Sinec Infrastructure Network Services (Siemens) - vulnerabilities (CVEs)

68 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2021-11-23. Vendor: Siemens.

CVEs of Sinec Infrastructure Network Services

• CVE-2021-3672 - CVSS 5.6 (medium), 2021-11-23: A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong…
• CVE-2021-25219 - CVSS 5.3 (medium), 2021-10-27: In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 -> 9.16.21-S1 of BIND Supported Preview Edition, as well as…
• CVE-2020-27304 - CVSS 9.8 (critical), 2021-10-21: The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload…
• CVE-2021-22930 - CVSS 9.8 (critical), 2021-10-07: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to…
• CVE-2021-22947 - CVSS 5.9 (medium), 2021-09-29: When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and…
• CVE-2021-22946 - CVSS 7.5 (high), 2021-09-29: A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command…
• CVE-2021-39134 - CVSS 8.2 (high), 2021-08-31: `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to…
• CVE-2021-37713 - CVSS 8.6 (high), 2021-08-31: The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution…
• CVE-2021-37712 - CVSS 8.6 (high), 2021-08-31: The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution…
• CVE-2021-39135 - CVSS 8.2 (high), 2021-08-31: `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to…
• CVE-2021-37701 - CVSS 8.6 (high), 2021-08-31: The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution…
• CVE-2021-3712 - CVSS 7.4 (high), 2021-08-24: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the…
• CVE-2021-22939 - CVSS 5.3 (medium), 2021-08-16: If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to…
• CVE-2021-22931 - CVSS 9.8 (critical), 2021-08-16: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names…
• CVE-2021-22940 - CVSS 7.5 (high), 2021-08-16: Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to…
• CVE-2021-22925 - CVSS 5.3 (medium), 2021-08-05: curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs…
• CVE-2021-22924 - CVSS 3.7 (low), 2021-08-05: libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic,…
• CVE-2021-22923 - CVSS 5.3 (medium), 2021-08-05: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same…
• CVE-2021-22926 - CVSS 7.5 (high), 2021-08-05: libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with…
• CVE-2021-22922 - CVSS 6.5 (medium), 2021-08-05: When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink…
• CVE-2021-32804 - CVSS 8.2 (high), 2021-08-03: The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient…
• CVE-2021-32803 - CVSS 8.2 (high), 2021-08-03: The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient…
• CVE-2021-22921 - CVSS 7.8 (high), 2021-07-12: Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More…
• CVE-2021-22918 - CVSS 5.3 (medium), 2021-07-12: Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is…
• CVE-2021-20093 - CVSS 9.1 (critical), 2021-06-16: A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap…
• CVE-2021-22898 - CVSS 3.1 (low), 2021-06-11: curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send…
• CVE-2021-22901 - CVSS 8.1 (high), 2021-06-11: curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over…
• CVE-2021-22897 - CVSS 5.3 (medium), 2021-06-11: curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is…
• CVE-2021-25215 - CVSS 7.5 (high), 2021-04-29: In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well…
• CVE-2021-25216 - CVSS 9.8 (critical), 2021-04-29: In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well…
• CVE-2021-25214 - CVSS 6.5 (medium), 2021-04-29: In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview…
• CVE-2021-22876 - CVSS 5.3 (medium), 2021-04-01: curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP…
• CVE-2021-22890 - CVSS 4.3 (medium), 2021-04-01: curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session…
• CVE-2021-3449 - CVSS 5.9 (medium), 2021-03-25: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits…
• CVE-2021-23362 - CVSS 5.3 (medium), 2021-03-23: The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl…
• CVE-2021-27290 - CVSS 7.5 (high), 2021-03-12: ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely…
• CVE-2021-22884 - CVSS 7.5 (high), 2021-03-03: Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not…
• CVE-2021-22883 - CVSS 7.5 (high), 2021-03-03: Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol'…
• CVE-2020-8625 - CVSS 8.1 (high), 2021-02-17: BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default…
• CVE-2020-8287 - CVSS 6.5 (medium), 2021-01-06: Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header…
• CVE-2020-8265 - CVSS 8.1 (high), 2021-01-06: Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled…
• CVE-2020-8286 - CVSS 7.5 (high), 2020-12-14: curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
• CVE-2020-8177 - CVSS 7.8 (high), 2020-12-14: curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J…
• CVE-2020-8285 - CVSS 7.5 (high), 2020-12-14: curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
• CVE-2020-8169 - CVSS 7.5 (high), 2020-12-14: curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to…
• CVE-2020-8284 - CVSS 3.7 (low), 2020-12-14: A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way…
• CVE-2020-8231 - CVSS 7.5 (high), 2020-12-14: Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
• CVE-2020-1971 - CVSS 5.9 (medium), 2020-12-08: The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a…
• CVE-2020-7774 - CVSS 9.8 (critical), 2020-11-17: The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
• CVE-2020-15358 - CVSS 5.5 (medium), 2020-06-27: In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive…
• CVE-2020-13871 - CVSS 7.5 (high), 2020-06-06: SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
• CVE-2020-13632 - CVSS 5.5 (medium), 2020-05-27: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
• CVE-2020-13631 - CVSS 5.5 (medium), 2020-05-27: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
• CVE-2020-13630 - CVSS 7 (high), 2020-05-27: ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
• CVE-2020-11655 - CVSS 7.5 (high), 2020-04-09: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's…
• CVE-2020-11656 - CVSS 9.8 (critical), 2020-04-09: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT…
• CVE-2020-9327 - CVSS 7.5 (high), 2020-02-21: In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column…
• CVE-2019-19925 - CVSS 7.5 (high), 2019-12-24: zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
• CVE-2019-19924 - CVSS 5.3 (medium), 2019-12-24: SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error…
• CVE-2019-19923 - CVSS 7.5 (high), 2019-12-24: flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can…
• CVE-2019-19926 - CVSS 7.5 (high), 2019-12-23: multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this…
• CVE-2019-19880 - CVSS 7.5 (high), 2019-12-18: exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses…
• CVE-2019-19646 - CVSS 9.8 (critical), 2019-12-09: pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
• CVE-2019-19603 - CVSS 7.5 (high), 2019-12-09: SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
• CVE-2019-19645 - CVSS 5.5 (medium), 2019-12-09: alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE…
• CVE-2019-19317 - CVSS 9.8 (critical), 2019-12-05: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of…
• CVE-2019-19242 - CVSS 5.9 (medium), 2019-11-27: SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.
• CVE-2019-19244 - CVSS 7.5 (high), 2019-11-25: sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.