{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination and support with this publication",
        "urls": [
          "https://certvde.com/"
        ]
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "Festo Didactic offers products with security functions that aid the safe operation of plants, systems, machines and networks. In order to protect plants, systems, machines and networks from cyber threats, a comprehensive security concept must be implemented and continuously updated. Festo products and services only constitute one part of such a concept.\nThe customer is responsible for preventing unauthorized access to their plants, systems, machines and networks. Systems, machines and components should only be connected to a company\u0027s network or the Internet if and as necessary, and only when the suitable security measures (e.g., firewalls and network segmentation, defense-in-depth) are in place. Failure to ensure adequate security measures when connecting the product to the network can result in vulnerabilities which allow unauthorized, remote access to the network - even beyond the product boundaries. This access could be abused to incur a loss of data or manipulate or sabotage systems. Typical forms of attack include but are not limited to: Denial-of-Service (rendering the system temporarily non-functional), remote execution of malicious code, privilege escalation (executing malicious code with higher system privileges than expected), ransomware (encryption of data and demanding payment for decryption). In the context of industrial systems and machines this can also lead to unsafe states, posing a danger to people and equipment.\nFurthermore, Festo guidelines on suitable security measures should be observed. Festo products and solutions are constantly being developed further in order to make them more secure. Festo strongly recommends that customers install product updates as soon as they become available and always use the latest versions of its products. Any use of product versions that are no longer supported or any failure to install the latest updates may render the customer vulnerable to cyber-attacks.",
        "title": "General recommendation"
      },
      {
        "category": "summary",
        "text": "MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications. \n\nMES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic\u0027s Factory Control Panel application.",
        "title": "Summary"
      },
      {
        "category": "legal_disclaimer",
        "text": "Festo assumes no liability whatsoever for indirect, collateral, accidental or consequential losses that occur by the distribution and/or use of this document or any losses in connection with the distribution and/or use of this document. All information published in this document is provided free of charge and on good faith by Festo. Insofar as permissible by law, however, none of this information shall establish any warranty, guarantee, commitment, or liability on the part of Festo.\\n\\nNote: In no case does this information release the operator or responsible person from the obligation to check the effect on his system or installation before using the information and, in the event of negative consequences, not to use the information.\\n\\nIn addition, the actual general terms, and conditions for delivery, payment and software use of Festo, available under http://www.festo.com and the special provisions for the use of Festo Security Advisory available at https://www.festo.com/psirt shall apply.",
        "title": "Disclaimer"
      },
      {
        "category": "description",
        "text": "The vulnerabilities covered by this advisory have a broad range of impacts ranging from denial-of-service to disclosure or manipulation/deletion of information.\nGiven the intended usage of MES PCs for didactic purposes in controlled lab environments, separate from productive systems, it never comes into contact with sensitive information. Therefore the impact is reduced to limited availability of the system.",
        "title": "Impact"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@festo.com",
      "name": "Festo SE \u0026 Co. KG",
      "namespace": "https://festo.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)",
        "url": "https://festo.com/psirt"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisory",
        "url": "https://certvde.com/en/advisories/vendor/festo/"
      },
      {
        "category": "self",
        "summary": "FSA-202402: Several Vulnerabilities in MES PC (Windows 10) - CSAF",
        "url": "https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2024/fsa-202402.json"
      },
      {
        "category": "self",
        "summary": "FSA-202402: Several Vulnerabilities in MES PC (Windows 10) - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-065"
      }
    ],
    "title": "Several Vulnerabilities in MES PC (Windows 10)",
    "tracking": {
      "aliases": [
        "VDE-2023-065"
      ],
      "current_release_date": "2025-12-08T07:00:00.000Z",
      "generator": {
        "date": "2025-12-08T07:08:55.567Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.40"
        }
      },
      "id": "FSA-202402",
      "initial_release_date": "2024-02-27T12:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-02-27T12:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial version"
        },
        {
          "date": "2025-11-04T11:00:00.000Z",
          "number": "1.0.1",
          "summary": "Adjust to VDE template. Add missing CWE-IDs if available. Updated legal disclaimer to add references to special provisions."
        },
        {
          "date": "2025-12-08T07:00:00.000Z",
          "number": "1.1.0",
          "summary": "Add all missing CWE identifier and CVSS 3.x scores."
        }
      ],
      "status": "final",
      "version": "1.1.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "shipped with Windows 10",
                "product": {
                  "name": "Festo Didactic SE MES PC shipped with Windows 10",
                  "product_id": "MES"
                }
              }
            ],
            "category": "product_name",
            "name": "MES PC"
          }
        ],
        "category": "vendor",
        "name": "Festo Didactic SE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-11036",
      "cwe": {
        "id": "CWE-126",
        "name": "Buffer Over-read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "108177",
          "url": "http://www.securityfocus.com/bid/108177"
        },
        {
          "summary": "FEDORA-2019-6350c4e21a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BY2XUUAN277LS7HKAOGL4DVGAELOJV3/"
        },
        {
          "summary": "FEDORA-2019-6e325234a4",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NFXYNCXZCPYT7ZN4ZLI5EPQQW44FRRO/"
        },
        {
          "summary": "FEDORA-2019-bab3944fee",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WN2HLPGEZEF4MFM5YC5FILZB5QEQFP3A/"
        },
        {
          "summary": "USN-3566-2",
          "url": "https://usn.ubuntu.com/3566-2/"
        },
        {
          "summary": "[debian-lts-announce] 20190525 [SECURITY] [DLA 1803-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html"
        },
        {
          "summary": "openSUSE-SU-2019:1501",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html"
        },
        {
          "summary": "openSUSE-SU-2019:1503",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html"
        },
        {
          "summary": "USN-4009-1",
          "url": "https://usn.ubuntu.com/4009-1/"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "20190920 [SECURITY] [DSA 4527-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/35"
        },
        {
          "summary": "DSA-4527",
          "url": "https://www.debian.org/security/2019/dsa-4527"
        },
        {
          "summary": "DSA-4529",
          "url": "https://www.debian.org/security/2019/dsa-4529"
        },
        {
          "summary": "20190923 [SECURITY] [DSA 4529-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/38"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11036"
    },
    {
      "cve": "CVE-2023-25727",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2023-25727"
    },
    {
      "cve": "CVE-2021-2011",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-db50ab62d3",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/"
        },
        {
          "summary": "FEDORA-2021-b1d1655cef",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2011"
    },
    {
      "cve": "CVE-2022-32083",
      "cwe": {
        "id": "CWE-229",
        "name": "Improper Handling of Values"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-32083"
    },
    {
      "cve": "CVE-2021-46668",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact with storage-engine resource limitations for temporary data structures.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-263f7cc483",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
        },
        {
          "summary": "FEDORA-2022-03350936ee",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
        },
        {
          "summary": "FEDORA-2022-5cfe372ab7",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-46668"
    },
    {
      "cve": "CVE-2018-19518",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a \"-oProxyCommand\" argument.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "45914",
          "url": "https://www.exploit-db.com/exploits/45914/"
        },
        {
          "summary": "[debian-lts-announce] 20190301 [SECURITY] [DLA 1700-1] uw-imap security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00001.html"
        },
        {
          "summary": "1042157",
          "url": "http://www.securitytracker.com/id/1042157"
        },
        {
          "summary": "DSA-4353",
          "url": "https://www.debian.org/security/2018/dsa-4353"
        },
        {
          "summary": "106018",
          "url": "http://www.securityfocus.com/bid/106018"
        },
        {
          "summary": "[debian-lts-announce] 20181217 [SECURITY] [DLA 1608-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00006.html"
        },
        {
          "summary": "USN-4160-1",
          "url": "https://usn.ubuntu.com/4160-1/"
        },
        {
          "summary": "GLSA-202003-57",
          "url": "https://security.gentoo.org/glsa/202003-57"
        },
        {
          "summary": "[debian-lts-announce] 20211229 [SECURITY] [DLA 2866-1] uw-imap security update",
          "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00031.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2018-19518"
    },
    {
      "cve": "CVE-2021-2194",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-01189f6361",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKV7TRUEQW6EV45RSZVVFLVQMNHVHBCJ/"
        },
        {
          "summary": "FEDORA-2021-5b6c69a73a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJVUTKKFQAWR7NURCQHQQ5JHTVYGEOYQ/"
        },
        {
          "summary": "FEDORA-2021-b8b7829a83",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJQRPXNDH6YHQLUSCS5VA7DAW32PN7N7/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2194"
    },
    {
      "cve": "CVE-2019-11049",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2019-437d94e271",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/"
        },
        {
          "summary": "FEDORA-2019-a54a622670",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/"
        },
        {
          "summary": "20200218 [SECURITY] [DSA 4626-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/27"
        },
        {
          "summary": "DSA-4626",
          "url": "https://www.debian.org/security/2020/dsa-4626"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11049"
    },
    {
      "cve": "CVE-2022-31626",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-0a96e5b9b1",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZTZQKRGEYJT5UB4FGG3MOE72SQUHSL4/"
        },
        {
          "summary": "FEDORA-2022-f3fc52428e",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/"
        },
        {
          "summary": "DSA-5179",
