COMOS vulnerabilities

6 known vulnerabilities in COMOS from Siemens. 6 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  COMOS: Improper Access Control

  CVE-2023-46601Nov 14, 2023Siemens

  A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not ha

• 9.8 Critical severity

  COMOS: Buffer Copy without Checking Size of Input

  CVE-2023-43504Nov 14, 2023Siemens

  A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affected application is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker

• 7.5 High severity

  COMOS: Cleartext Transmission of Sensitive Information

  CVE-2023-43503Nov 14, 2023Siemens

  A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and project information in cleartext via UDP.

• 9.8 Critical severity

  COMOS V10.2: Buffer Copy without Checking Size of Input

  CVE-2023-24482Feb 14, 2023Siemens

  A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versions < V10.3.3.2.33), COMOS V10.3.3.3 (All versions < V10.3.3.3.9), COMOS V10.3.3.4 (All versions < V10.3.3.4.6), COMOS V

• 9.0 Critical severity

  Apache Log4j2 Deserialization of Untrusted Data Exploited

  CVE-2021-45046Dec 14, 2021ApacheEPSS 100%

  It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default

• 10.0 Critical severity

  Apache Log4j2 Remote Code Execution Exploited

  CVE-2021-44228Dec 10, 2021ApacheEPSS 100%

  Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who c