SIEMENS CERT
12/13/2022
SSA-638652 V1.2 (Last Update: 2022-12-13): Authentication Bypass Vulnerability in Mendix SAML Module
The Mendix SAML module insufficiently protects from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version. Note: For compatibility reasons, fix versions are …
SIEMENS CERT
12/13/2022
SICAM PAS/PQS before V8.06 is affected by three vulnerabilities which could lead to remote code execution, privilege escalation or the creation of a denial of service condition. Siemens has released several updates for SICAM PAS/PQS and recommends to update to the latest version.
SIEMENS CERT
12/13/2022
Siemens Teamcenter Visualization and JT2Go are affected by multiple file parsing vulnerabilities that could be triggered when the application reads malicious TIF, CGM or PDF files. If a user is tricked to open a malicious TIF, CGM or PDF file with the affected products, this could lead the application to …
SIEMENS CERT
12/13/2022
A privilege management vulnerability in the APOGEE PXC and TALON TC series of products could allow low privilege authenticated attackers to gain high privilege access. Siemens has released updates for the affected products and recommends to update to the latest versions.
SIEMENS CERT
12/13/2022
The Mendix Workflow Commons module improperly handles access control for some module entities. This could allow authenticated remote attackers to read or delete sensitive information. Mendix has released an update for the Mendix Workflow Commons module and recommends to update to the latest version. Note that the fix might slightly …
SIEMENS CERT
12/13/2022
A vulnerability in the third party component SISCO MMS-EASE could allow attackers to cause a denial of service condition with SIPROTEC 5 devices. Siemens has released updates for the affected products and recommends to update to the latest versions.
US CERT
11/17/2022
Summary This Alert is the result of recent collaboration between the Department of the Treasury Financial Sector Cyber Information Group (CIG) and the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) to identify and share information with the financial services sector. Treasury and the Cybersecurity and Infrastructure Security Agency …
US CERT
11/17/2022
Summary The Cybersecurity and Infrastructure Security Agency (CISA) is sharing the following information with the cybersecurity community as a primer for assisting in the protection of our Nation’s critical infrastructure in light of the current tensions between the Islamic Republic of Iran and the United States and Iran’s historic use …