          "url": "https://www.debian.org/security/2022/dsa-5179"
        },
        {
          "summary": "GLSA-202209-20",
          "url": "https://security.gentoo.org/glsa/202209-20"
        },
        {
          "summary": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-31626"
    },
    {
      "cve": "CVE-2022-32084",
      "cwe": {
        "id": "CWE-229",
        "name": "Improper Handling of Values"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        },
        {
          "summary": "FEDORA-2022-cf88f807f9",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHISY4YVO4S5QJYYIXCIAXBM7INOL4VY/"
        },
        {
          "summary": "FEDORA-2022-e0e9a43546",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/"
        },
        {
          "summary": "FEDORA-2022-333df1c4aa",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-32084"
    },
    {
      "cve": "CVE-2022-32088",
      "cwe": {
        "id": "CWE-229",
        "name": "Improper Handling of Values"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-32088"
    },
    {
      "cve": "CVE-2022-27377",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27377"
    },
    {
      "cve": "CVE-2020-2922",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Client accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-4350-1",
          "url": "https://usn.ubuntu.com/4350-1/"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-2922"
    },
    {
      "cve": "CVE-2019-9638",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note-\u003eoffset relationship to value_len.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4403",
          "url": "https://www.debian.org/security/2019/dsa-4403"
        },
        {
          "summary": "USN-3922-1",
          "url": "https://usn.ubuntu.com/3922-1/"
        },
        {
          "summary": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1741-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html"
        },
        {
          "summary": "USN-3922-2",
          "url": "https://usn.ubuntu.com/3922-2/"
        },
        {
          "summary": "USN-3922-3",
          "url": "https://usn.ubuntu.com/3922-3/"
        },
        {
          "summary": "openSUSE-SU-2019:1293",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html"
        },
        {
          "summary": "openSUSE-SU-2019:1503",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9638"
    },
    {
      "cve": "CVE-2019-11044",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \\0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2019-437d94e271",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/"
        },
        {
          "summary": "FEDORA-2019-a54a622670",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11044"
    },
    {
      "cve": "CVE-2020-7068",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "GLSA-202009-10",
          "url": "https://security.gentoo.org/glsa/202009-10"
        },
        {
          "summary": "DSA-4856",
          "url": "https://www.debian.org/security/2021/dsa-4856"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7068"
    },
    {
      "cve": "CVE-2020-7069",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2020-4573f0e03a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/"
        },
        {
          "summary": "FEDORA-2020-4fe6b116e5",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/"
        },
        {
          "summary": "FEDORA-2020-94763cb98b",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/"
        },
        {
          "summary": "openSUSE-SU-2020:1703",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html"
        },
        {
          "summary": "USN-4583-1",
          "url": "https://usn.ubuntu.com/4583-1/"
        },
        {
          "summary": "openSUSE-SU-2020:1767",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html"
        },
        {
          "summary": "GLSA-202012-16",
          "url": "https://security.gentoo.org/glsa/202012-16"
        },
        {
          "summary": "DSA-4856",
          "url": "https://www.debian.org/security/2021/dsa-4856"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7069"
    },
    {
      "cve": "CVE-2015-2301",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-3198",
          "url": "http://www.debian.org/security/2015/dsa-3198"
        },
        {
          "summary": "USN-2535-1",
          "url": "http://www.ubuntu.com/usn/USN-2535-1"
        },
        {
          "summary": "HPSBMU03409",
          "url": "http://marc.info/?l=bugtraq\u0026m=144050155601375\u0026w=2"
        },
        {
          "summary": "openSUSE-SU-2015:0644",
          "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html"
        },
        {
          "summary": "APPLE-SA-2015-09-30-3",
          "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
        },
        {
          "summary": "1031949",
          "url": "http://www.securitytracker.com/id/1031949"
        },
        {
          "summary": "HPSBMU03380",
          "url": "http://marc.info/?l=bugtraq\u0026m=143748090628601\u0026w=2"
        },
        {
          "summary": "MDVSA-2015:079",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:079"
        },
        {
          "summary": "SSRT102066",
          "url": "http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2"
        },
        {
          "summary": "SUSE-SU-2015:0868",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html"
        },
        {
          "summary": "73037",
          "url": "http://www.securityfocus.com/bid/73037"
        },
        {
          "summary": "RHSA-2015:1135",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html"
        },
        {
          "summary": "RHSA-2015:1053",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
        },
        {
          "summary": "HPSBUX03337",
          "url": "http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2"
        },
        {
          "summary": "[oss-security] 20150315 Re: CVE Request: PHP 5.6.6 changelog",
          "url": "http://openwall.com/lists/oss-security/2015/03/15/6"
        },
        {
          "summary": "GLSA-201606-10",
          "url": "https://security.gentoo.org/glsa/201606-10"
        },
        {
          "summary": "RHSA-2015:1066",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
        },
        {
          "summary": "RHSA-2015:1218",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1218.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2015-2301"
    },
    {
      "cve": "CVE-2023-0568",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2023-0568"
    },
    {
      "cve": "CVE-2022-27458",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27458"
    },
    {
      "cve": "CVE-2021-21706",
      "cwe": {
        "id": "CWE-24",
        "name": "Path Traversal: \u0027../filedir\u0027"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-21706"
    },
    {
      "cve": "CVE-2022-27452",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27452"
    },
    {
      "cve": "CVE-2020-7071",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4856",
          "url": "https://www.debian.org/security/2021/dsa-4856"
        },
        {
          "summary": "GLSA-202105-23",
          "url": "https://security.gentoo.org/glsa/202105-23"
        },
        {
          "summary": "[debian-lts-announce] 20210715 [SECURITY] [DLA 2708-1] php7.0 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00008.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7071"
    },
    {
      "cve": "CVE-2022-27387",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27387"
    },
    {
      "cve": "CVE-2022-27376",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27376"
    },
    {
      "cve": "CVE-2019-11043",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-4166-1",
          "url": "https://usn.ubuntu.com/4166-1/"
        },
        {
          "summary": "DSA-4552",
          "url": "https://www.debian.org/security/2019/dsa-4552"
        },
        {
          "summary": "DSA-4553",
          "url": "https://www.debian.org/security/2019/dsa-4553"
        },
        {
          "summary": "USN-4166-2",
          "url": "https://usn.ubuntu.com/4166-2/"
        },
        {
          "summary": "FEDORA-2019-4adc49a476",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/"
        },
        {
          "summary": "RHSA-2019:3286",
          "url": "https://access.redhat.com/errata/RHSA-2019:3286"
        },
        {
          "summary": "RHSA-2019:3287",
          "url": "https://access.redhat.com/errata/RHSA-2019:3287"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        },
        {
          "summary": "RHSA-2019:3300",
          "url": "https://access.redhat.com/errata/RHSA-2019:3300"
        },
        {
          "summary": "FEDORA-2019-187ae3128d",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/"
        },
        {
          "summary": "FEDORA-2019-7bb07c3b02",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/"
        },
        {
          "summary": "openSUSE-SU-2019:2441",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html"
        },
        {
          "summary": "RHSA-2019:3724",
          "url": "https://access.redhat.com/errata/RHSA-2019:3724"
        },
        {
          "summary": "RHSA-2019:3735",
          "url": "https://access.redhat.com/errata/RHSA-2019:3735"
        },
        {
          "summary": "RHSA-2019:3736",
          "url": "https://access.redhat.com/errata/RHSA-2019:3736"
        },
        {
          "summary": "openSUSE-SU-2019:2457",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html"
        },
        {
          "summary": "20200129 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra",
          "url": "https://seclists.org/bugtraq/2020/Jan/44"
        },
        {
          "summary": "20200131 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra",
          "url": "http://seclists.org/fulldisclosure/2020/Jan/40"
        },
        {
          "summary": "RHSA-2020:0322",
          "url": "https://access.redhat.com/errata/RHSA-2020:0322"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11043"
    },
    {
      "cve": "CVE-2021-2032",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Information Schema). Supported versions that are affected are 5.7.32 and prior and 8.0.22 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2032"
    },
    {
      "cve": "CVE-2021-2007",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Client accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-db50ab62d3",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/"
        },
        {
          "summary": "FEDORA-2021-b1d1655cef",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2007"
    },
    {
      "cve": "CVE-2019-11045",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \\0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20191229 [SECURITY] [DLA 2050-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html"
        },
        {
          "summary": "FEDORA-2019-437d94e271",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/"
        },
        {
          "summary": "FEDORA-2019-a54a622670",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/"
        },
        {
          "summary": "USN-4239-1",
          "url": "https://usn.ubuntu.com/4239-1/"
        },
        {
          "summary": "openSUSE-SU-2020:0080",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html"
        },
        {
          "summary": "20200218 [SECURITY] [DSA 4626-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/27"
        },
        {
          "summary": "DSA-4626",
          "url": "https://www.debian.org/security/2020/dsa-4626"
        },
        {
          "summary": "DSA-4628",
          "url": "https://www.debian.org/security/2020/dsa-4628"
        },
        {
          "summary": "20200219 [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/31"
        },
        {
          "summary": "20210116 Re: [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2021/Jan/3"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11045"
    },
    {
      "cve": "CVE-2022-27445",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27445"
