https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 14:43:38 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-63350 <p>Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.</p> <p>Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.</p> https://db.gcve.eu/vuln/fkie_cve-2026-63350 https://db.gcve.eu/vuln/ghsa-f4m3-j7vm-pp4x <p>Affected devices do not properly restrict executable content contained in imported trace files.</p> <p>This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.</p> <p>Affected devices do not properly restrict executable content contained in imported trace files.</p> <p>This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.</p> https://db.gcve.eu/vuln/ghsa-f4m3-j7vm-pp4x https://db.gcve.eu/vuln/ncsc-2026-0415 NCSC-2026-0415 https://db.gcve.eu/vuln/ncsc-2026-0415 https://db.gcve.eu/vuln/ssa-591731 <p>SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization.</p> <p>Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.</p> <p>SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization.</p> <p>Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.</p> https://db.gcve.eu/vuln/ssa-591731