Siemens Sinema Remote Connect Server vulnerabilities, page 2
72 vulnerabilities
Known vulnerabilities in Siemens Sinema Remote Connect Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-7595alpinelibxml2+27
EPSS score7.84%
xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.CVE-2022-25313alpineexpat+24EPSS score3.29%
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.CVE-2022-25235alpineexpat+31EPSS score4.96%
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.CVE-2022-25315alpineexpat+24EPSS score4.82%
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.CVE-2022-25236alpineexpat+61EPSS score35.27%
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.CVE-2022-25314alpineexpat+24EPSS score4.82%
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.CVE-2022-29034siemenssinema_remote_connect_serverEPSS score28.73%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code.
This could allow attackers to perform reflected cross-site scripting (XSS) attacks.CVE-2022-27221siemenssinema_remote_connect_serverEPSS score1.02%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack.CVE-2022-27219siemenssinema_remote_connect_serverEPSS score0.68%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors.CVE-2022-27220siemenssinema_remote_connect_serverEPSS score0.68%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server configured on port 6220. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors.CVE-2022-22824alpineexpat+23EPSS score3.60%
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22826alpineexpat+23EPSS score2.96%
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22827alpineexpat+23EPSS score2.96%
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22825alpineexpat+23EPSS score2.79%
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22822alpineexpat+23EPSS score5.10%
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22823alpineexpat+23EPSS score3.60%
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-32258siemenssinema_remote_connect_serverEPSS score0.89%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for information disclosure.CVE-2022-32259siemenssinema_remote_connect_serverEPSS score0.64%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The system images for installation or update of the affected application contain unit test scripts with sensitive information. An attacker could gain information about testing architecture and also tamper with test configuration.CVE-2022-32257siemenssinema_remote_connect_serverEPSS score0.84%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to resources and potentially lead to code execution.CVE-2022-32252siemenssinema_remote_connect_serverEPSS score0.36%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker.