VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-201912-1266 CVE-2019-18300 SPPA-T3000 MS3000 Migration Server Integer overflow vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18291, CVE-2019-18292, CVE-2019-18294, CVE-2019-18298, CVE-2019-18299, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-18307. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18290 , CVE-2019-18291 , CVE-2019-18292 , CVE-2019-18294 , CVE-2019-18298 , CVE-2019-18299 , CVE-2019-18301 , CVE-2019-18302 , CVE-2019-18303 , CVE-2019-18304 , CVE-2019-18305 , CVE-2019-18306 , CVE-2019-18307 Is a different vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. MS3000 Migration Server is one of them
VAR-201912-1265 CVE-2019-18299 SPPA-T3000 MS3000 Migration Server Vulnerable to out-of-bounds writing CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18291, CVE-2019-18292, CVE-2019-18294, CVE-2019-18298, CVE-2019-18300, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-18307. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18290 , CVE-2019-18291 , CVE-2019-18292 , CVE-2019-18294 , CVE-2019-18298 , CVE-2019-18300 , CVE-2019-18301 , CVE-2019-18302 , CVE-2019-18303 , CVE-2019-18304 , CVE-2019-18305 , CVE-2019-18306 , CVE-2019-18307 Is a different vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. MS3000 Migration Server is one of them
VAR-201912-1005 CVE-2019-18287 SPPA-T3000 Application Server Authentication vulnerability CVSS V2: 5.0
CVSS V3: 5.3
Severity: MEDIUM
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes directory listings and files containing sensitive information. This vulnerability is independent from CVE-2019-18286. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. Application Server is one of the application servers that provides the main system services, including access control, data distribution to thin clients, and archiving
VAR-201912-1278 CVE-2019-18312 SPPA-T3000 MS3000 Migration Server Authentication vulnerability CVSS V2: 5.0
CVSS V3: 5.3
Severity: MEDIUM
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could be able to enumerate running RPC services. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants
VAR-201912-1277 CVE-2019-18311 Siemens SPPA-T3000 MS3000 Migration Server Denial of service vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition by sending specifically crafted packets to port 7061/tcp. This vulnerability is independent from CVE-2019-18310. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18310 Is a different vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. MS3000 Migration Server is one of them
VAR-201912-0877 CVE-2019-14608 Intel(R) NUC(R) Buffer error vulnerability CVSS V2: 4.6
CVSS V3: 7.8
Severity: HIGH
Improper buffer restrictions in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access. Intel(R) NUC(R) Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intel NUC 8 Mainstream Game Kit and so on are a small desktop computer of Intel Corporation of the United States. Intel NUC's firmware has a buffer limitation error vulnerability, which is caused by the program's failure to properly perform buffer limitation, and a local attacker can use this vulnerability to elevate permissions
VAR-201912-1006 CVE-2019-18288 Siemens SPPA-T3000 Application Server File upload vulnerability CVSS V2: 6.5
CVSS V3: 8.8
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with valid authentication at the RMI interface could be able to gain remote code execution through an unsecured file upload. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. SPPA-T3000 Application Server Contains an out-of-bounds write vulnerability and an unlimited upload of dangerous types of files.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. Application Server is one of the application servers that provides the main system services, including access control, data distribution to thin clients, and archiving. There is a security vulnerability in the Siemens SPPA-T3000 Application Server
VAR-201912-1262 CVE-2019-18296 SPPA-T3000 MS3000 Migration Server Vulnerable to out-of-bounds writing CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18289, CVE-2019-18293, and CVE-2019-18295. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18289 , CVE-2019-18293 , CVE-2019-18295 Is a different vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants
VAR-201912-1280 CVE-2019-18314 SPPA-T3000 Application Server Authentication vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could gain remote code execution by sending specifically crafted objects via RMI. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. SPPA-T3000 Application Server Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. Application Server is one of the application servers that provides the main system services, including access control, data distribution to thin clients, and archiving. There is a security vulnerability in the Siemens SPPA-T3000 Application Server
VAR-201912-1276 CVE-2019-18310 Siemens SPPA-T3000 MS3000 Migration Server Heap Buffer Overflow Vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition by sending specifically crafted packets to port 7061/tcp. This vulnerability is independent from CVE-2019-18311. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18311 Is a different vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants
VAR-201912-1281 CVE-2019-18315 SPPA-T3000 Application Server Authentication vulnerability CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could gain remote code execution by sending specifically crafted packets to 8888/tcp. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. SPPA-T3000 Application Server Contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. Application Server is one of the application servers that provides the main system services, including access control, data distribution to thin clients, and archiving. There is a security vulnerability in the Siemens SPPA-T3000 Application Server
