Tuesday, 14.06.2022
Title
SSA-414513 V1.1 (Last Update: 2022-06-14): Information Disclosure Vulnerability in Mendix
Published
June 14, 2022, 2 a.m.
Summary
An information disclosure vulnerability in Mendix applications was discovered. The vulnerability could allow to read sensitive data. Siemens has released updates for several Mendix Applications and recommends to update to the latest versions. Siemens is preparing further updates and recommends countermeasures for products where updates are not, or not yet ...
Title
SSA-401167 V1.0: Cross-site scripting Vulnerability in Teamcenter Active Workspace
Published
June 14, 2022, 2 a.m.
Summary
Teamcenter Active Workspace is affected by a cross site scripting vulnerability. Siemens has released updates for the affected products and recommends to update to the latest versions.
Title
SSA-388239 V1.0: Default Password Leakage affecting the Component Shared HIS used in Spectrum Power Systems
Published
June 14, 2022, 2 a.m.
Summary
Siemens has been made aware of a default password leakage in the internet affecting the component Shared HIS (SHHIS) used in Spectrum Power systems. The products listed below are affected by this default password leakage. This could allow an attacker to access the component Shared HIS of those products with ...
Title
SSA-363107 V1.1 (Last Update: 2022-06-14): An Improper Initialization Vulnerability Affects SIMATIC WinCC Kiosk Mode
Published
June 14, 2022, 2 a.m.
Summary
A vulnerability was found in SIMATIC WinCC that could allow authenticated attackers to escape the Kiosk Mode. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
Title
SSA-330556 V1.0: PwnKit Vulnerability in SCALANCE LPE9403 and SINUMERIK Edge Products (CVE-2021-4034)
Published
June 14, 2022, 2 a.m.
Summary
The products listed below contain a local privilege escalation vulnerability (CVE-2021-4034) found on polkit’s pkexec utility, that could allow an unprivileged user to gain administrative rights. Siemens has released updates for the affected products and recommends to update to the latest versions.
Title
SSA-324955 V1.8 (Last Update: 2022-06-14): SAD DNS Attack in Linux Based Products
Published
June 14, 2022, 2 a.m.
Summary
A vulnerability made public under the name SAD DNS affects Domain Name System resolvers due to a vulnerability in the Linux kernel when handling ICMP packets. The Siemens products which are affected are listed below. For more information please see https://www.saddns.net/. Siemens has released updates for several affected products and ...
Title
SSA-301589 V1.3 (Last Update: 2022-06-14): Multiple File Parsing Vulnerabilities in Solid Edge, JT2Go and Teamcenter Visualization
Published
June 14, 2022, 2 a.m.
Summary
Siemens has released updates for JT2Go, Solid Edge and Teamcenter Visualization to fix multiple file parsing vulnerabilities. If a user is tricked to open a malicious file (crafted as PDF, DXF or PAR) with any of the affected products, this could lead the application to crash or potentially lead to ...
Title
SSA-254054 V1.2 (Last Update: 2022-06-14): Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products
Published
June 14, 2022, 2 a.m.
Summary
A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as “Spring4Shell” or “SpringShell”. Siemens is currently investigating to determine which products are affected and is continuously updating this advisory as ...
Title
SSA-244969 V1.5 (Last Update: 2022-06-14): OpenSSL Vulnerability in Industrial Products
Published
June 14, 2022, 2 a.m.
Summary
OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1l and 1.0.2 < 1.0.2za that allows an attacker to cause a denial of service (DoS) or to disclose private memory content. Siemens has released updates for several affected products and recommends to update to ...
Title
SSA-220589 V1.0: Hard Coded Default Credential Vulnerability in Teamcenter
Published
June 14, 2022, 2 a.m.
Summary
Siemens has released updates for Teamcenter that fixes a security vulnerability related to unsecure storage of user credentials. This vulnerability affects Java EE Server Manager HTML Adaptor. This service is not installed by default and currently also obsoleted. Siemens has released updates for the affected products and recommends to update ...
Title
SSA-148078 V1.1 (Last Update: 2022-06-14): Multiple Vulnerabilities in APOGEE/TALON Field Panels
Published
June 14, 2022, 2 a.m.
Summary
Multiple vulnerabilities in the APOGEE PXC and TALON TC series of products could allow unauthenticated attackers to download sensitive information through the integrated webserver. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or ...
Friday, 10.06.2022
Title
Sicherheitsupdate: CODESYS Security Advisory 2022-02
Published
June 10, 2022, 11:53 a.m.
Summary
Please check source url for more information.
Wednesday, 08.06.2022
Title
AA22-158A: People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices
Published
June 8, 2022, midnight
Summary
Original release date: June 7, 2022SummaryBest Practices • Apply patches as soon as possible • Disable unnecessary ports and protocols • Replace end-of-life infrastructure • Implement a centralized patch management system This joint Cybersecurity Advisory describes the ways in which People’s Republic of China (PRC) state-sponsored cyber actors continue to ...
Tuesday, 07.06.2022
Title
Mitsubishi Electric MELSEC and MELIPC Series (Update C)
Published
June 7, 2022, 4 p.m.
Summary
This updated advisory is a follow up to the advisory update titled ICSA-21-334-02 Mitsubishi Electric MELSEC and MELIPC Series (Update B) that was published April 26, 2022, to the ICS webpage on cisa.gov/ics. This advisory contains mitigations for Uncontrolled Resource Consumption, Improper Handling of Length Parameter Inconsistency, and Improper Input ...
Friday, 03.06.2022
Title
Vulnerabilities Affecting Dominion Voting Systems ImageCast X
Published
June 3, 2022, 9 p.m.
Summary
This advisory contains mitigations for Improper Verification of Cryptographic Signature, Mutable Attestation of Measurement Reporting Data, Hidden Functionality, Improper Protection of Alternate Path, Path Traversal: ''../filedir', Execution with Unnecessary Privileges, Authentication Bypass Spoofing, Incorrect Privilege Assignment, and Origin Validation Error vulnerabilities in versions of Dominion Voting Systems Democracy Suite ImageCast ...
Title
Sicherheitsupdate: CODESYS Security Advisories 2021-13, 2022-09, 2022-10 und 2022-14
Published
June 3, 2022, 9:20 a.m.
Summary
Please check source url for more information.
Thursday, 02.06.2022
Title
Carrier LenelS2 HID Mercury access panels
Published
June 2, 2022, 4:05 p.m.
Summary
This advisory contains mitigations for Protection Mechanism Failure, Forced Browsing, Classic Buffer Overflow, Path Traversal, and OS Command Injection vulnerabilities in Carrier HID Mercury access panels sold by LenlS2.
Title
Illumina Local Run Manager
Published
June 2, 2022, 4 p.m.
Summary
This advisory contains mitigations for Path Traversal, Unrestricted Upload of File with Dangerous Type, Improper Access Control, and Cleartext Transmission of Sensitive Information vulnerabilities in Illumina devices using Local Run Manager software.
Wednesday, 01.06.2022
Title
AA22-152A: Karakurt Data Extortion Group
Published
June 1, 2022, 4 p.m.
Summary
Original release date: June 1, 2022SummaryActions to take today to mitigate cyber threats from ransomware: • Prioritize patching known exploited vulnerabilities. • Train users to recognize and report phishing attempts. • Enforce multifactor authentication. The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the Department of ...

Last Updates

BOSCH PSIRT
20.03.2024
CODESYS
28.06.2023
SIEMENS CERT
09.04.2024
US CERT
26.02.2024
US CERT (ICS)
11.04.2024

By Source

Archive

2024
2023
2022
2021
2020
2019
2018
2017

Feeds