Latest siemens sinec ins Vulnerabilities

● CVE-2023-48429

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices does not check the length of parameters in certain conditions. This allows a malicio...

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

Siemens Sinec Ins=1.0-sp1

Siemens Sinec Ins=1.0-sp2

Siemens Sinec Ins=1.0-sp2_update_1

● CVE-2023-48427

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the configured UMC server. This could allow an attack...

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

Siemens Sinec Ins=1.0-sp1

Siemens Sinec Ins=1.0-sp2

Siemens Sinec Ins=1.0-sp2_update_1

● CVE-2022-45092

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affected product, could p...

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

Siemens Sinec Ins=1.0-sp1

Siemens Sinec Ins=1.0-sp2

● CVE-2022-45094

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

Siemens Sinec Ins=1.0-sp1

Siemens Sinec Ins=1.0-sp2

● CVE-2022-45093

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

Siemens Sinec Ins=1.0-sp1

Siemens Sinec Ins=1.0-sp2

● CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

redhat/nodejs<1:16.17.1-1.el9_0

redhat/nodejs<1:16.18.1-3.el9_1

redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.15.0<14.20.1

Nodejs Node.js>=16.0.0<=16.12.0

and 9 more

● CVE-2022-35255

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems w...

redhat/nodejs<1:16.17.1-1.el9_0

Nodejs Node.js>=15.0.0<=15.14.0

Nodejs Node.js>=16.0.0<=16.12.0

Nodejs Node.js>=16.13.0<16.17.1

Nodejs Node.js>=18.0.0<18.9.1

Siemens Sinec Ins<1.0

and 5 more

● CVE-2022-32222

A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-ad...

Nodejs Node.js>=18.0.0<18.5.0

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

Siemens Sinec Ins=1.0-sp1

Siemens Sinec Ins=1.0-sp2

● CVE-2022-32212

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly...

redhat/nodejs<14.20.0

redhat/nodejs<16.20.0

redhat/nodejs<18.5.0

redhat/nodejs<1:16.16.0-1.el9_0

redhat/rh-nodejs14-nodejs<0:14.20.0-2.el7

Nodejs Node.js>=14.0.0<=14.14.0

and 13 more

● CVE-2022-32213

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Llhttp Llhttp<2.1.5

Llhttp Llhttp>=6.0.0<6.0.7

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.15.0<14.20.1

Nodejs Node.js>=16.0.0<=16.12.0

Nodejs Node.js>=16.13.0<16.17.1

and 15 more

● CVE-2022-32215

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

Llhttp Llhttp>=14.0.0<14.20.1

Llhttp Llhttp>=16.0.0<16.17.1

Llhttp Llhttp>=18.0.0<18.9.1

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.15.0<14.20.0

Nodejs Node.js>=16.0.0<=16.12.0

and 16 more

● CVE-2022-2097

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data tha...

redhat/openssl<1:1.1.1k-7.el8_6

redhat/openssl<1:3.0.1-41.el9_0

OpenSSL OpenSSL>=1.1.1<1.1.1q

OpenSSL OpenSSL>=3.0.0<3.0.5

Fedoraproject Fedora=35

Fedoraproject Fedora=36

and 40 more

● CVE-2022-2068

OpenSSL could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the c_rehash script. By sending a specially-crafted request u...

redhat/jbcs-httpd24-openssl<1:1.1.1k-13.el8

redhat/jbcs-httpd24-openssl<1:1.1.1k-13.el7

redhat/openssl<1:1.1.1k-7.el8_6

redhat/openssl<1:3.0.1-41.el9_0

redhat/jws5-tomcat-native<0:1.2.31-11.redhat_11.el7

redhat/jws5-tomcat-native<0:1.2.31-11.redhat_11.el8

and 95 more

● CVE-2022-0396

BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE...

redhat/bind9.16<32:9.16.23-0.9.el8.1

redhat/bind<32:9.16.23-5.el9_1

ISC BIND>=9.16.11<9.16.27

ISC BIND>=9.17.0<=9.18.0

Fedoraproject Fedora=34

and 39 more

● CVE-2021-25220

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, ...

redhat/bind<32:9.11.4-26.P2.el7_9.13

redhat/bind9.16<32:9.16.23-0.9.el8.1

redhat/bind<32:9.11.36-5.el8

redhat/bind<32:9.16.23-5.el9_1

redhat/dhcp<12:4.4.2-17.b1.el9

ISC BIND>=9.11.0<9.11.37

and 184 more

● CVE-2021-4160

OpenSSL could provide weaker than expected security, caused by a carry propagation flaw in the MIPS32 and MIPS64 squaring procedure. An attacker could exploit this vulnerability to launch further atta...

debian/openssl

IBM Cognos Analytics<=12.0.0-12.0.1

IBM Cognos Analytics<=11.2.0-11.2.4 FP2

IBM Cognos Analytics<=11.1.1-11.1.7 FP7

OpenSSL OpenSSL>=1.0.2<=1.0.2zb

OpenSSL OpenSSL>=1.1.1<1.1.1m

and 33 more

● CVE-2022-0235

A flaw was found in node-fetch. When following a redirect to a third-party domain, node-fetch was forwarding sensitive headers such as "Authorization," "WWW-Authenticate," and "Cookie" to potentially ...