    },
    {
      "cve": "CVE-2022-27457",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27457"
    },
    {
      "cve": "CVE-2022-27384",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27384"
    },
    {
      "cve": "CVE-2022-23808",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-23808"
    },
    {
      "cve": "CVE-2023-0567",
      "cwe": {
        "id": "CWE-916",
        "name": "Use of Password Hash With Insufficient Computational Effort"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2023-0567"
    },
    {
      "cve": "CVE-2019-9025",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the mb_split() function in ext/mbstring/php_mbregex.c can cause PHP to execute memcpy() with a negative argument, which could read and write past buffers allocated for the data.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9025"
    },
    {
      "cve": "CVE-2022-27379",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27379"
    },
    {
      "cve": "CVE-2019-9637",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4403",
          "url": "https://www.debian.org/security/2019/dsa-4403"
        },
        {
          "summary": "USN-3922-1",
          "url": "https://usn.ubuntu.com/3922-1/"
        },
        {
          "summary": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1741-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html"
        },
        {
          "summary": "USN-3922-2",
          "url": "https://usn.ubuntu.com/3922-2/"
        },
        {
          "summary": "USN-3922-3",
          "url": "https://usn.ubuntu.com/3922-3/"
        },
        {
          "summary": "openSUSE-SU-2019:1293",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html"
        },
        {
          "summary": "openSUSE-SU-2019:1503",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9637"
    },
    {
      "cve": "CVE-2021-27928",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20210323 [SECURITY] [DLA 2605-1] mariadb-10.1 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00028.html"
        },
        {
          "summary": "GLSA-202105-28",
          "url": "https://security.gentoo.org/glsa/202105-28"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-27928"
    },
    {
      "cve": "CVE-2021-21703",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4992",
          "url": "https://www.debian.org/security/2021/dsa-4992"
        },
        {
          "summary": "DSA-4993",
          "url": "https://www.debian.org/security/2021/dsa-4993"
        },
        {
          "summary": "[oss-security] 20211026 CVE-2021-21703: PHP-FPM 5.3.7 \u003c= 8.0.12 Local Root",
          "url": "http://www.openwall.com/lists/oss-security/2021/10/26/7"
        },
        {
          "summary": "[debian-lts-announce] 20211027 [SECURITY] [DLA 2794-1] php7.0 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00021.html"
        },
        {
          "summary": "FEDORA-2021-9f68f5f752",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JO5RA6YOBGGGKLIA6F6BQRZDDECF5L3R/"
        },
        {
          "summary": "FEDORA-2021-4140b54de2",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBM3KKB3RY2YPOKNMC4HIH7IH3T3WC74/"
        },
        {
          "summary": "FEDORA-2021-02d218c3be",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PZVLICZUJMXOGWOUWSBAEGIVTF6Y6V3/"
        },
        {
          "summary": "GLSA-202209-20",
          "url": "https://security.gentoo.org/glsa/202209-20"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-21703"
    },
    {
      "cve": "CVE-2020-2760",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.0 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-4350-1",
          "url": "https://usn.ubuntu.com/4350-1/"
        },
        {
          "summary": "FEDORA-2020-20ac7c92a1",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSVLI36TYRTPQGCS24VZQUXCUFOUW4VQ/"
        },
        {
          "summary": "FEDORA-2020-136dc82437",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDGBQYS3A36S4CAZPV5YROHYXYZR6LAH/"
        },
        {
          "summary": "FEDORA-2020-261c9ddd7c",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77REFDB7DE4WNKQIRGZTF53RFBQOXQLC/"
        },
        {
          "summary": "FEDORA-2020-35f52d9370",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/"
        },
        {
          "summary": "openSUSE-SU-2020:0870",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html"
        },
        {
          "summary": "FEDORA-2020-ac2d47d89a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        },
        {
          "summary": "GLSA-202012-08",
          "url": "https://security.gentoo.org/glsa/202012-08"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-2760"
    },
    {
      "cve": "CVE-2021-2166",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-01189f6361",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKV7TRUEQW6EV45RSZVVFLVQMNHVHBCJ/"
        },
        {
          "summary": "FEDORA-2021-5b6c69a73a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJVUTKKFQAWR7NURCQHQQ5JHTVYGEOYQ/"
        },
        {
          "summary": "FEDORA-2021-b8b7829a83",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJQRPXNDH6YHQLUSCS5VA7DAW32PN7N7/"
        },
        {
          "summary": "FEDORA-2021-68db93b130",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK/"
        },
        {
          "summary": "FEDORA-2021-27187ac9dd",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT/"
        },
        {
          "summary": "FEDORA-2021-179f2fbb88",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE/"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        },
        {
          "summary": "GLSA-202105-28",
          "url": "https://security.gentoo.org/glsa/202105-28"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2166"
    },
    {
      "cve": "CVE-2015-2787",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "1032485",
          "url": "http://www.securitytracker.com/id/1032485"
        },
        {
          "summary": "73431",
          "url": "http://www.securityfocus.com/bid/73431"
        },
        {
          "summary": "HPSBMU03409",
          "url": "http://marc.info/?l=bugtraq\u0026m=144050155601375\u0026w=2"
        },
        {
          "summary": "APPLE-SA-2015-09-30-3",
          "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
        },
        {
          "summary": "HPSBMU03380",
          "url": "http://marc.info/?l=bugtraq\u0026m=143748090628601\u0026w=2"
        },
        {
          "summary": "SUSE-SU-2015:0868",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html"
        },
        {
          "summary": "APPLE-SA-2015-08-13-2",
          "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"
        },
        {
          "summary": "USN-2572-1",
          "url": "http://www.ubuntu.com/usn/USN-2572-1"
        },
        {
          "summary": "RHSA-2015:1135",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html"
        },
        {
          "summary": "RHSA-2015:1053",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
        },
        {
          "summary": "openSUSE-SU-2015:0684",
          "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00015.html"
        },
        {
          "summary": "GLSA-201606-10",
          "url": "https://security.gentoo.org/glsa/201606-10"
        },
        {
          "summary": "RHSA-2015:1066",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
        },
        {
          "summary": "RHSA-2015:1218",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1218.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2015-2787"
    },
    {
      "cve": "CVE-2022-23807",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-23807"
    },
    {
      "cve": "CVE-2020-2752",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Client. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2020-35f52d9370",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/"
        },
        {
          "summary": "openSUSE-SU-2020:0870",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html"
        },
        {
          "summary": "FEDORA-2020-ac2d47d89a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        },
        {
          "summary": "GLSA-202012-08",
          "url": "https://security.gentoo.org/glsa/202012-08"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-2752"
    },
    {
      "cve": "CVE-2021-46666",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE clause.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-46666"
    },
    {
      "cve": "CVE-2020-2814",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.47 and prior, 5.7.28 and prior and 8.0.18 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2020-20ac7c92a1",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSVLI36TYRTPQGCS24VZQUXCUFOUW4VQ/"
        },
        {
          "summary": "FEDORA-2020-136dc82437",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDGBQYS3A36S4CAZPV5YROHYXYZR6LAH/"
        },
        {
          "summary": "FEDORA-2020-261c9ddd7c",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77REFDB7DE4WNKQIRGZTF53RFBQOXQLC/"
        },
        {
          "summary": "FEDORA-2020-35f52d9370",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/"
        },
        {
          "summary": "openSUSE-SU-2020:0870",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html"
        },
        {
          "summary": "FEDORA-2020-ac2d47d89a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        },
        {
          "summary": "GLSA-202012-08",
          "url": "https://security.gentoo.org/glsa/202012-08"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-2814"
    },
    {
      "cve": "CVE-2020-7065",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-4330-1",
          "url": "https://usn.ubuntu.com/4330-1/"
        },
        {
          "summary": "USN-4330-2",
          "url": "https://usn.ubuntu.com/4330-2/"
        },
        {
          "summary": "DSA-4719",
          "url": "https://www.debian.org/security/2020/dsa-4719"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7065"
    },
    {
      "cve": "CVE-2021-21705",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "GLSA-202209-20",
          "url": "https://security.gentoo.org/glsa/202209-20"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-21705"
    },
    {
      "cve": "CVE-2020-7062",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "openSUSE-SU-2020:0341",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html"
        },
        {
          "summary": "GLSA-202003-57",
          "url": "https://security.gentoo.org/glsa/202003-57"
        },
        {
          "summary": "[debian-lts-announce] 20200326 [SECURITY] [DLA 2160-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00034.html"
        },
        {
          "summary": "USN-4330-1",
          "url": "https://usn.ubuntu.com/4330-1/"
        },
        {
          "summary": "DSA-4717",
          "url": "https://www.debian.org/security/2020/dsa-4717"
        },
        {
          "summary": "DSA-4719",
          "url": "https://www.debian.org/security/2020/dsa-4719"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7062"
    },
    {
      "cve": "CVE-2019-11039",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "openSUSE-SU-2019:1778",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00029.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "20190920 [SECURITY] [DSA 4527-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/35"
        },
        {
          "summary": "DSA-4527",
          "url": "https://www.debian.org/security/2019/dsa-4527"
        },
        {
          "summary": "DSA-4529",
          "url": "https://www.debian.org/security/2019/dsa-4529"
        },
        {
          "summary": "20190923 [SECURITY] [DSA 4529-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/38"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11039"
    },
    {
      "cve": "CVE-2019-11035",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-3953-1",
          "url": "https://usn.ubuntu.com/3953-1/"
        },
        {
          "summary": "USN-3953-2",
          "url": "https://usn.ubuntu.com/3953-2/"
        },
        {
          "summary": "[debian-lts-announce] 20190525 [SECURITY] [DLA 1803-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html"
        },
        {
          "summary": "openSUSE-SU-2019:1501",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html"
        },
        {
          "summary": "openSUSE-SU-2019:1503",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "DSA-4529",
          "url": "https://www.debian.org/security/2019/dsa-4529"
        },
        {
          "summary": "20190923 [SECURITY] [DSA 4529-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/38"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11035"
    },
    {
      "cve": "CVE-2022-27447",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27447"
    },
    {
      "cve": "CVE-2019-11046",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren\u0027t ASCII numbers. This can read to disclosure of the content of some memory locations.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20191229 [SECURITY] [DLA 2050-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html"
        },
        {
          "summary": "FEDORA-2019-437d94e271",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/"
        },
        {
          "summary": "FEDORA-2019-a54a622670",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/"
        },
        {
          "summary": "USN-4239-1",
          "url": "https://usn.ubuntu.com/4239-1/"
        },
        {
          "summary": "openSUSE-SU-2020:0080",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html"
        },
        {
          "summary": "20200218 [SECURITY] [DSA 4626-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/27"
        },
        {
          "summary": "DSA-4626",
          "url": "https://www.debian.org/security/2020/dsa-4626"
        },
        {
          "summary": "DSA-4628",
          "url": "https://www.debian.org/security/2020/dsa-4628"
        },
        {
          "summary": "20200219 [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/31"
        },
        {
          "summary": "20210116 Re: [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2021/Jan/3"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11046"
    },
    {
      "cve": "CVE-2022-27446",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27446"
    },
    {
      "cve": "CVE-2022-27386",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27386"
    },
    {
      "cve": "CVE-2019-9639",
      "cwe": {
        "id": "CWE-909",
        "name": "Missing Initialization of Resource"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4403",
          "url": "https://www.debian.org/security/2019/dsa-4403"
        },
        {
          "summary": "USN-3922-1",
          "url": "https://usn.ubuntu.com/3922-1/"
        },
        {
          "summary": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1741-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html"
        },
        {
          "summary": "USN-3922-2",
          "url": "https://usn.ubuntu.com/3922-2/"
        },
        {
          "summary": "USN-3922-3",
          "url": "https://usn.ubuntu.com/3922-3/"
        },
        {
          "summary": "openSUSE-SU-2019:1293",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html"
        },
        {
          "summary": "openSUSE-SU-2019:1503",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9639"
    },
    {
      "cve": "CVE-2019-11042",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20190812 [SECURITY] [DLA 1878-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00010.html"
        },
        {
          "summary": "USN-4097-2",
          "url": "https://usn.ubuntu.com/4097-2/"
        },
        {
          "summary": "USN-4097-1",
          "url": "https://usn.ubuntu.com/4097-1/"
        },
        {
          "summary": "20190920 [SECURITY] [DSA 4527-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/35"
        },
        {
          "summary": "DSA-4527",
          "url": "https://www.debian.org/security/2019/dsa-4527"
        },
        {
          "summary": "DSA-4529",
          "url": "https://www.debian.org/security/2019/dsa-4529"
        },
        {
          "summary": "20190923 [SECURITY] [DSA 4529-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/38"
        },
        {
          "summary": "openSUSE-SU-2019:2271",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00019.html"
        },
        {
          "summary": "20191008 APPLE-SA-2019-10-07-1 macOS Catalina 10.15",
          "url": "https://seclists.org/bugtraq/2019/Oct/9"
        },
        {
          "summary": "20191008 APPLE-SA-2019-10-07-1 macOS Catalina 10.15",
          "url": "http://seclists.org/fulldisclosure/2019/Oct/15"
        },
        {
          "summary": "20191031 APPLE-SA-2019-10-29-10 Additional information for APPLE-SA-2019-10-07-1 macOS Catalina 10.15",
          "url": "http://seclists.org/fulldisclosure/2019/Oct/55"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11042"
    },
    {
      "cve": "CVE-2022-27385",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27385"
    },
    {
      "cve": "CVE-2020-7059",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "20200218 [SECURITY] [DSA 4626-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/27"
        },
        {
          "summary": "DSA-4626",
          "url": "https://www.debian.org/security/2020/dsa-4626"
        },
        {
          "summary": "USN-4279-1",
          "url": "https://usn.ubuntu.com/4279-1/"
        },
        {
          "summary": "DSA-4628",
          "url": "https://www.debian.org/security/2020/dsa-4628"
        },
        {
          "summary": "20200219 [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/31"
        },
        {
          "summary": "[debian-lts-announce] 20200228 [SECURITY] [DLA 2124-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html"
        },
        {
          "summary": "openSUSE-SU-2020:0341",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html"
        },
        {
          "summary": "GLSA-202003-57",
          "url": "https://security.gentoo.org/glsa/202003-57"
        },
        {
          "summary": "20210116 Re: [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2021/Jan/3"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7059"
    },
    {
      "cve": "CVE-2020-7070",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2020-4573f0e03a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/"
        },
        {
          "summary": "[debian-lts-announce] 20201006 [SECURITY] [DLA 2397-1] php7.0 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00008.html"
        },
        {
          "summary": "FEDORA-2020-4fe6b116e5",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/"
        },
        {
          "summary": "FEDORA-2020-94763cb98b",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/"
        },
        {
          "summary": "openSUSE-SU-2020:1703",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html"
        },
        {
          "summary": "USN-4583-1",
          "url": "https://usn.ubuntu.com/4583-1/"
        },
        {
          "summary": "openSUSE-SU-2020:1767",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html"
        },
        {
          "summary": "GLSA-202012-16",
          "url": "https://security.gentoo.org/glsa/202012-16"
        },
        {
          "summary": "DSA-4856",
          "url": "https://www.debian.org/security/2021/dsa-4856"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7070"
    },
    {
      "cve": "CVE-2022-32091",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        },
        {
          "summary": "FEDORA-2022-cf88f807f9",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHISY4YVO4S5QJYYIXCIAXBM7INOL4VY/"
        },
        {
          "summary": "FEDORA-2022-e0e9a43546",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/"
        },
        {
          "summary": "FEDORA-2022-333df1c4aa",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-32091"
    },
    {
      "cve": "CVE-2015-2348",
      "cwe": {
        "id": "CWE-626",
        "name": "Null Byte Interaction Error (Poison Null Byte)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \\x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "HPSBMU03409",
          "url": "http://marc.info/?l=bugtraq\u0026m=144050155601375\u0026w=2"
        },
        {
          "summary": "APPLE-SA-2015-09-30-3",
          "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
        },
        {
          "summary": "HPSBMU03380",
          "url": "http://marc.info/?l=bugtraq\u0026m=143748090628601\u0026w=2"
        },
        {
          "summary": "SUSE-SU-2015:0868",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html"
        },
        {
          "summary": "1032484",
          "url": "http://www.securitytracker.com/id/1032484"
        },
        {
          "summary": "73434",
          "url": "http://www.securityfocus.com/bid/73434"
        },
        {
          "summary": "USN-2572-1",
          "url": "http://www.ubuntu.com/usn/USN-2572-1"
        },
        {
          "summary": "RHSA-2015:1135",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html"
        },
        {
          "summary": "RHSA-2015:1053",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
        },
        {
          "summary": "openSUSE-SU-2015:0684",
          "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00015.html"
        },
        {
          "summary": "GLSA-201606-10",
          "url": "https://security.gentoo.org/glsa/201606-10"
        },
        {
          "summary": "RHSA-2015:1066",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2015-2348"
    },
    {
      "cve": "CVE-2019-9020",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-3902-2",
          "url": "https://usn.ubuntu.com/3902-2/"
        },
        {
          "summary": "DSA-4398",
          "url": "https://www.debian.org/security/2019/dsa-4398"
        },
        {
          "summary": "USN-3902-1",
          "url": "https://usn.ubuntu.com/3902-1/"
        },
        {
          "summary": "107156",
          "url": "http://www.securityfocus.com/bid/107156"
        },
        {
          "summary": "openSUSE-SU-2019:1256",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html"
        },
        {
          "summary": "openSUSE-SU-2019:1293",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9020"
    },
    {
      "cve": "CVE-2021-35604",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-70dd0b9f5d",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5MLAXYFLUDC636S46X34USCLDZAOFBM2/"
        },
        {
          "summary": "FEDORA-2021-46dc82116b",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XF3ZFPL3JJ26YRUGXLXQZYJBLZV3WC2C/"
        },
        {
          "summary": "FEDORA-2021-f74148c6d4",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRCU3RTIPVKPC3GMC76YW7DJEXUEY6FG/"
        },
        {
          "summary": "FEDORA-2021-acef1dc8cf",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
        },
        {
          "summary": "FEDORA-2021-72d5918529",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-35604"
    },
    {
      "cve": "CVE-2022-27444",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27444"
    },
    {
      "cve": "CVE-2018-14883",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "104871",
          "url": "http://www.securityfocus.com/bid/104871"
        },
        {
          "summary": "USN-3766-1",
          "url": "https://usn.ubuntu.com/3766-1/"
        },
        {
          "summary": "DSA-4353",
          "url": "https://www.debian.org/security/2018/dsa-4353"
        },
        {
          "summary": "[debian-lts-announce] 20180901 [SECURITY] [DLA 1490-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00000.html"
        },
        {
          "summary": "USN-3766-2",
          "url": "https://usn.ubuntu.com/3766-2/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2018-14883"
    },
    {
      "cve": "CVE-2014-9705",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-3195",
          "url": "http://www.debian.org/security/2015/dsa-3195"
        },
        {