VAR-201912-1273 CVE-2019-18307 Siemens SPPA-T3000 MS3000 Migration Server Out-of-bounds read vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18291, CVE-2019-18292, CVE-2019-18294, CVE-2019-18298, CVE-2019-18299, CVE-2019-18300, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, and CVE-2019-18306. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18290 , CVE-2019-18291 , CVE-2019-18292 , CVE-2019-18294 , CVE-2019-18298 , CVE-2019-18299 , CVE-2019-18300 , CVE-2019-18301 , CVE-2019-18302 , CVE-2019-18303 , CVE-2019-18304 , CVE-2019-18305 , CVE-2019-18306 Is a different vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants
VAR-201912-1272 CVE-2019-18306 SPPA-T3000 MS3000 Migration Server Vulnerable to out-of-bounds reading CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18291, CVE-2019-18292, CVE-2019-18294, CVE-2019-18298, CVE-2019-18299, CVE-2019-18300, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, and CVE-2019-18307. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18290 , CVE-2019-18291 , CVE-2019-18292 , CVE-2019-18294 , CVE-2019-18298 , CVE-2019-18299 , CVE-2019-18300 , CVE-2019-18301 , CVE-2019-18302 , CVE-2019-18303 , CVE-2019-18304 , CVE-2019-18305 , CVE-2019-18307 Is a different vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. MS3000 Migration Server is one of them
VAR-201912-0882 CVE-2019-14612 Intel(R) NUC(R) Vulnerable to out-of-bounds writing CVSS V2: 4.6
CVSS V3: 6.7
Severity: MEDIUM
Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access. Intel(R) NUC(R) Contains an out-of-bounds vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intel NUC Kit NUC7i5DNKE and other products are products of Intel Corporation of the United States. Intel NUC Kit NUC7i5DNKE is a mini-host product. Intel NUC 8 Mainstream Game Kit is a small desktop computer. Intel NUC 8 Mainstream Game Mini Computer is a small desktop computer. An out-of-bounds write vulnerability exists in the Intel NUC firmware. Local attackers can use this vulnerability to elevate privileges
VAR-201912-0878 CVE-2019-14609 Intel(R) NUC(R) Input validation vulnerability CVSS V2: 4.6
CVSS V3: 6.7
Severity: MEDIUM
Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access. Intel(R) NUC(R) Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intel NUC 8 Mainstream Game Kit and so on are a small desktop computer of Intel Corporation of the United States
VAR-201912-1264 CVE-2019-18298 SPPA-T3000 MS3000 Migration Server Integer overflow vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18291, CVE-2019-18292, CVE-2019-18294, CVE-2019-18299, CVE-2019-18300, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-18307. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18290 , CVE-2019-18291 , CVE-2019-18292 , CVE-2019-18294 , CVE-2019-18299 , CVE-2019-18300 , CVE-2019-18301 , CVE-2019-18302 , CVE-2019-18303 , CVE-2019-18304 , CVE-2019-18305 , CVE-2019-18306 , CVE-2019-18307 Is a different vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. MS3000 Migration Server is one of them
VAR-201912-1257 CVE-2019-18291 SPPA-T3000 MS3000 Migration Server Vulnerable to out-of-bounds writing CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18292, CVE-2019-18294, CVE-2019-18298, CVE-2019-18299, CVE-2019-18300, CVE-2019-18301, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-18307. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18290 , CVE-2019-18292 , CVE-2019-18294 , CVE-2019-18298 , CVE-2019-18299 , CVE-2019-18300 , CVE-2019-18301 , CVE-2019-18302 , CVE-2019-18303 , CVE-2019-18304 , CVE-2019-18305 , CVE-2019-18306 , CVE-2019-18307 Is a different vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants
VAR-201912-1267 CVE-2019-18301 SPPA-T3000 MS3000 Migration Server Integer overflow vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18291, CVE-2019-18292, CVE-2019-18294, CVE-2019-18298, CVE-2019-18299, CVE-2019-18300, CVE-2019-18302, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-18307. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18290 , CVE-2019-18291 , CVE-2019-18292 , CVE-2019-18294 , CVE-2019-18298 , CVE-2019-18299 , CVE-2019-18300 , CVE-2019-18302 , CVE-2019-18303 , CVE-2019-18304 , CVE-2019-18305 , CVE-2019-18306 , CVE-2019-18307 Is a different vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. MS3000 Migration Server is one of them
VAR-201912-1268 CVE-2019-18302 SPPA-T3000 MS3000 Migration Server Integer overflow vulnerability CVSS V2: 5.0
CVSS V3: 7.5
Severity: HIGH
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can trigger a Denial-of-Service condition by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18290, CVE-2019-18291, CVE-2019-18292, CVE-2019-18294, CVE-2019-18298, CVE-2019-18299, CVE-2019-18300, CVE-2019-18301, CVE-2019-18303, CVE-2019-18304, CVE-2019-18305, CVE-2019-18306, and CVE-2019-18307. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18290 , CVE-2019-18291 , CVE-2019-18292 , CVE-2019-18294 , CVE-2019-18298 , CVE-2019-18299 , CVE-2019-18300 , CVE-2019-18301 , CVE-2019-18303 , CVE-2019-18304 , CVE-2019-18305 , CVE-2019-18306 , CVE-2019-18307 Is a different vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants. MS3000 Migration Server is one of them
VAR-201912-1007 CVE-2019-18289 SPPA-T3000 MS3000 Migration Server Vulnerable to out-of-bounds writing CVSS V2: 7.5
CVSS V3: 9.8
Severity: CRITICAL
A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18293, CVE-2019-18295, and CVE-2019-18296. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. This vulnerability CVE-2019-18293 , CVE-2019-18295 , CVE-2019-18296 Is a different vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. SPPA-T3000 is a distributed control system mainly used in thermal power plants and large renewable energy power plants