Vulnerabilidades de Siemens

CVEs publicadas que afetam produtos de Siemens: 310 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2021-22898 Baixa · 3.1 CWE-909 11/06/2021

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option,...

curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.

CVE-2021-22901 Alta · 8.1 CWE-416 11/06/2021

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed...

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL, it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory, libcurl might even call a function pointer in the object, making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.

CVE-2021-22897 Média · 5.3 CWE-668 11/06/2021

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a...

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

CVE-2020-8670 Média · 6.4 CWE-362 09/06/2021

Race condition in the firmware for some Intel(R) Processors may allow a privileged user to...

Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

CVE-2020-24513 Média · 6.5 09/06/2021

Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an...

Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

CVE-2020-24486 Média · 5.5 CWE-20 09/06/2021

Improper Input Validation em Intel Bios

Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.

CVE-2020-12360 Alta · 7.8 CWE-125 09/06/2021

Out-of-bounds Read em Intel Bios

Out of bounds read in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.

CVE-2020-12358 Média · 4.4 CWE-787 09/06/2021

Out of bounds write in the firmware for some Intel(R) Processors may allow a privileged user to...

Out of bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access.

CVE-2020-12357 Média · 6.7 CWE-665 09/06/2021

Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user...

Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

CVE-2020-24588 Baixa · 3.5 CWE-327 11/05/2021

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired...

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.

CVE-2020-26144 Média · 6.5 CWE-20 11/05/2021

Improper Input Validation em Samsung Galaxy I9305 Firmware

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.

CVE-2020-26140 Média · 6.5 CWE-327 11/05/2021

Use of a Broken or Risky Cryptographic Algorithm em Alfa Awus036h Firmware

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.

CVE-2021-22890 Baixa · 3.7 CWE-290 01/04/2021

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to...

curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote server and then wrongly "short-cut" the host handshake. When confusing the tickets, a HTTPS proxy can trick libcurl to use the wrong session ticket resume for the host and thereby circumvent the server TLS certificate check and make a MITM attack to be possible to perform unnoticed. Note that such a malicious HTTPS proxy needs to provide a certificate that curl will accept for the MITMed server for an attack to work - unless curl has been told to ignore the server certificate check.

CVE-2021-22876 Média · 5.3 CWE-200 01/04/2021

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information...

curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request.

CVE-2021-3449 Média · 5.9 CWE-476 25/03/2021

NULL pointer deref in signature_algorithms processing

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

CVE-2021-23337 Alta · 7.2 Exploit público CWE-94 15/02/2021

Command Injection

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVE-2020-28500 Média · 5.3 15/02/2021

Regular Expression Denial of Service (ReDoS)

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

CVE-2020-8286 Alta · 7.5 CWE-295 14/12/2020

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to...

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CVE-2020-8177 Alta · 7.8 CWE-74 14/12/2020

Injection em Haxx Curl

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

CVE-2020-8285 Alta · 7.5 CWE-674 14/12/2020

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack...

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

CVE-2020-8284 Baixa · 3.7 CWE-200 14/12/2020

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting...

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

CVE-2020-8231 Alta · 7.5 CWE-416 14/12/2020

Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when...

Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

CVE-2020-8169 Alta · 7.5 CWE-200 14/12/2020

curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead...

curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).

CVE-2020-15358 Média · 5.5 CWE-787 27/06/2020

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a...

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

CVE-2020-13871 Alta · 7.5 CWE-416 06/06/2020

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite...

SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.