          "summary": "USN-2535-1",
          "url": "http://www.ubuntu.com/usn/USN-2535-1"
        },
        {
          "summary": "HPSBMU03409",
          "url": "http://marc.info/?l=bugtraq\u0026m=144050155601375\u0026w=2"
        },
        {
          "summary": "openSUSE-SU-2015:0644",
          "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html"
        },
        {
          "summary": "APPLE-SA-2015-09-30-3",
          "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
        },
        {
          "summary": "HPSBMU03380",
          "url": "http://marc.info/?l=bugtraq\u0026m=143748090628601\u0026w=2"
        },
        {
          "summary": "MDVSA-2015:079",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:079"
        },
        {
          "summary": "SUSE-SU-2015:0868",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html"
        },
        {
          "summary": "RHSA-2015:1135",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html"
        },
        {
          "summary": "RHSA-2015:1053",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
        },
        {
          "summary": "[oss-security] 20150315 Re: CVE Request: PHP 5.6.6 changelog",
          "url": "http://openwall.com/lists/oss-security/2015/03/15/6"
        },
        {
          "summary": "73031",
          "url": "http://www.securityfocus.com/bid/73031"
        },
        {
          "summary": "1031948",
          "url": "http://www.securitytracker.com/id/1031948"
        },
        {
          "summary": "GLSA-201606-10",
          "url": "https://security.gentoo.org/glsa/201606-10"
        },
        {
          "summary": "RHSA-2015:1066",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
        },
        {
          "summary": "RHSA-2015:1218",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1218.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.8,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.8,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2014-9705"
    },
    {
      "cve": "CVE-2020-7064",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20200426 [SECURITY] [DLA 2188-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00021.html"
        },
        {
          "summary": "USN-4330-1",
          "url": "https://usn.ubuntu.com/4330-1/"
        },
        {
          "summary": "USN-4330-2",
          "url": "https://usn.ubuntu.com/4330-2/"
        },
        {
          "summary": "openSUSE-SU-2020:0642",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.html"
        },
        {
          "summary": "DSA-4717",
          "url": "https://www.debian.org/security/2020/dsa-4717"
        },
        {
          "summary": "DSA-4719",
          "url": "https://www.debian.org/security/2020/dsa-4719"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7064"
    },
    {
      "cve": "CVE-2022-27382",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27382"
    },
    {
      "cve": "CVE-2020-7063",
      "cwe": {
        "id": "CWE-281",
        "name": "Improper Preservation of Permissions"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "openSUSE-SU-2020:0341",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html"
        },
        {
          "summary": "GLSA-202003-57",
          "url": "https://security.gentoo.org/glsa/202003-57"
        },
        {
          "summary": "[debian-lts-announce] 20200326 [SECURITY] [DLA 2160-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00034.html"
        },
        {
          "summary": "USN-4330-1",
          "url": "https://usn.ubuntu.com/4330-1/"
        },
        {
          "summary": "DSA-4717",
          "url": "https://www.debian.org/security/2020/dsa-4717"
        },
        {
          "summary": "DSA-4719",
          "url": "https://www.debian.org/security/2020/dsa-4719"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7063"
    },
    {
      "cve": "CVE-2021-2372",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-dc4299a8d0",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6OO2Q5PIFURXLLKCIJE6XF6VL4LLMNO5/"
        },
        {
          "summary": "FEDORA-2021-df40c41094",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPJAGVMRKODR4QIXQSVEM4BLRZUM7P3R/"
        },
        {
          "summary": "FEDORA-2021-acef1dc8cf",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
        },
        {
          "summary": "FEDORA-2021-72d5918529",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2372"
    },
    {
      "cve": "CVE-2019-9021",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-3902-2",
          "url": "https://usn.ubuntu.com/3902-2/"
        },
        {
          "summary": "DSA-4398",
          "url": "https://www.debian.org/security/2019/dsa-4398"
        },
        {
          "summary": "USN-3902-1",
          "url": "https://usn.ubuntu.com/3902-1/"
        },
        {
          "summary": "107156",
          "url": "http://www.securityfocus.com/bid/107156"
        },
        {
          "summary": "106747",
          "url": "http://www.securityfocus.com/bid/106747"
        },
        {
          "summary": "openSUSE-SU-2019:1256",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html"
        },
        {
          "summary": "openSUSE-SU-2019:1293",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9021"
    },
    {
      "cve": "CVE-2018-14851",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "104871",
          "url": "http://www.securityfocus.com/bid/104871"
        },
        {
          "summary": "USN-3766-1",
          "url": "https://usn.ubuntu.com/3766-1/"
        },
        {
          "summary": "DSA-4353",
          "url": "https://www.debian.org/security/2018/dsa-4353"
        },
        {
          "summary": "[debian-lts-announce] 20180901 [SECURITY] [DLA 1490-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00000.html"
        },
        {
          "summary": "USN-3766-2",
          "url": "https://usn.ubuntu.com/3766-2/"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2018-14851"
    },
    {
      "cve": "CVE-2022-27448",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "There is an Assertion failure in MariaDB Server v10.9 and below via \u0027node-\u003epcur-\u003erel_pos == BTR_PCUR_ON\u0027 at /row/row0mysql.cc.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27448"
    },
    {
      "cve": "CVE-2021-46663",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-263f7cc483",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
        },
        {
          "summary": "FEDORA-2022-03350936ee",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
        },
        {
          "summary": "FEDORA-2022-5cfe372ab7",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-46663"
    },
    {
      "cve": "CVE-2021-2180",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-01189f6361",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKV7TRUEQW6EV45RSZVVFLVQMNHVHBCJ/"
        },
        {
          "summary": "FEDORA-2021-5b6c69a73a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJVUTKKFQAWR7NURCQHQQ5JHTVYGEOYQ/"
        },
        {
          "summary": "FEDORA-2021-b8b7829a83",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJQRPXNDH6YHQLUSCS5VA7DAW32PN7N7/"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        },
        {
          "summary": "GLSA-202105-28",
          "url": "https://security.gentoo.org/glsa/202105-28"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2180"
    },
    {
      "cve": "CVE-2014-9709",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "MDVSA-2015:153",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:153"
        },
        {
          "summary": "1033703",
          "url": "http://www.securitytracker.com/id/1033703"
        },
        {
          "summary": "openSUSE-SU-2015:0644",
          "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html"
        },
        {
          "summary": "APPLE-SA-2015-09-30-3",
          "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html"
        },
        {
          "summary": "SSRT102066",
          "url": "http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2"
        },
        {
          "summary": "DSA-3215",
          "url": "http://www.debian.org/security/2015/dsa-3215"
        },
        {
          "summary": "SUSE-SU-2015:0868",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html"
        },
        {
          "summary": "GLSA-201607-04",
          "url": "https://security.gentoo.org/glsa/201607-04"
        },
        {
          "summary": "USN-2987-1",
          "url": "http://www.ubuntu.com/usn/USN-2987-1"
        },
        {
          "summary": "73306",
          "url": "http://www.securityfocus.com/bid/73306"
        },
        {
          "summary": "RHSA-2015:1135",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html"
        },
        {
          "summary": "RHSA-2015:1053",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"
        },
        {
          "summary": "HPSBUX03337",
          "url": "http://marc.info/?l=bugtraq\u0026m=143403519711434\u0026w=2"
        },
        {
          "summary": "GLSA-201606-10",
          "url": "https://security.gentoo.org/glsa/201606-10"
        },
        {
          "summary": "RHSA-2015:1066",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"
        },
        {
          "summary": "RHSA-2015:1218",
          "url": "http://rhn.redhat.com/errata/RHSA-2015-1218.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 9.1,
            "environmentalSeverity": "CRITICAL",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.1,
            "temporalSeverity": "CRITICAL",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2014-9709"
    },
    {
      "cve": "CVE-2023-25690",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule\n or ProxyPassMatch in which a non-specific pattern matches\n some portion of the user-supplied request-target (URL) data and is then\n re-inserted into the proxied request-target using variable \nsubstitution. For example, something like: RewriteEngine on\nRewriteRule \"^/here/(.*)\" \"http://example.com:8080/elsewhere?$1\"; [P]\nProxyPassReverse /here/ http://example.com:8080/Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2023-25690"
    },
    {
      "cve": "CVE-2022-32082",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table-\u003eget_ref_count() == 0 in dict0dict.cc.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-cf88f807f9",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHISY4YVO4S5QJYYIXCIAXBM7INOL4VY/"
        },
        {
          "summary": "FEDORA-2022-e0e9a43546",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/"
        },
        {
          "summary": "FEDORA-2022-333df1c4aa",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-32082"
    },
    {
      "cve": "CVE-2022-31629",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim\u0027s browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-0b77fbd9e7",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/"
        },
        {
          "summary": "FEDORA-2022-afdea1c747",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/"
        },
        {
          "summary": "FEDORA-2022-f204e1d0ed",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/"
        },
        {
          "summary": "DSA-5277",
          "url": "https://www.debian.org/security/2022/dsa-5277"
        },
        {
          "summary": "GLSA-202211-03",
          "url": "https://security.gentoo.org/glsa/202211-03"
        },
        {
          "summary": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-31629"
    },
    {
      "cve": "CVE-2019-9022",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4398",
          "url": "https://www.debian.org/security/2019/dsa-4398"
        },
        {
          "summary": "USN-3902-1",
          "url": "https://usn.ubuntu.com/3902-1/"
        },
        {
          "summary": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1741-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html"
        },
        {
          "summary": "USN-3922-2",
          "url": "https://usn.ubuntu.com/3922-2/"
        },
        {
          "summary": "USN-3922-3",
