Siemens SINEC NMS 1.0 Service Pack 2 Update 1

CPE Details

Siemens SINEC NMS 1.0 Service Pack 2 Update 1
siemens
sinec_nms
1.0
2021-10-13
13h16 +00:00
2021-10-13
21h18 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:siemens:sinec_nms:1.0:sp2_update_1:*:*:*:*:*:*

Informations

Vendor

siemens

Product

sinec_nms

Version

1.0

Update

sp2_update_1

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2024-47808 2024-11-12 12h49 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V3.0 SP1). The affected application contains a database function, that does not properly restrict the permissions of users to write to the filesystem of the host system. This could allow an authenticated medium-privileged attacker to write arbitrary content to any location in the filesystem of the host system.
8.3
High
CVE-2024-41941 2024-08-13 07h54 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could allow an authenticated attacker to bypass the checks and modify settings in the application without authorization.
5.3
Medium
CVE-2024-41940 2024-08-13 07h54 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly validate user input to a privileged command queue. This could allow an authenticated attacker to execute OS commands with elevated privileges.
9.4
Critical
CVE-2024-41939 2024-08-13 07h54 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could allow an authenticated attacker to bypass the checks and elevate their privileges on the application.
8.7
High
CVE-2024-41938 2024-08-13 07h54 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V3.0). The importCertificate function of the SINEC NMS Control web application contains a path traversal vulnerability. This could allow an authenticated attacker it to delete arbitrary certificate files on the drive SINEC NMS is installed on.
5.1
Medium
CVE-2024-36398 2024-08-13 07h54 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application executes a subset of its services as `NT AUTHORITY\SYSTEM`. This could allow a local attacker to execute operating system commands with elevated privileges.
8.5
High
CVE-2024-23812 2024-02-13 09h00 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application incorrectly neutralizes special elements when creating a report which could lead to command injection.
8.8
High
CVE-2024-23811 2024-02-13 09h00 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.
8.8
High
CVE-2024-23810 2024-02-13 09h00 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application is vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.
9.8
Critical
CVE-2023-44315 2023-10-10 10h21 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could prepare a stored cross-site scripting (XSS) attack that may lead to unintentional modification of application data by legitimate users.
5.4
Medium
CVE-2022-30527 2023-10-10 10h20 +00:00 A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific folders containing executable files and libraries. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.
7.8
High
CVE-2021-42550 2021-12-15 23h00 +00:00 In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
6.6
Medium
CVE-2021-40438 2021-09-16 14h40 +00:00 A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
9
Critical
CVE-2021-39275 2021-09-16 12h40 +00:00 ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.
9.8
Critical
CVE-2021-34798 2021-09-16 12h40 +00:00 Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
7.5
High