Vulnerabilidades do SICK AG Enterprise Analytics
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam SICK AG Enterprise Analytics: 5 registro(s), com versões afetadas e correções.cpe:2.3:a:sick:enterprise_analytics
CVE-2025-58583
Média · 5.3
CWE-497 06/10/2025
User Enumeration
The application provides access to a login protected H2 database for caching purposes. The username is prefilled.
CVE-2025-58582
Alta · 7.5
CWE-770 06/10/2025
Uncontrolled Resource Consumption via log file
If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged.
CVE-2025-58581
Média · 4.3
CWE-200 06/10/2025
Information Disclosure Through Stacktrace-/MQTT/Config/changeAll
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
CVE-2025-58580
Média · 5.3
CWE-117 06/10/2025
Injection via log file
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.
CVE-2025-58578
Média · 4.3
CWE-770 06/10/2025
Unlimited user creation by authorized users
A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.