          "url": "https://usn.ubuntu.com/3922-3/"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9022"
    },
    {
      "cve": "CVE-2016-3078",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[oss-security] 20160428 CVE-2016-3078: php: integer overflow in ZipArchive::getFrom*",
          "url": "http://www.openwall.com/lists/oss-security/2016/04/28/1"
        },
        {
          "summary": "39742",
          "url": "https://www.exploit-db.com/exploits/39742/"
        },
        {
          "summary": "1035701",
          "url": "http://www.securitytracker.com/id/1035701"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2016-3078"
    },
    {
      "cve": "CVE-2023-0662",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2023-0662"
    },
    {
      "cve": "CVE-2021-2022",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-db50ab62d3",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/"
        },
        {
          "summary": "FEDORA-2021-b1d1655cef",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2022"
    },
    {
      "cve": "CVE-2022-32089",
      "cwe": {
        "id": "CWE-229",
        "name": "Improper Handling of Values"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-cf88f807f9",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHISY4YVO4S5QJYYIXCIAXBM7INOL4VY/"
        },
        {
          "summary": "FEDORA-2022-e0e9a43546",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/"
        },
        {
          "summary": "FEDORA-2022-333df1c4aa",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-32089"
    },
    {
      "cve": "CVE-2019-11048",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2020-8838d072d5",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBA3TFZSP3TB5N4G24SO6BI64RJZXE3D/"
        },
        {
          "summary": "FEDORA-2020-9fa7f4e25c",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMDUQ7XFONY3BWTAQQUD3QUGZT6NFZUF/"
        },
        {
          "summary": "USN-4375-1",
          "url": "https://usn.ubuntu.com/4375-1/"
        },
        {
          "summary": "openSUSE-SU-2020:0847",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00045.html"
        },
        {
          "summary": "[debian-lts-announce] 20200629 [SECURITY] [DLA 2261-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00033.html"
        },
        {
          "summary": "DSA-4717",
          "url": "https://www.debian.org/security/2020/dsa-4717"
        },
        {
          "summary": "DSA-4719",
          "url": "https://www.debian.org/security/2020/dsa-4719"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11048"
    },
    {
      "cve": "CVE-2021-46669",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-25dcba7104",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRJCSPQHYPKTWXXZVDMY6JAHZJQ4TZ5X/"
        },
        {
          "summary": "FEDORA-2022-e6dc7ed871",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KHEOTQ63YWC3PGHGDFGS7AZIEXCGOPWH/"
        },
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-46669"
    },
    {
      "cve": "CVE-2019-11047",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20191229 [SECURITY] [DLA 2050-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html"
        },
        {
          "summary": "FEDORA-2019-437d94e271",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/"
        },
        {
          "summary": "FEDORA-2019-a54a622670",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/"
        },
        {
          "summary": "USN-4239-1",
          "url": "https://usn.ubuntu.com/4239-1/"
        },
        {
          "summary": "openSUSE-SU-2020:0080",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html"
        },
        {
          "summary": "20200218 [SECURITY] [DSA 4626-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/27"
        },
        {
          "summary": "DSA-4626",
          "url": "https://www.debian.org/security/2020/dsa-4626"
        },
        {
          "summary": "DSA-4628",
          "url": "https://www.debian.org/security/2020/dsa-4628"
        },
        {
          "summary": "20200219 [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/31"
        },
        {
          "summary": "20210116 Re: [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2021/Jan/3"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11047"
    },
    {
      "cve": "CVE-2022-27383",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27383"
    },
    {
      "cve": "CVE-2021-46667",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-263f7cc483",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
        },
        {
          "summary": "FEDORA-2022-03350936ee",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
        },
        {
          "summary": "FEDORA-2022-5cfe372ab7",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-46667"
    },
    {
      "cve": "CVE-2022-32087",
      "cwe": {
        "id": "CWE-229",
        "name": "Improper Handling of Values"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-32087"
    },
    {
      "cve": "CVE-2022-36760",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request Smuggling\u0027) vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to.  This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-36760"
    },
    {
      "cve": "CVE-2020-7060",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "20200218 [SECURITY] [DSA 4626-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/27"
        },
        {
          "summary": "DSA-4626",
          "url": "https://www.debian.org/security/2020/dsa-4626"
        },
        {
          "summary": "USN-4279-1",
          "url": "https://usn.ubuntu.com/4279-1/"
        },
        {
          "summary": "DSA-4628",
          "url": "https://www.debian.org/security/2020/dsa-4628"
        },
        {
          "summary": "20200219 [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/31"
        },
        {
          "summary": "[debian-lts-announce] 20200228 [SECURITY] [DLA 2124-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00030.html"
        },
        {
          "summary": "openSUSE-SU-2020:0341",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html"
        },
        {
          "summary": "GLSA-202003-57",
          "url": "https://security.gentoo.org/glsa/202003-57"
        },
        {
          "summary": "20210116 Re: [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2021/Jan/3"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7060"
    },
    {
      "cve": "CVE-2018-17082",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a \"Transfer-Encoding: chunked\" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4353",
          "url": "https://www.debian.org/security/2018/dsa-4353"
        },
        {
          "summary": "[debian-lts-announce] 20180920 [SECURITY] [DLA 1509-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00020.html"
        },
        {
          "summary": "GLSA-201812-01",
          "url": "https://security.gentoo.org/glsa/201812-01"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2018-17082"
    },
    {
      "cve": "CVE-2019-9640",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4403",
          "url": "https://www.debian.org/security/2019/dsa-4403"
        },
        {
          "summary": "USN-3922-1",
          "url": "https://usn.ubuntu.com/3922-1/"
        },
        {
          "summary": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1741-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html"
        },
        {
          "summary": "USN-3922-2",
          "url": "https://usn.ubuntu.com/3922-2/"
        },
        {
          "summary": "USN-3922-3",
          "url": "https://usn.ubuntu.com/3922-3/"
        },
        {
          "summary": "openSUSE-SU-2019:1293",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html"
        },
        {
          "summary": "openSUSE-SU-2019:1503",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9640"
    },
    {
      "cve": "CVE-2021-46661",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-263f7cc483",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
        },
        {
          "summary": "FEDORA-2022-03350936ee",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
        },
        {
          "summary": "FEDORA-2022-5cfe372ab7",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-46661"
    },
    {
      "cve": "CVE-2019-11034",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-3953-1",
          "url": "https://usn.ubuntu.com/3953-1/"
        },
        {
          "summary": "USN-3953-2",
          "url": "https://usn.ubuntu.com/3953-2/"
        },
        {
          "summary": "[debian-lts-announce] 20190525 [SECURITY] [DLA 1803-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00035.html"
        },
        {
          "summary": "openSUSE-SU-2019:1501",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00010.html"
        },
        {
          "summary": "openSUSE-SU-2019:1503",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00012.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "DSA-4529",
          "url": "https://www.debian.org/security/2019/dsa-4529"
        },
        {
          "summary": "20190923 [SECURITY] [DSA 4529-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/38"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11034"
    },
    {
      "cve": "CVE-2022-27456",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27456"
    },
    {
      "cve": "CVE-2020-7061",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.3.x below 7.3.15 and 7.4.x below 7.4.3, while extracting PHAR files on Windows using phar extension, certain content inside PHAR file could lead to one-byte read past the allocated buffer. This could potentially lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "GLSA-202003-57",
          "url": "https://security.gentoo.org/glsa/202003-57"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7061"
    },
    {
      "cve": "CVE-2022-27455",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27455"
    },
    {
      "cve": "CVE-2021-2144",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2144"
    },
    {
      "cve": "CVE-2021-2154",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-68db93b130",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK/"
        },
        {
          "summary": "FEDORA-2021-27187ac9dd",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT/"
        },
        {
          "summary": "FEDORA-2021-179f2fbb88",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE/"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        },
        {
          "summary": "GLSA-202105-28",
          "url": "https://security.gentoo.org/glsa/202105-28"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2154"
    },
    {
      "cve": "CVE-2022-21595",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-21595"
    },
    {
      "cve": "CVE-2019-11040",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "openSUSE-SU-2019:1778",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00029.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "20190920 [SECURITY] [DSA 4527-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/35"
        },
        {
          "summary": "DSA-4527",
          "url": "https://www.debian.org/security/2019/dsa-4527"
        },
        {
          "summary": "DSA-4529",
          "url": "https://www.debian.org/security/2019/dsa-4529"
        },
        {
          "summary": "20190923 [SECURITY] [DSA 4529-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/38"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11040"
    },
    {
      "cve": "CVE-2021-2389",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-acef1dc8cf",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/"
        },
        {
          "summary": "FEDORA-2021-72d5918529",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2389"
    },
    {
      "cve": "CVE-2023-27522",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2023-27522"
    },
    {
      "cve": "CVE-2020-2812",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-4350-1",
          "url": "https://usn.ubuntu.com/4350-1/"
        },
        {
          "summary": "FEDORA-2020-20ac7c92a1",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSVLI36TYRTPQGCS24VZQUXCUFOUW4VQ/"
        },
        {
          "summary": "FEDORA-2020-136dc82437",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDGBQYS3A36S4CAZPV5YROHYXYZR6LAH/"
        },
        {
          "summary": "FEDORA-2020-261c9ddd7c",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77REFDB7DE4WNKQIRGZTF53RFBQOXQLC/"
        },
        {
          "summary": "FEDORA-2020-35f52d9370",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW2ED32VEUHXFN2J3YQE27JIBV4SC2PI/"
        },
        {
          "summary": "openSUSE-SU-2020:0870",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00054.html"
        },
        {
          "summary": "FEDORA-2020-ac2d47d89a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        },
        {
          "summary": "GLSA-202012-08",
          "url": "https://security.gentoo.org/glsa/202012-08"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-2812"
    },
    {
      "cve": "CVE-2021-46665",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-263f7cc483",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
        },
        {
          "summary": "FEDORA-2022-03350936ee",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
        },
        {
          "summary": "FEDORA-2022-5cfe372ab7",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-46665"
    },
    {
      "cve": "CVE-2022-32086",
      "cwe": {
        "id": "CWE-229",
        "name": "Improper Handling of Values"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-32086"
    },
    {
      "cve": "CVE-2022-32085",
      "cwe": {
        "id": "CWE-229",
        "name": "Improper Handling of Values"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-32085"
    },
    {
      "cve": "CVE-2021-21704",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "GLSA-202209-20",
          "url": "https://security.gentoo.org/glsa/202209-20"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-21704"
    },
    {
      "cve": "CVE-2020-7066",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20200426 [SECURITY] [DLA 2188-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00021.html"
        },
        {
          "summary": "USN-4330-2",
          "url": "https://usn.ubuntu.com/4330-2/"
        },
        {
          "summary": "openSUSE-SU-2020:0642",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.html"
        },
        {
          "summary": "DSA-4717",
          "url": "https://www.debian.org/security/2020/dsa-4717"
        },
        {
          "summary": "DSA-4719",
          "url": "https://www.debian.org/security/2020/dsa-4719"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-7066"
    },
    {
      "cve": "CVE-2022-31628",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress \"quines\" gzip files, resulting in an infinite loop.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-0b77fbd9e7",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/"
        },
        {
          "summary": "FEDORA-2022-afdea1c747",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/"
        },
        {
          "summary": "FEDORA-2022-f204e1d0ed",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/"
        },
        {
          "summary": "DSA-5277",
          "url": "https://www.debian.org/security/2022/dsa-5277"
        },
        {
          "summary": "GLSA-202211-03",
          "url": "https://security.gentoo.org/glsa/202211-03"
        },
        {
          "summary": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-31628"
    },
    {
      "cve": "CVE-2021-46662",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with a nested subquery.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-46662"
    },
    {
      "cve": "CVE-2016-5385",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application\u0027s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv(\u0027HTTP_PROXY\u0027) call or (2) a CGI configuration of PHP, aka an \"httpoxy\" issue.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2016-8eb11666aa",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7RMYXAVNYL2MOBJTFATE73TOVOEZYC5R/"
        },
        {
          "summary": "VU#797896",
          "url": "http://www.kb.cert.org/vuls/id/797896"
        },
        {
          "summary": "GLSA-201611-22",
          "url": "https://security.gentoo.org/glsa/201611-22"
        },
        {
          "summary": "openSUSE-SU-2016:1922",
          "url": "http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html"
        },
        {
          "summary": "RHSA-2016:1613",
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1613.html"
        },
        {
          "summary": "RHSA-2016:1611",
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1611.html"
        },
        {
          "summary": "RHSA-2016:1610",
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1610.html"
        },
        {
          "summary": "DSA-3631",
          "url": "http://www.debian.org/security/2016/dsa-3631"
        },
        {
          "summary": "91821",
          "url": "http://www.securityfocus.com/bid/91821"
        },
        {
          "summary": "FEDORA-2016-4e7db3d437",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZOIUYZDBWNDDHC6XTOLZYRMRXZWTJCP/"
        },
        {
          "summary": "RHSA-2016:1609",
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1609.html"
        },
        {
          "summary": "1036335",
          "url": "http://www.securitytracker.com/id/1036335"
        },
        {
          "summary": "RHSA-2016:1612",
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1612.html"
        },
        {
          "summary": "FEDORA-2016-9c8cf5912c",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXFEIMZPSVGZQQAYIQ7U7DFVX3IBSDLF/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2016-5385"
    },
    {
      "cve": "CVE-2022-37436",
      "cwe": {
        "id": "CWE-113",
        "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-37436"
    },
    {
      "cve": "CVE-2013-6501",
      "cwe": {
        "id": "CWE-74",
        "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_sdl function in ext/soap/php_sdl.c.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "SUSE-SU-2015:0436",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00003.html"
        },
        {
          "summary": "72530",
          "url": "http://www.securityfocus.com/bid/72530"
        },
        {
          "summary": "GLSA-201606-10",
          "url": "https://security.gentoo.org/glsa/201606-10"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2013-6501"
    },
    {
      "cve": "CVE-2021-21702",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4856",
          "url": "https://www.debian.org/security/2021/dsa-4856"
        },
        {
          "summary": "GLSA-202105-23",
          "url": "https://security.gentoo.org/glsa/202105-23"
        },
        {
          "summary": "[debian-lts-announce] 20210715 [SECURITY] [DLA 2708-1] php7.0 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2021/07/msg00008.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-21702"
    },
    {
      "cve": "CVE-2019-9024",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-3902-2",
          "url": "https://usn.ubuntu.com/3902-2/"
        },
        {
          "summary": "DSA-4398",
          "url": "https://www.debian.org/security/2019/dsa-4398"
        },
        {
          "summary": "USN-3902-1",
          "url": "https://usn.ubuntu.com/3902-1/"
        },
        {
          "summary": "107156",
          "url": "http://www.securityfocus.com/bid/107156"
        },
        {
          "summary": "openSUSE-SU-2019:1256",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html"
        },
        {
          "summary": "openSUSE-SU-2019:1293",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9024"
    },
    {
      "cve": "CVE-2019-9023",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-3902-2",
          "url": "https://usn.ubuntu.com/3902-2/"
        },
        {
          "summary": "DSA-4398",
          "url": "https://www.debian.org/security/2019/dsa-4398"
        },
        {
          "summary": "USN-3902-1",
          "url": "https://usn.ubuntu.com/3902-1/"
        },
        {
          "summary": "107156",
          "url": "http://www.securityfocus.com/bid/107156"
        },
        {
          "summary": "openSUSE-SU-2019:1256",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html"
        },
        {
          "summary": "openSUSE-SU-2019:1293",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        },
        {
          "summary": "RHSA-2019:2519",
          "url": "https://access.redhat.com/errata/RHSA-2019:2519"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9023"
    },
    {
      "cve": "CVE-2022-27449",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27449"
    },
    {
      "cve": "CVE-2021-46664",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-263f7cc483",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ4KDAGF3H4D4BDTHRAM6ZEAJJWWMRUO/"
        },
        {
          "summary": "FEDORA-2022-03350936ee",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKJRBYJAQCOPHSED43A3HUPNKQLDTFGD/"
        },
        {
          "summary": "FEDORA-2022-5cfe372ab7",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZFZVMJL5UDTOZMARLXQIMG3BTG6UNYW/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-46664"
    },
    {
      "cve": "CVE-2019-11050",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20191229 [SECURITY] [DLA 2050-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/12/msg00034.html"
        },
        {
          "summary": "FEDORA-2019-437d94e271",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN/"
        },
        {
          "summary": "FEDORA-2019-a54a622670",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWRQPYXVG43Q7DXMXH6UVWMKWGUW552F/"
        },
        {
          "summary": "USN-4239-1",
          "url": "https://usn.ubuntu.com/4239-1/"
        },
        {
          "summary": "openSUSE-SU-2020:0080",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html"
        },
        {
          "summary": "20200218 [SECURITY] [DSA 4626-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/27"
        },
        {
          "summary": "DSA-4626",
          "url": "https://www.debian.org/security/2020/dsa-4626"
        },
        {
          "summary": "DSA-4628",
          "url": "https://www.debian.org/security/2020/dsa-4628"
        },
        {
          "summary": "20200219 [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2020/Feb/31"
        },
        {
          "summary": "20210116 Re: [SECURITY] [DSA 4628-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2021/Jan/3"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11050"
    },
    {
      "cve": "CVE-2021-21708",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "GLSA-202209-20",
          "url": "https://security.gentoo.org/glsa/202209-20"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-21708"
    },
    {
      "cve": "CVE-2022-31625",
      "cwe": {
        "id": "CWE-590",
        "name": "Free of Memory not on the Heap"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-0a96e5b9b1",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZTZQKRGEYJT5UB4FGG3MOE72SQUHSL4/"
        },
        {
          "summary": "FEDORA-2022-f3fc52428e",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/"
        },
        {
          "summary": "DSA-5179",
          "url": "https://www.debian.org/security/2022/dsa-5179"
        },
        {
          "summary": "GLSA-202209-20",
          "url": "https://security.gentoo.org/glsa/202209-20"
        },
        {
          "summary": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-31625"
    },
    {
      "cve": "CVE-2022-32081",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2022-cf88f807f9",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHISY4YVO4S5QJYYIXCIAXBM7INOL4VY/"
        },
        {
          "summary": "FEDORA-2022-e0e9a43546",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCOEGSVMIEXDZHBOSV6WVF7FAVRBR2JE/"
        },
        {
