Timur Yunusov

The issue allows an attacker to send a malicious packet to the Common Gateway Interface (CGI) of a target device, causing it to fail while setting the port attribute. This results in a Denial of Service (DoS) attack.

The issue allows remote authenticated users to execute arbitrary SQL commands. This is due to insufficient protection of the SQL query structure during authentication, which enables SQL code injection. Exploitation of this issue may allow a remote attacker to execute arbitrary SQL commands and modify web server settings, accounts, and projects.

The issue is related to an XML external entity (XXE) vulnerability in the WebHMI server, which can be exploited by local users to cause a denial of service, resulting in CPU or network traffic consumption, or to read arbitrary files.

The issue allows remote attackers to execute arbitrary SQL commands.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized actions on the web application.

The issue affects the confidentiality and availability of the system, but details about the vectors used for exploitation are not specified. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service through CPU and memory consumption. This is related to an XML External Entity (XXE) issue, where an XML document containing an external entity declaration in conjunction with an entity reference can be used for exploitation.

The issue allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out remotely.

An issue exists in the way Microsoft Excel parses specially crafted XML files, allowing remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference. This is related to an XML External Entity (XXE) issue, which is an information disclosure vulnerability.

The issue allows remote attackers to obtain sensitive information via crafted XML data in a FrontPage document. This is due to the improper parsing of DTDs.

The issue is related to an XML External Entity (XXE) problem, where an XML document containing an external entity declaration in conjunction with an entity reference can be used to read arbitrary files. This occurs because of the way Microsoft Word parses specially crafted XML files containing external entities, leading to an information disclosure vulnerability.

The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. The vulnerability is also associated with insufficient access restrictions to certain functions, which can be exploited by an attacker to achieve similar malicious outcomes.

A cross-site request forgery (CSRF) issue exists due to improper configuration of SIMATIC HMI panels by the WinCC product, allowing remote attackers to hijack the authentication of victims.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels. This is due to an open redirect vulnerability in the affected software.

The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors. This is related to a SQL injection vulnerability in the login screen of the Web Navigator in Siemens WinCC.

An information disclosure issue exists due to the way Microsoft Visio handles specially crafted XML files containing external entities. This allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference.

The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service through CPU and memory consumption. This is achieved via an XML external entity declaration in conjunction with an entity reference.

The issue allows remote attackers to obtain sensitive information or cause a denial of service by using a crafted project file.

The issue allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service due to CPU and memory consumption. This is achieved via an XML external entity declaration in conjunction with an entity reference.