SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
beschreibt (23)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-22610US | medium6.1 | Exploit | ||
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and… | ||||
| CVE-2025-69277US | — | — | ||
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elli… | ||||
| CVE-2025-15284US | — | — | ||
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
Summary
The arrayLimit option in qs did not enforce limits for bra… | ||||
| CVE-2025-66412US | medium5.4 | — | ||
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored… | ||||
| CVE-2025-66035US | — | — | ||
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1,… | ||||
| CVE-2025-66031US | high7.5 | — | ||
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and belo… | ||||
| CVE-2025-66030US | medium5.3 | — | ||
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enab… | ||||
| CVE-2025-12816US | — | — | ||
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema vali… | ||||
| CVE-2025-64756US | — | — | ||
Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its… | ||||
| CVE-2025-64718US | — | — | ||
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document vi… | ||||
| CVE-2025-62522US | — | — | ||
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before… | ||||
| CVE-2025-9232US | — | — | ||
Issue summary: An application using the OpenSSL HTTP client API functions may
trigger an out-of-bounds read if the 'no_proxy' environment variable is set and
the host portion of th… | ||||
| CVE-2025-9230US | — | — | ||
Issue summary: An application trying to decrypt CMS messages encrypted using
password based encryption can trigger an out-of-bounds read and write.
Impact summary: This out-of-bou… | ||||
| CVE-2025-58754US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL w… | ||||
| CVE-2025-58752US | medium5.3 | — | ||
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` sett… | ||||
| CVE-2025-58751US | medium5.3 | — | ||
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypa… | ||||
| CVE-2025-9670US | — | — | ||
A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipulation results in ine… | ||||
| CVE-2025-7783US | —OT erhöht | Exploit | ||
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.
This is… | ||||
| CVE-2025-6965US | high7.7 | Exploit | ||
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corrupti… | ||||
| CVE-2024-41996US | — | — | ||
Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (23)
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
- BehobenSIDIS Prime
Update to V4.0.800 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan