FTP services of the SiVMS/SiNVR Video Server and the Control Center Server CCS...

PT-2020-2445 · Unknown · Control Center Server +2

Name of the Vulnerable Software and Affected Versions: Control Center Server CCS versions prior to V1.5.0 SiNVR 3 Central Control Server all versions SiNVR 3 Video Server all versions Description: A reflected Cross-site Scripting XSS vulnerability has been identified in the web interface of the...

PT-2020-2444 · Unknown · Control Center Server

Name of the Vulnerable Software and Affected Versions: Control Center Server versions prior to V1.5.0 Description: The issue is related to a lack of protection against SQL query structure exploitation. This can be exploited by a remote attacker to read or modify the central control server databas...

PT-2020-2446 · Unknown · Control Center Server

Name of the Vulnerable Software and Affected Versions: Control Center Server CCS versions prior to V1.5.0 Description: A stored Cross-site Scripting XSS vulnerability has been identified in the web interface of the Control Center Server CCS. This issue is related to the lack of input data...

PT-2020-2447 · Sinvr · Sinvr 3 Central Control Server +2

Name of the Vulnerable Software and Affected Versions: Control Center Server CCS versions prior to V1.5.0 SiNVR 3 Central Control Server all versions SiNVR 3 Video Server all versions Description: A vulnerability has been identified in the Control Center Server CCS and SiNVR 3 Central Control...

Security Bulletin: IBM WebSphere Application Server - Liberty improper session validation vulnerability affects IBM Control Center (CVE-2019-4304)

Summary IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by improper session validation. Vulnerability Details CVEID: CVE-2019-4304 DESCRIPTION: IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass securi...

Security Bulletin: Websphere denial-of-service vulnerability affects IBM Control Center (CVE-2019-12402)

Summary The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress...

Security Bulletin: Java Vulnerability Impacts IBM Control Center (CVE-2019-2989)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Technology Edition, Version 7 and 8 that is used by IBM Control Center. The issue was disclosed as part of the IBM Java SDK update in October 2019. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified vulnerabili...

Security Bulletin: WebSphere Application Server browser stack trace vulnerability affects IBM Control Center (CVE-2019-4441)

Summary Webspher Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser Vulnerability Details CVEID: CVE-2019-4441 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain...

Security Bulletin: WebSphere Application Server improper cookie setting vulnerability affects IBM Control Center (CVE-2019-4305)

Summary WebSphere Application Server in IBM Control Center could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. Vulnerability Details CVEID: CVE-2019-4305 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to...

Security Bulletin: Vulnerability in Apache PDFBox Affects IBM Control Center (CVE-2019-0228)

Summary Vulnerability in Apache PDFBox Affects IBM Control Center CVE-2019-0228 Vulnerability Details CVEID: CVE-2019-0228 DESCRIPTION: Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity XXE attacks via a craft...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling Control Center

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 7 that is used by IBM Control Center. These issues were disclosed as part of the IBM Java SDK updates in April and July 2015. Vulnerability Details CVEID: CVE-2015-2613 DESCRIPTION: An...

Security Bulletin: Vulnerability in SSLv3 affects Sterling Control Center (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Sterling Control Center Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive...

Security Bulletin: HTTP response splitting vulnerability in IBM WebSphere Application Server affects IBM Control Center (CVE-2015-2017)

Summary IBM WebSphere Application Server is shipped as a component of IBM Control Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin Security Bulletin:...