CVE-2024-1159

CVE-2024-1159 concerns the Bold Page Builder WordPress plugin. A stored cross-site scripting (XSS) flaw exists in all versions up to and including 4.8.0, caused by insufficient input sanitization and output escaping on shortcode attributes. Exploitation requires authenticated access at contributo...

CVE-2024-1160

CVE-2024-1160 : Bold Page Builder (WordPress) is vulnerable to Stored XSS via the plugin’s Icon Link in all versions up to and including 4.8.0 due to insufficient input sanitization and output escaping. Exploitation requires contributor-level or higher authentication, and scripts execute when use...

Design/Logic Flaw

A vulnerability has been identified in Polarion ALM All versions. The affected product is vulnerable due to weak file and folder permissions in the installation path. An attacker with local access could exploit this vulnerability to escalate privileges to NT AUTHORITY\SYSTEM...

Command injection

A vulnerability has been identified in SINEC NMS All versions V2.0 SP1. The affected application incorrectly neutralizes special elements when creating a report which could lead to command injection...

Code injection

A vulnerability has been identified in Polarion ALM All versions. The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code...

Out-of-bounds

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 All versions V2201.0012, Tecnomatix Plant Simulation V2302 All versions V2302.0006. The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. Th...

Design/Logic Flaw

A vulnerability has been identified in OpenPCS 7 V9.1 All versions, SIMATIC BATCH V9.1 All versions, SIMATIC PCS 7 V9.1 All versions, SIMATIC Route Control V9.1 All versions, SIMATIC WinCC Runtime Professional V18 All versions, SIMATIC WinCC Runtime Professional V19 All versions, SIMATIC WinCC V7...

CVE-2024-24924

Siemens Simcenter Femap is affected by CVE-2024-24924 (all versions

CVE-2024-24923

Summary of CVE-2024-24923 (Siemens Simcenter Femap): Affects Simcenter Femap with the following vulnerable versions: all < V2401.0000 and all

CVE-2024-24921

Siemens Simcenter Femap is affected by CVE-2024-24921 in all versions prior to V2401.0000. The issue is a memory corruption flaw triggered while parsing specially crafted Catia MODEL files, enabling code execution in the current process context (ZDI-CAN-21712). Mitigation per the sources is to up...

CVE-2024-24920

Siemens Simcenter Femap versions before V2401.0000 are affected by an out-of-bounds write when parsing a Catia MODEL file, allowing potential code execution in the current process (CVE-2024-24920; ZDI-CAN-21710). Affected product: Simcenter Femap; vulnerable component/file parsing Catia MODEL. Im...

CVE-2024-23812

CVE-2024-23812 affects Siemens SINEC NMS: all versions prior to 2.0 SP1 are vulnerable to OS command injection caused by incorrect neutralization of special elements when generating reports. The issue can lead to arbitrary command execution and has high impact on confidentiality, integrity, and a...

CVE-2024-23810

Siemens SINEC NMS is affected by CVE-2024-23810: all versions prior to 2.0 SP1 are vulnerable to SQL injection in the server database, potentially allowing an unauthenticated attacker to run arbitrary SQL queries. Sources consistently identify this CVE as a SQL-injection issue impacting SINEC NMS...

CVE-2024-23804

CVE-2024-23804 affects Siemens Tecnomatix Plant Simulation: stack overflow while parsing PSOBJ files in Tecnomatix Plant Simulation V2201 (pre-0012) and V2302 (pre-0006). This can allow code execution in the affected process (local attack; user interaction required). Remediation per sources: upda...

CVE-2024-23802

CVE-2024-23802 affects Siemens Tecnomatix Plant Simulation: V2201 before 0012 and V2302 before 0006 are vulnerable to an out-of-bounds read when parsing specially crafted SPP files, enabling code execution in the process context. Affected components are the SPP parser within Plant Simulation; roo...

CVE-2024-23800

CVE-2024-23800 affects Siemens Tecnomatix Plant Simulation, specifically versions V2201 through V2302.0006, with a null pointer dereference while parsing specially crafted SPP files. This vulnerability can cause the application to crash, yielding a denial-of-service condition. Affected products i...

CVE-2024-23798

The CVE-2024-23798 entry concerns Siemens Tecnomatix Plant Simulation. A stack overflow when parsing specially crafted WRL files affects Tecnomatix Plant Simulation V2201 before 0012 and V2302 before 0006. Exploitation could allow code execution in the current process. Vendors recommend updating:...

CVE-2024-23797

The CVE-2024-23797 entry affects Siemens Tecnomatix Plant Simulation V2201 (versions before V2201.0012) and V2302 (versions before V2302.0006). A stack overflow occurs while parsing specially crafted WRL files, enabling code execution in the current process. Documented fixes: update to V2201.0012...

CVE-2024-23796

CVE-2024-23796 affects Siemens Tecnomatix Plant Simulation: heap-based buffer overflow when parsing WRL files in Tecnomatix Plant Simulation V2201 before 0012 and V2302 before 0006. The vulnerability could allow code execution in the process context. Exploitation appears as a local issue with use...

CVE-2024-23795

Siemens Tecnomatix Plant Simulation is affected by CVE-2024-23795: an out-of-bounds write past the end of an allocated buffer while parsing a specially crafted WRL file, allowing code execution in the current process. Affected versions are Tecnomatix Plant Simulation V2201 prior to 0012 and V2302...