redhat/rh-nodejs14-nodejs<0:14.21.1-3.el7

redhat/rh-nodejs14-nodejs-nodemon<0:2.0.20-2.el7

Node-fetch Project Node-fetch<2.6.7

Node-fetch Project Node-fetch>=3.0.0<3.1.1

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

and 4 more

● CVE-2022-0155

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

redhat/ovirt-web-ui<0:1.9.2-1.el8e

Follow-redirects Project Follow-redirects<1.14.7

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

Siemens Sinec Ins=1.0-sp1

npm/follow-redirects<1.14.7

● CVE-2021-22945

curl. Multiple issues were addressed by updating to curl version 7.79.1.

debian/curl

Apple macOS Monterey<12.3

Haxx Libcurl>=7.73.0<=7.78.0

Fedoraproject Fedora=33

Fedoraproject Fedora=35

Netapp Cloud Backup

and 41 more

● CVE-2021-3749

A Regular Expression Denial of Service (ReDoS) vulnerability was found in the nodejs axios. This flaw allows an attacker to provide crafted input to the trim function, which might cause high resources...

redhat/kiali<0:v1.24.7.redhat1-1.el8

IBM Cognos Analytics 11.2.x<=IBM Cognos Analytics 11.2.x

IBM Cognos Analytics 11.1.x<=IBM Cognos Analytics 11.1.x

npm/axios<0.21.2

redhat/axios<0.21.2

Axios Axios<=0.21.1

and 4 more

● CVE-2021-25217

A flaw was found in the Dynamic Host Configuration Protocol (DHCP). There is a discrepancy between the code that handles encapsulated option information in leases transmitted "on the wire" and the cod...

redhat/dhcp<12:4.1.1-64.P1.el6_10

redhat/dhcp<12:4.2.5-83.el7_9.1

redhat/dhcp<12:4.2.5-42.el7_2.2

redhat/dhcp<12:4.2.5-47.el7_3.2

redhat/dhcp<12:4.2.5-58.el7_4.5

redhat/dhcp<12:4.2.5-69.el7_6.1

and 69 more

● CVE-2021-23841

WebRTC. A null pointer dereference was addressed with improved input validation.

redhat/jbcs-httpd24-apr<0:1.6.3-107.el8

redhat/jbcs-httpd24-apr-util<0:1.6.1-84.el8

redhat/jbcs-httpd24-curl<0:7.78.0-2.el8

redhat/jbcs-httpd24-httpd<0:2.4.37-78.el8

redhat/jbcs-httpd24-nghttp2<0:1.39.2-39.el8

redhat/jbcs-httpd24-openssl<1:1.1.1g-8.el8

and 67 more

● CVE-2021-23839

OpenSSL could provide weaker than expected security, caused by incorrect SSLv2 rollback protection that allows for the inversion of the logic during a padding check. If the server is configured for SS...

OpenSSL OpenSSL>=1.0.2s<=1.0.2x

Oracle Business Intelligence=5.5.0.0.0

Oracle Business Intelligence=5.9.0.0.0

Oracle Business Intelligence=12.2.1.3.0

Oracle Business Intelligence=12.2.1.4.0

Oracle Enterprise Manager For Storage Management=13.4.0.0

and 14 more

● CVE-2021-23337

`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

redhat/cockpit-ovirt<0:0.15.1-2.el8e

redhat/ovirt-engine-ui-extensions<0:1.2.6-1.el8e

redhat/ovirt-web-ui<0:1.6.9-1.el8e

redhat/nodejs-lodash<4.17.21

npm/lodash-template<=1.0.0

npm/lodash.template<=4.5.0

and 50 more

● CVE-2020-28500

A flaw was found in nodejs-lodash. A Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions is possible.

redhat/cockpit-ovirt<0:0.15.1-2.el8e

redhat/ovirt-engine-ui-extensions<0:1.2.6-1.el8e

redhat/ovirt-web-ui<0:1.6.9-1.el8e

npm/lodash.trim<=4.5.1

npm/lodash.trimend<=4.5.1

npm/lodash-es<4.17.21

and 44 more

● CVE-2020-7793

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).

Ua-parser-js Project Ua-parser-js<0.7.23

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

Siemens Sinec Ins=1.0-sp1

● CVE-2020-28168

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host o...

IBM Cloud Pak for Automation<=20.0.3

IBM Cloud Pak for Automation<=20.0.2 IF002

Axios Axios>=0.19.0<=0.21.0

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0-sp1

● CVE-2020-12762

json-c could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow and out-of-bounds write. By persuading a victim to run a specially crafted file, an attacker...

Json-c Json-c<0.15-20200726

Fedoraproject Fedora=30

Fedoraproject Fedora=31

Fedoraproject Fedora=32

Debian Debian Linux=8.0

Debian Debian Linux=9.0

and 22 more

Latest siemens sinec ins Vulnerabilities

Company

Resources

Contact