SINEMA Remote Connect Server vulnerabilities
22 known vulnerabilities in SINEMA Remote Connect Server from Siemens. 22 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
SINEMA Remote Connect Server: Improper Restriction of Excessive Authentication Attempts
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its Client Communication component. This could allow an attac
- 7.5 High severity
SINEMA Remote Connect Server: Improper Restriction of Excessive Authentication Attempts
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its web API. This could allow an attacker to learn user crede
- 9.9 Critical severity
SINEMA Remote Connect Server: Creation of Temporary File With Insecure Permissions
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the 'M
- 7.8 High severity
SINEMA Remote Connect Server: Client-Side Enforcement of Server-Side Security
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected applications can be configured to allow users to manage own users. A local authenticated user with this privilege could use this modify users outside of
- 7.3 High severity
SINEMA Remote Connect Server: Direct Request
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and
- 7.3 High severity
SINEMA Remote Connect Server: Direct Request
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and
- 8.8 High severity
SINEMA Remote Connect Server: Privilege Defined With Unsafe Actions
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. This could allow an attacker with access to the backup encryption key and with the right to u
- 8.8 High severity
SINEMA Remote Connect Server: Unrestricted Upload of File with Dangerous Type
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. As part of this backup, files can be restored without correctly checking the path of the rest
- 8.8 High severity
SINEMA Remote Connect Server: Improper Neutralization of Special Elements used in a Command
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to missing server side input sanitation when loading SNMP configurations. This could allow an attacker
- 8.8 High severity
SINEMA Remote Connect Server: Improper Neutralization of Special Elements used in a Command
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to missing server side input sanitation when loading VxLAN configurations. This could allow an authenti
- 8.1 High severity
Red Hat Enterprise Linux 9: Concurrent Execution using Shared Resource with Improper Synchronization
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate
- 9.8 Critical severity
SINEMA Remote Connect Server: Improper Access Control
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to resources and po
- 9.8 Critical severity
SINEMA Remote Connect Server: Improper Neutralization of Special Elements used in a Command
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server that is vulnerable to command injection. An attacker could use this to achieve arbitrary code execution.
- 7.5 High severity
SINEMA Remote Connect Server: Improper Handling of Parameters
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguration in the APT update. This could allow an attacker to add insecure packages to the application.
- 9.8 Critical severity
SINEMA Remote Connect Server: Incorrect User Management
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application creates temporary user credentials for UMC (User Management Component) users. An attacker could use these temporary credentials for authenti
- 7.5 High severity
SINEMA Remote Connect Server: Obsolete Feature in UI
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for info
- 7.5 High severity
SINEMA Remote Connect Server: Insertion of Sensitive Information into Log File
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valu
- 7.5 High severity
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1).
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input validation, the OpenSSL certificate's password could be printed to a file reachable by an attacker.
- 7.8 High severity
SINEMA Remote Connect Server: Insufficient Verification of Data Authenticity
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting
- 9.8 Critical severity
SINEMA Remote Connect Server: Missing Authentication for Critical Functionality
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions
- 9.8 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Improper Encoding or Escaping of Output
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
- 9.0 Critical severity
Apache HTTP Server-Side Request Forgery (SSRF) Exploited
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.