Siemens Comos vulnerabilities

CVE-2021-31784 [HIGH] CWE-787 CVE-2021-31784: An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Dr An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supported by ODA platforms in static configuration. This can allow attackers to cause a crash, potentially enabling a denial of service attack (Crash, Exit, or Restart) or possible code execution.

CVE-2021-25173 [HIGH] CWE-770 CVE-2021-25173: An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation wit An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which allows attackers to cause a crash, potentially enabling denial of service (crash, exit, or restart).

CVE-2021-25174 [HIGH] CWE-787 CVE-2021-25174: An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vul An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to cause a crash, potentially enabling denial of service (Crash, Exit, or Restart).

CVE-2021-37195 [MEDIUM] CWE-80 CVE-2021-37195: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), C A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS accepts arbitrary code as attachment to tasks. This could allow an attacker to

CVE-2021-32950 [HIGH] CWE-125 CVE-2021-32950: An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allows attackers to cause a denial-of-service condition or read sensitive information from memory loc

CVE-2021-32940 [HIGH] CWE-125 CVE-2021-32940: An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All ver An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022.5) resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or read sensitive information from memory

CVE-2013-4943 [HIGH] CWE-264 CVE-2013-4943: The client application in Siemens COMOS before 9.1 Update 458, 9.2 before 9.2.0.6.37, and 10.0 befor The client application in Siemens COMOS before 9.1 Update 458, 9.2 before 9.2.0.6.37, and 10.0 before 10.0.3.0.19 allows local users to gain privileges and bypass intended database-operation restrictions by leveraging COMOS project access.

CVE-2021-32938 [HIGH] CWE-125 CVE-2021-32938: Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing o Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allows attackers to cause a denial-of service condition or read sensitive information from memory.

CVE-2013-6840 [MEDIUM] CWE-264 CVE-2013-6840: Siemens COMOS before 9.2.0.8.1, 10.0 before 10.0.3.1.40, and 10.1 before 10.1.0.0.2 allows local use Siemens COMOS before 9.2.0.8.1, 10.0 before 10.0.3.1.40, and 10.1 before 10.1.0.0.2 allows local users to gain database privileges via unspecified vectors.

CVE-2013-3927 [MEDIUM] CVE-2013-3927: Unspecified vulnerability in the client library in Siemens COMOS 9.2 before 9.2.0.6.10 and 10.0 befo Unspecified vulnerability in the client library in Siemens COMOS 9.2 before 9.2.0.6.10 and 10.0 before 10.0.3.0.4 allows local users to obtain unintended write access to the database by leveraging read access.