SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1
Advisory ansehen veröffentlicht 2024-11-12
SINEC NMS before V3.0 SP1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
01
beschreibt (17)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-47808US | medium6.5 | — | ||
A vulnerability has been identified in SINEC NMS (All versions < V3.0 SP1). The affected application contains a database function, that does not properly restrict the permissions o… | ||||
| CVE-2023-46280US | — | — | ||
A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC BATCH V9.1 (All versions < V9.1… | ||||
| CVE-2023-6237US | — | — | ||
Issue summary: Checking excessively long invalid RSA public keys may take
a long time.
Impact summary: Applications that use the function EVP_PKEY_public_check()
to check RSA publ… | ||||
| CVE-2024-27316US | high7.5 | Exploit | ||
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, th… | ||||
| CVE-2024-24795US | — | — | ||
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchro… | ||||
| CVE-2023-38709US | — | Exploit | ||
Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.
This issue affects Apache HTTP Server: through 2.… | ||||
| CVE-2024-2466US | — | — | ||
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hos… | ||||
| CVE-2024-2398US | — | — | ||
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts t… | ||||
| CVE-2024-2379US | — | — | ||
libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or curve, the error path… | ||||
| CVE-2024-2004US | —OT erhöht | — | ||
When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic… | ||||
| CVE-2024-0727US | medium5.5 | — | ||
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files… | ||||
| CVE-2023-6129US | medium6.5 | — | ||
Issue summary: The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications running
on PowerPC CPU based platf… | ||||
| CVE-2023-46219US | medium5.3OT erhöht | — | ||
When saving HSTS data to an excessively long file name, curl could end up
removing all contents, making subsequent requests using that file unaware of
the HSTS status they should o… | ||||
| CVE-2023-46218US | medium6.5 | — | ||
This flaw allows a malicious HTTP server to set "super cookies" in curl that
are then passed back to more origins than what is otherwise allowed or
possible. This allows a site to… | ||||
| CVE-2023-5678US | medium5.3 | — | ||
Issue summary: Generating excessively long X9.42 DH keys or checking
excessively long X9.42 DH keys or parameters may be very slow.
Impact summary: Applications that use the funct… | ||||
| CVE-2023-5363US | high7.5 | — | ||
Issue summary: A bug has been identified in the processing of key and
initialisation vector (IV) lengths. This can lead to potential truncation
or overruns during the initialisati… | ||||
| CVE-2023-4807US | high7.8 | — | ||
Issue summary: The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications on the
Windows 64 platform when ru… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
03
Behebungen (17)
- BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/ - BehobenSINEC NMS
Update to V3.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974917/
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan