Siemens Sinema Remote Connect Server vulnerabilities, page 3
72 vulnerabilities
Known vulnerabilities in Siemens Sinema Remote Connect Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-32251siemenssinema_remote_connect_server
EPSS score1.24%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions of any user and gain the privileges of an administrative user.CVE-2022-32261siemenssinema_remote_connect_serverEPSS score0.72%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a misconfiguration in the APT update. This could allow an attacker to add insecure packages to the application.CVE-2022-32256siemenssinema_remote_connect_serverEPSS score0.68%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to low privileged users accessing privileged information.CVE-2022-32253siemenssinema_remote_connect_serverEPSS score0.61%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). Due to improper input validation, the OpenSSL certificate's password could be printed to a file reachable by an attacker.CVE-2022-32260siemenssinema_remote_connect_serverEPSS score0.77%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application creates temporary user credentials for UMC (User Management Component) users. An attacker could use these temporary credentials for authentication bypass in certain scenarios.CVE-2022-32262siemenssinema_remote_connect_serverEPSS score2.62%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server that is vulnerable to command injection. An attacker could use this to achieve arbitrary code execution.CVE-2022-32255siemenssinema_remote_connect_serverEPSS score0.83%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to limited information.CVE-2022-32254siemenssinema_remote_connect_serverEPSS score0.85%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valuable guidance to an attacker.CVE-2022-23990alpineexpat+18EPSS score4.69%
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.CVE-2022-23102siemenssinema_remote_connect_serverEPSS score4.72%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacker could trick a valid authenticated user to the device into clicking a malicious link there by leading to phishing attacks.CVE-2022-23852alpineexpat+28EPSS score5.08%
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.CVE-2024-42345siemenssinema_remote_connect_serverEPSS score0.34%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP2). The affected application does not properly handle user session establishment and invalidation. This could allow a remote attacker to circumvent the additional multi factor authentication for user session establishment.CVE-2024-39571siemenssinema_remote_connect_serverEPSS score1.31%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to missing server side input sanitation when loading SNMP configurations. This could allow an attacker with the right to modify the SNMP configuration to execute arbitrary code with root privileges.CVE-2024-39870siemenssinema_remote_connect_serverEPSS score0.25%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected applications can be configured to allow users to manage own users. A local authenticated user with this privilege could use this modify users outside of their own scope as well as to escalate privileges.CVE-2024-39872siemenssinema_remote_connect_serverEPSS score0.47%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the 'Manage firmware updates' role to escalate their privileges on the underlying OS level.CVE-2024-39570siemenssinema_remote_connect_serverEPSS score1.35%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1). Affected applications are vulnerable to command injection due to missing server side input sanitation when loading VxLAN configurations. This could allow an authenticated attacker to execute arbitrary code with root privileges.CVE-2024-39873siemenssinema_remote_connect_serverEPSS score0.45%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its web API. This could allow an attacker to learn user credentials that are vulnerable to brute force attacks.CVE-2024-39869siemenssinema_remote_connect_serverEPSS score0.28%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected products allow to upload certificates. An authenticated attacker could upload a crafted certificates leading to a permanent denial-of-service situation. In order to recover from such an attack, the offending certificate needs to be removed manually.CVE-2024-39866siemenssinema_remote_connect_serverEPSS score0.24%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows users to upload encrypted backup files. This could allow an attacker with access to the backup encryption key and with the right to upload backup files to create a user with administrative privileges.CVE-2024-39874siemenssinema_remote_connect_serverEPSS score0.41%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly implement brute force protection against user credentials in its Client Communication component. This could allow an attacker to learn user credentials that are vulnerable to brute force attacks.