Siemens SINEC INS
Multiple vulnerabilities affecting various third-party components of SINEC INS before V1.0 SP2 could allow an attacker to cause a denial of service condition, disclose sensitive data or violate the system integrity. Siemens has released an update for the SINEC INS and recommends to update to the latest version.
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-25220US | medium4.0 | — | ||
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those sho… | ||||
| CVE-2022-0396US | medium5.3 | — | ||
BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIN… | ||||
| CVE-2021-4160US | medium5.9OT elevated | — | ||
There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed… | ||||
| CVE-2022-0235US | medium6.1 | — | ||
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | ||||
| CVE-2022-0155US | medium6.5 | Exploit | ||
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor | ||||
| CVE-2021-3749US | high7.5 | Exploit | ||
axios is vulnerable to Inefficient Regular Expression Complexity | ||||
| CVE-2021-25217US | low3.3 | — | ||
In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond… | ||||
| CVE-2021-23841US | medium5.9OT elevated | Exploit | ||
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate… | ||||
| CVE-2021-23839US | low3.7OT elevated | — | ||
OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is ma… | ||||
| CVE-2021-23337US | high7.2 | Exploit | ||
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. | ||||
| CVE-2020-28500US | medium5.3 | — | ||
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. | ||||
| CVE-2020-7793US | high7.5 | — | ||
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info). | ||||
| CVE-2020-28168US | medium5.9 | — | ||
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to… | ||||
| CVE-2020-12762US | high7.8 | — | ||
json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. | ||||
references
External citations — patches, advisories, analysis.
- SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 - CSAF Versionself
- SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 - PDF Versionself
- SSA-637483 Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 - TXT Versionself
- ICS Advisory ICSA-22-258-05 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-22-258-05 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (14)
- FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/ - FixedSINEC INS
Update to V1.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812610/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan