A CVSS v3 base score of 7.5 has been calculated the CVSS vector string is (()).\n\n# 4.3 BACKGROUND\n\n * **CRITICAL INFRASTRUCTURE SECTORS: **Multiple\n * **COUNTRIES/AREAS DEPLOYED: **Worldwide\n * **COMPANY HEADQUARTERS LOCATION: **Germany\n\n# 4.4 RESEARCHER\n\nSharon Brizinov and Tal Keren of Claroty reported these vulnerabilities to CISA.\n\n# 5\\. A CVSS v3 base score of 7.4 has been calculated the CVSS vector string is (()).\n\n# 4.2.6 ()\n\nAn attacker could send a specially crafted packet that could have the server send back packets containing data from the heap.\n\n() has been assigned to this vulnerability. Only CmActLicense update files with CmActLicense Firm Code are affected.\n\n() has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated the CVSS vector string is (()).\n\n# 4.2.5 ()\n\nThere is an issue in the license-file signature checking mechanism, which allows attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file of an existing vendor. A CVSS v3 base score of 8.1 has been calculated the CVSS vector string is (()).\n\n# 4.2.4 ()\n\nCodeMeter and the software using it may crash while processing a specifically crafted license file due to unverified length fields.\n\n() has been assigned to this vulnerability. A CVSS v3 base score of 9.4 has been calculated the CVSS vector string is (()).\n\n# 4.2.3 ()\n\nThis vulnerability allows an attacker to use the internal WebSockets API via a specifically crafted Java Script payload, which may allow alteration or creation of license files when combined with CVE-2020-14515.\n\n() has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated the CVSS vector string is (()).\n\n# 4.2.2 ()\n\nProtocol encryption can be easily broken and the server accepts external connections, which may allow an attacker to remotely communicate with the CodeMeter API.\n\n() has been assigned to this vulnerability. An attacker could send specially crafted packets to exploit these vulnerabilities.\n\n() has been assigned to this vulnerability. , "published": "T00:00:00", "type": "nessus", "title": "CodeMeter )\n\nMultiple memory corruption vulnerabilities exist where the packet parser mechanism does not verify length fields.
0 kommentar(er)
