Sinec Ins (Siemens) - vulnerabilities (CVEs)

42 CVEs, 0 in the last 30 days, 12 known versions, newest CVE from 2026-06-09. Vendor: Siemens.

CVEs of Sinec Ins

CVE-2026-46747 - CVSS 5.3 (medium), 2026-06-09: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the…
CVE-2026-46746 - CVSS 8.8 (high), 2026-06-09: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the…
CVE-2026-46749 - CVSS 9.8 (critical), 2026-06-09: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a…
CVE-2026-46748 - CVSS 8.8 (high), 2026-06-09: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the…
CVE-2025-15467 - CVSS 9.8 (critical), 2026-01-27: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact…
CVE-2024-46894 - CVSS 6.3 (medium), 2024-11-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate authorization of a…
CVE-2024-46890 - CVSS 9.4 (critical), 2024-11-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate input sent to…
CVE-2024-46889 - CVSS 6.9 (medium), 2024-11-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application uses hard-coded cryptographic key material to…
CVE-2024-46892 - CVSS 8.1 (high), 2024-11-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly invalidate sessions when the…
CVE-2024-46891 - CVSS 7.5 (high), 2024-11-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly restrict the size of generated…
CVE-2024-46888 - CVSS 9.9 (critical), 2024-11-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly sanitize user provided paths…
CVE-2024-3596 - CVSS 9 (critical), 2024-07-09: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or…
CVE-2023-48431 - CVSS 8.6 (high), 2023-12-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correctly validate the response received by an…
CVE-2023-48430 - CVSS 2.7 (low), 2023-12-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The REST API of affected devices does not check the length of parameters…
CVE-2023-48429 - CVSS 2.7 (low), 2023-12-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices does not check the length of parameters in…
CVE-2023-48428 - CVSS 7.2 (high), 2023-12-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism of affected products does not…
CVE-2023-48427 - CVSS 9.8 (critical), 2023-12-12: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2022-45093 - CVSS 8.8 (high), 2023-01-10: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management…
CVE-2022-45092 - CVSS 9.9 (critical), 2023-01-10: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management…
CVE-2022-45094 - CVSS 8.8 (high), 2023-01-10: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management…
CVE-2022-35256 - CVSS 6.5 (medium), 2022-12-05: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP…
CVE-2022-35255 - CVSS 9.1 (critical), 2022-12-05: A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in…
CVE-2022-32222 - CVSS 5.3 (medium), 2022-07-14: A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be…
CVE-2022-32215 - CVSS 6.5 (medium), 2022-07-14: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can…
CVE-2022-32213 - CVSS 6.5 (medium), 2022-07-14: The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead…
CVE-2022-32212 - CVSS 8.1 (high), 2022-07-14: A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be…
CVE-2022-2097 - CVSS 5.3 (medium), 2022-07-05: AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances.…
CVE-2022-2068 - CVSS 9.8 (critical), 2022-06-21: In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise…
CVE-2021-25220 - CVSS 6.8 (medium), 2022-03-23: BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9…
CVE-2022-0396 - CVSS 5.3 (medium), 2022-03-23: BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can…
CVE-2022-0778 - CVSS 7.5 (high), 2022-03-15: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this…
CVE-2021-4160 - CVSS 5.9 (medium), 2022-01-28: There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves.…
CVE-2022-0235 - CVSS 8.8 (high), 2022-01-16: node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
CVE-2022-0155 - CVSS 8 (high), 2022-01-10: follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
CVE-2021-22945 - CVSS 9.1 (critical), 2021-09-23: When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and…
CVE-2021-3749 - CVSS 7.5 (high), 2021-08-31: axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-25217 - CVSS 7.4 (high), 2021-05-26: In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the…
CVE-2021-23841 - CVSS 5.9 (medium), 2021-02-16: The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained…
CVE-2021-23839 - CVSS 3.7 (low), 2021-02-16: OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS…
CVE-2021-23337 - CVSS 7.2 (high), 2021-02-15: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-28500 - CVSS 5.3 (medium), 2021-02-15: Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVE-2020-7793 - CVSS 7.5 (high), 2020-12-11: The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
CVE-2020-28168 - CVSS 5.9 (medium), 2020-11-06: Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that…
CVE-2020-12762 - CVSS 7.8 (high), 2020-05-09: json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.