SIMATIC S7-1500 CPU 1518-4 PN/DP MFP vulnerabilities
164 known vulnerabilities in SIMATIC S7-1500 CPU 1518-4 PN/DP MFP from Siemens. 164 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
https://github.com/curl/curl: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an a
- 7.0 High severity
Linux kernel: Access of Resource Using Incompatible Type
In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which woul
- 7.5 High severity
OpenSSL: Improper Certificate Validation
A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate c
- 7.8 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Improper Privilege Management
systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other prog
- 9.1 Critical severity
https://github.com/curl/curl: Cleartext Transmission of Sensitive Information
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure
- 7.5 High severity
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass…
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
- 7.4 High severity
gnutls: Observable Discrepancy
A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful
- 7.4 High severity
OpenSSL: Access of Resource Using Incompatible Type
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field
- 7.5 High severity
OpenSSL: Use After Free
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.
- 7.5 High severity
OpenSSL: Double Free
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to
- 9.8 Critical severity
C Library: Buffer Copy without Checking Size of Input
A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to appl
- 9.8 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Out-of-bounds Write
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thous
- 8.8 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Integer Overflow or Wraparound
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffe
- 7.5 High severity
https://github.com/curl/curl: Cleartext Transmission of Sensitive Information
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. Howeve
- 9.8 Critical severity
https://github.com/curl/curl: Exposure of Resource to Wrong Sphere
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used t
- 7.8 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Double Free
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.
- 7.5 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Integer Overflow or Wraparound
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically
- 7.5 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Inefficient Algorithmic Complexity
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU de
- 8.1 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Double Free
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HT
- 7.5 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Cleartext Transmission of Sensitive Information
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mech
- 7.5 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Use After Free
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
- 9.8 Critical severity
RUGGEDCOM APE1808: Integer Overflow or Wraparound
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
- 9.8 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Improper Authentication
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditio
- 8.8 High severity
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility.
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw
- 9.8 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Out-of-bounds Write
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code
- 7.5 High severity
GnuTLS: Double Free
A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.
- 9.8 Critical severity
https://github.com/curl/curl: Incorrect Default Permissions
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the perm
- 9.8 Critical severity
OpenSSL: Out-of-bounds Write
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen
- 7.3 High severity
OpenSSL: Improper Neutralization of Special Elements used in an OS Command
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was
- 7.5 High severity
https://github.com/curl/curl: Improper Certificate Validation
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches t
- 7.5 High severity
https://github.com/curl/curl: Loop with Unreachable Exit Condition
libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop whe
- 7.5 High severity
https://github.com/curl/curl: Server-Side Request Forgery
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it is later retrieved.For example, a URL like `http://example.com%2F127.0.0.1/`, wou
- 8.1 High severity
https://github.com/curl/curl: Use of Incorrectly-Resolved Name or Reference
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`.
- 7.5 High severity
https://github.com/curl/curl: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.
- 8.1 High severity
https://github.com/curl/curl: Missing Authentication for Critical Functionality
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfe
- 9.8 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Improper Neutralization of Special Elements used in an SQL Command
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is process
- 7.5 High severity
OpenSSL: Incomplete Cleanup
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes cert
- 7.3 High severity
OpenSSL: Improper Neutralization of Special Elements used in an OS Command
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrar
- 7.8 High severity
e2fsprogs: Out-of-bounds Read
An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.
- 7.0 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Untrusted Search Path
In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have ins