https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 14:44:01 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-63356 <p>Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.</p> <p>Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.</p> https://db.gcve.eu/vuln/fkie_cve-2026-63356 https://db.gcve.eu/vuln/ghsa-739x-j4vq-qrx3 <p>Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page.</p> <p>This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.</p> <p>Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page.</p> <p>This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.</p> https://db.gcve.eu/vuln/ghsa-739x-j4vq-qrx3 https://db.gcve.eu/vuln/ncsc-2026-0415 NCSC-2026-0415 https://db.gcve.eu/vuln/ncsc-2026-0415 https://db.gcve.eu/vuln/ssa-591731 <p>SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization.</p> <p>Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.</p> <p>SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow an attacker to execute malicious code in an authorized user’s browser session and perform PLC operations within the scope of that user’s authorization.</p> <p>Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.</p> https://db.gcve.eu/vuln/ssa-591731