          "summary": "FEDORA-2022-333df1c4aa",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTVAONAZXJFGHAJ4RP2OF3EAMQCOTDSQ/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-32081"
    },
    {
      "cve": "CVE-2022-27378",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27378"
    },
    {
      "cve": "CVE-2006-20001",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2006-20001"
    },
    {
      "cve": "CVE-2018-19935",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4353",
          "url": "https://www.debian.org/security/2018/dsa-4353"
        },
        {
          "summary": "106143",
          "url": "http://www.securityfocus.com/bid/106143"
        },
        {
          "summary": "[debian-lts-announce] 20181217 [SECURITY] [DLA 1608-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00006.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2018-19935"
    },
    {
      "cve": "CVE-2022-4900",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "RHBZ#2179880",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179880"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-4900"
    },
    {
      "cve": "CVE-2018-12882",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "104551",
          "url": "http://www.securityfocus.com/bid/104551"
        },
        {
          "summary": "USN-3702-2",
          "url": "https://usn.ubuntu.com/3702-2/"
        },
        {
          "summary": "USN-3702-1",
          "url": "https://usn.ubuntu.com/3702-1/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2018-12882"
    },
    {
      "cve": "CVE-2019-9641",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-4403",
          "url": "https://www.debian.org/security/2019/dsa-4403"
        },
        {
          "summary": "USN-3922-1",
          "url": "https://usn.ubuntu.com/3922-1/"
        },
        {
          "summary": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1741-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html"
        },
        {
          "summary": "USN-3922-2",
          "url": "https://usn.ubuntu.com/3922-2/"
        },
        {
          "summary": "openSUSE-SU-2019:1256",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html"
        },
        {
          "summary": "USN-3922-3",
          "url": "https://usn.ubuntu.com/3922-3/"
        },
        {
          "summary": "openSUSE-SU-2019:1293",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html"
        },
        {
          "summary": "openSUSE-SU-2019:1572",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html"
        },
        {
          "summary": "openSUSE-SU-2019:1573",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-9641"
    },
    {
      "cve": "CVE-2022-27380",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27380"
    },
    {
      "cve": "CVE-2022-27381",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20220916 [SECURITY] [DLA 3114-1] mariadb-10.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27381"
    },
    {
      "cve": "CVE-2021-21707",
      "cwe": {
        "id": "CWE-159",
        "name": "Improper Handling of Invalid Use of Special Elements"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "DSA-5082",
          "url": "https://www.debian.org/security/2022/dsa-5082"
        },
        {
          "summary": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-21707"
    },
    {
      "cve": "CVE-2022-27451",
      "cwe": {
        "id": "CWE-1173",
        "name": "Improper Use of Validation Framework"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2022-27451"
    },
    {
      "cve": "CVE-2020-2780",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.0 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "USN-4350-1",
          "url": "https://usn.ubuntu.com/4350-1/"
        },
        {
          "summary": "FEDORA-2020-20ac7c92a1",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSVLI36TYRTPQGCS24VZQUXCUFOUW4VQ/"
        },
        {
          "summary": "FEDORA-2020-136dc82437",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDGBQYS3A36S4CAZPV5YROHYXYZR6LAH/"
        },
        {
          "summary": "FEDORA-2020-261c9ddd7c",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/77REFDB7DE4WNKQIRGZTF53RFBQOXQLC/"
        },
        {
          "summary": "FEDORA-2020-ac2d47d89a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X4X2BMF3EILMTXGOZDTPYS3KT5VWLA2P/"
        },
        {
          "summary": "GLSA-202105-27",
          "url": "https://security.gentoo.org/glsa/202105-27"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2020-2780"
    },
    {
      "cve": "CVE-2019-11041",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "[debian-lts-announce] 20190812 [SECURITY] [DLA 1878-1] php5 security update",
          "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00010.html"
        },
        {
          "summary": "USN-4097-2",
          "url": "https://usn.ubuntu.com/4097-2/"
        },
        {
          "summary": "USN-4097-1",
          "url": "https://usn.ubuntu.com/4097-1/"
        },
        {
          "summary": "20190920 [SECURITY] [DSA 4527-1] php7.3 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/35"
        },
        {
          "summary": "DSA-4527",
          "url": "https://www.debian.org/security/2019/dsa-4527"
        },
        {
          "summary": "DSA-4529",
          "url": "https://www.debian.org/security/2019/dsa-4529"
        },
        {
          "summary": "20190923 [SECURITY] [DSA 4529-1] php7.0 security update",
          "url": "https://seclists.org/bugtraq/2019/Sep/38"
        },
        {
          "summary": "openSUSE-SU-2019:2271",
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00019.html"
        },
        {
          "summary": "20191008 APPLE-SA-2019-10-07-1 macOS Catalina 10.15",
          "url": "https://seclists.org/bugtraq/2019/Oct/9"
        },
        {
          "summary": "20191008 APPLE-SA-2019-10-07-1 macOS Catalina 10.15",
          "url": "http://seclists.org/fulldisclosure/2019/Oct/15"
        },
        {
          "summary": "20191031 APPLE-SA-2019-10-29-10 Additional information for APPLE-SA-2019-10-07-1 macOS Catalina 10.15",
          "url": "http://seclists.org/fulldisclosure/2019/Oct/55"
        },
        {
          "summary": "RHSA-2019:3299",
          "url": "https://access.redhat.com/errata/RHSA-2019:3299"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2019-11041"
    },
    {
      "cve": "CVE-2021-2174",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "MES"
        ]
      },
      "references": [
        {
          "summary": "FEDORA-2021-01189f6361",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKV7TRUEQW6EV45RSZVVFLVQMNHVHBCJ/"
        },
        {
          "summary": "FEDORA-2021-5b6c69a73a",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UJVUTKKFQAWR7NURCQHQQ5JHTVYGEOYQ/"
        },
        {
          "summary": "FEDORA-2021-b8b7829a83",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJQRPXNDH6YHQLUSCS5VA7DAW32PN7N7/"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-05-26T10:00:00.000Z",
          "details": "Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.",
          "product_ids": [
            "MES"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          }
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "MES"
          ]
        }
      ],
      "title": "CVE-2021-2174"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-2154"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-22T22:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
  "id": "GHSA-c827-7w49-pg8j",
  "modified": "2022-08-30T00:00:26Z",
  "published": "2022-05-24T17:48:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-2154"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202105-27"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202105-28"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20210513-0002"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2021-2154",
    "description": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
    "id": "GSD-2021-2154",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-2154.html",
      "https://ubuntu.com/security/CVE-2021-2154",
      "https://advisories.mageia.org/CVE-2021-2154.html",
      "https://security.archlinux.org/CVE-2021-2154",
      "https://access.redhat.com/errata/RHSA-2022:1007",
      "https://access.redhat.com/errata/RHSA-2022:1010",
      "https://access.redhat.com/errata/RHSA-2022:1556",
      "https://access.redhat.com/errata/RHSA-2022:1557",
      "https://linux.oracle.com/cve/CVE-2021-2154.html",
      "https://access.redhat.com/errata/RHSA-2022:4818"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-2154"
      ],
      "details": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
      "id": "GSD-2021-2154",
      "modified": "2023-12-13T01:23:15.068072Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert_us@oracle.com",
        "ID": "CVE-2021-2154",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "MySQL Server",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "5.7.33 and prior"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Oracle Corporation"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
          }
        ]
      },
      "impact": {
        "cvss": {
          "baseScore": "4.9",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server."
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.oracle.com/security-alerts/cpuapr2021.html",
            "refsource": "MISC",
            "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
          },
          {
            "name": "FEDORA-2021-68db93b130",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK/"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20210513-0002/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
          },
          {
            "name": "FEDORA-2021-27187ac9dd",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT/"
          },
          {
            "name": "FEDORA-2021-179f2fbb88",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE/"
          },
          {
            "name": "GLSA-202105-27",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/202105-27"
          },
          {
            "name": "GLSA-202105-28",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/202105-28"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5.7.33",
                "versionStartIncluding": "5.7.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "10.5.10",
                "versionStartIncluding": "10.5.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "10.2.38",
                "versionStartIncluding": "10.2.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "10.3.29",
                "versionStartIncluding": "10.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "10.4.19",
                "versionStartIncluding": "10.4.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-2154"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 5.7.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2021.html",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
            },
            {
              "name": "FEDORA-2021-68db93b130",
              "refsource": "FEDORA",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPA3CTGXPVWKHMCQDVURK4ETH7GE34KK/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210513-0002/",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
            },
            {
              "name": "FEDORA-2021-27187ac9dd",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GAU7KW36A6TQGKG3RUITYSVUFIHBY3OT/"
            },
            {
              "name": "FEDORA-2021-179f2fbb88",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PEF5CRATUGQZUSQU63MHQIDZPOLHW2VE/"
            },
            {
              "name": "GLSA-202105-27",
              "refsource": "GENTOO",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.gentoo.org/glsa/202105-27"
            },
            {
              "name": "GLSA-202105-28",
              "refsource": "GENTOO",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.gentoo.org/glsa/202105-28"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-08-29T21:00Z",
      "publishedDate": "2021-04-22T22:15Z"
    }
  }
}