CVE-2025-6965

CVE-2025-6965 affects SQLite prior to 3.50.2, where the number of aggregate terms could exceed available columns, causing a memory corruption issue. The description in the Initial document notes upgrading to 3.50.2 or newer as the recommended fix. Connected documents corroborate the vulnerability...

CVE-2024-27943

Siemens RUGGEDCOM CROSSBOW is affected by CVE-2024-27943 (all versions

CVE-2024-27942

Consolidated details for CVE-2024-27942: RUGGEDCOM CROSSBOW is affected in all versions prior to V5.5. The flaw allows any unauthenticated client to disconnect an active user from the server, enabling a denial-of-service condition. CVSS base score 7.5 ( HIGH ), network attack vector, low complexi...

CVE-2024-27939

CVE-2024-27939 affects Siemens RUGGEDCOM CROSSBOW prior to version V5.5. The issue is missing authorization that allows an unauthenticated user to upload arbitrary files, enabling potential remote arbitrary code execution with system privileges. Public sources (Red Hat/Red Hat support and ICS adv...

CVE-2024-27946

CVE-2024-27946 affects Siemens RUGGEDCOM CROSSBOW (all versions before V5.5). The issue is a path traversal/file download weakness that lets an attacker overwrite arbitrary files in the installation directory by supplying a target filename, given the attacker has the required privileges. Affected...

CVE-2024-27941

CVE-2024-27941 affects Siemens RUGGEDCOM CROSSBOW (all versions prior to V5.5). The root cause is improper input data sanitization before sending data to the SQL server, enabling SQL injection that could compromise the entire database. Public references from multiple sources corroborate a SQL inj...

CVE-2024-27945

Affected product: Siemens RUGGEDCOM CROSSBOW. Vulnerability: External control of file name or path via the bulk import feature, enabling a privileged user to upload files to the root installation directory and potentially tamper files or achieve remote code execution. Root cause/vector: Bulk impo...

CVE-2023-27462

Siemens RUGGEDCOM CROSSBOW (all versions

CVE-2023-27309

Affected product: Siemens RUGGEDCOM CROSSBOW, all versions

CVE-2023-37372

CVE-2023-37372 concerns Siemens RUGGEDCOM CROSSBOW server application. Affected: CROSSBOW versions before V5.4. Issue: SQL injection vulnerability in the application allowing an unauthenticated remote attacker to execute arbitrary SQL queries on the server database. Impact: high confidentiality, ...

CVE-2023-37373

CVE-2023-37373 affects Siemens RUGGEDCOM CROSSBOW prior to V5.4. The flaw allows an unauthenticated remote attacker to write arbitrary files to the device filesystem via an unauthenticated function. Siemens’ advisory SSA-472630 (and CISA ICS doc ICSA-23-222-05) indicate this vulnerability is expl...

CVE-2023-27463

CVE-2023-27463 affects Siemens RUGGEDCOM CROSSBOW prior to v5.3. The audit log form is vulnerable to SQL injection, allowing authenticated remote attackers to execute arbitrary SQL queries on the server database (CVSSv3.1 base score 8.8, HIGH impact). Documented mitigation: update to V5.3 or late...

CVE-2024-27940

CVE-2024-27940 affects Siemens/RUGGEDCOM CROSSBOW (versions prior to V5.5). Multiple sources confirm an SQL injection vulnerability that allows any authenticated user to send arbitrary SQL commands to the SQL server, potentially compromising the entire database. Publicly documented impact include...

CVE-2023-27310

Siemens RUGGEDCOM CROSSBOW (all versions prior to V5.2) contains a missing-authorization vulnerability in the client query handler: when assigning groups to user accounts, it does not properly enforce permissions, potentially allowing an authenticated remote attacker to elevate privileges by addi...

CVE-2024-27944

Siemens RUGGEDCOM CROSSBOW is affected by CVE-2024-27944 (and related CVEs in the same advisory) for all versions prior to V5.5. The issue is external control of file name or path in the Firmware Upload Handler, enabling a privileged user to upload firmware to the root installation directory and ...

CVE-2023-27411

Siemens RUGGEDCOM CROSSBOW is affected by a SQL injection vulnerability in all versions prior to V5.4. The flaw allows an authenticated remote attacker to execute arbitrary SQL queries on the server database and escalate privileges. Siemens/Red Hat/NVD references consistently identify SQL injecti...

CVE-2024-27947

CVE-2024-27947 affects Siemens RUGGEDCOM CROSSBOW (all versions prior to v5.5). The issue is information disclosure where log messages can be forwarded to a specific client under certain circumstances, enabling an attacker to forward logs to a compromised client. Connected advisories consistently...