Design/Logic Flaw

A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. An attacker with network access to port 23/tcp could extract internal communication data or cause a Denial-of-Service condition. Successful exploitation requires network access to a vulnerable device. At the time o...

Cross site scripting

A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. The integrated web server of the affected CP devices could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked into following a malicious link. User interaction is required for a successful...

Cross site request forgery (csrf)

A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation...

CVE-2019-6575

CVE-2019-6575 affects Siemens industrial products using OPC UA, including SIMATIC CP443-1 OPC UA, ET 200 Open Controller CPU 1515SP PC2, HMI Outdoor Panels (7"/15"), HMI Comfort Panels (4"–22"), KTP Mobile Panels, IPC DiagMonitor, NET PC Software, RF188C, RF600R, S7‑1500 family, WinCC OA/Runtime,...

CVE-2018-13808

Siemens CP1604/CP1616 devices (all versions) expose a vulnerability on port 23/tcp where an attacker with network access can either extract internal communication data or cause a Denial-of-Service. The issue is described as cleartext transmission of sensitive information, enabling eavesdropping o...

CVE-2018-13809

A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. The integrated web server of the affected CP devices could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked into following a malicious link. User interaction is required for a successful...

CVE-2018-13810

A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation...

CVE-2018-13810

Siemens CP1604 and CP1616 devices (all versions) are affected by CVE-2018-13810, a Cross-Site Request Forgery (CSRF) vulnerability in the integrated configuration web server. Exploitation requires a user to click a malicious link and perform actions through the web interface with the user’s legit...

CVE-2018-13808

A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. An attacker with network access to port 23/tcp could extract internal communication data or cause a Denial-of-Service condition. Successful exploitation requires network access to a vulnerable device. At the time o...

CVE-2018-13809

CVE-2018-13809 affects Siemens CP1604 and CP1616 devices. The vulnerability arises from Improper Neutralization of Input During Web Page Generation (XSS) in the devices’ integrated web server, allowing an attacker to craft a malicious link that could execute script in a logged-in user’s browser. ...

CVE-2018-13809: Improper Neutralization of Input During Web Page Generation

A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. The integrated web server of the affected CP devices could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked into following a malicious link. User interaction is required for a successful...

CVE-2018-13810: Cross-Site Request Forgery (CSRF)

A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation...

CVE-2018-13808: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been identified in CP 1604 All versions, CP 1616 All versions. An attacker with network access to port 23/tcp could extract internal communication data or cause a Denial-of-Service condition. Successful exploitation requires network access to a vulnerable device. At the time o...

PT-2019-2034 · Siemens · Simatic Hmi Comfort Outdoor Panels 7" & 15" +16

Name of the Vulnerable Software and Affected Versions: SIMATIC CP 443-1 OPC UA versions prior to the fixed version SIMATIC ET 200SP Open Controller CPU 1515SP PC2 versions prior to V2.7 SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V15.1 Upd 4 SIMATIC HMI Comfort Panels 4" - 22"...

CVE-2019-1002101: Improper Link Resolution Before File Access

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could r...

openSUSE Security Update : containerd / docker / docker-runc / etc (openSUSE-2019-1079)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues : Security issues fixed : - CVE-2018-16875: Fixed a CPU Denial of Service bsc1118899. - CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in...

CVE-2018-13798

Siemens SICAM A8000 RTU series (CP-8000 < v14, CP-802X < v14, CP-8050

CVE-2018-13798: Improper Input Validation

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V14, SICAM A8000 CP-802X All versions V14, SICAM A8000 CP-8050 All versions V2.00. Specially crafted network packets sent to port 80/TCP or 443/TCP could allow an unauthenticated remote attacker to cause a Denial-of-Service...

CVE-2019-9646

The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cpadminintedition.inc.php in the "custom edition area."...

PT-2019-19772

Name of the Vulnerable Software and Affected Versions Contact Form Email plugin versions prior to 1.2.66 Description The issue allows for XSS in the wp-admin/admin.php item, related to the custom edition area in the cp admin int edition.inc.php file. Recommendations For versions prior to 1.2.66,...