Known vulnerabilities in SIMATIC WinCC Runtime Professional

Vendor: Siemens
Software: SIMATIC WinCC Runtime Professional
Software CPE: cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*
Website: https://www.siemens.com/
Total vulnerabilities: 15
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting SIMATIC WinCC Runtime Professional SIMATIC WinCC Runtime Professional is affected by 15 known vulnerabilities: 4 medium, 11 low Critical High Medium Low

Vulnerabilities (15)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU97145 - Execution with Unnecessary Privileges
CVE-2024-35783		 CWE-250 Low
No
No
 - 11.09.2024 SB2024091119
#VU94199 - Exposure of sensitive information to an unauthorized actor
CVE-2024-30321		 CWE-200 Medium
No
No
 19 Update 2 12.07.2024 SB2024071240
#VU88481 - Memory corruption
CVE-2023-50821		 CWE-119 Low
No
No
 - 11.04.2024 SB2024041145
#VU86607 - NULL Pointer Dereference
CVE-2023-48364		 CWE-476 Low
No
No
 - 20.02.2024 SB2024022016
#VU86606 - NULL Pointer Dereference
CVE-2023-48363		 CWE-476 Low
No
No
 - 20.02.2024 SB2024022016
#VU75039 - Incorrect Permission Assignment for Critical Resource
CVE-2022-44725		 CWE-732 Low
No
No
 - 12.04.2023 SB2023041248
SB2023041249
SB2024041517
#VU63312 - Memory corruption
CVE-2021-40142		 CWE-119 Medium
No
No
 - 17.05.2022 SB2021082715
SB2022051720
#VU63303 - Missing initialization of resource
CVE-2022-24287		 CWE-909 Low
No
No
 - 17.05.2022 SB2022051718
#VU28936 - Unquoted Search Path or Element
CVE-2020-7580		 CWE-428 Low
No
No
 - 10.06.2020 SB2020061031
#VU19158 - Unrestricted Upload of File with Dangerous Type
CVE-2019-10935		 CWE-434 Medium
No
No
 - 12.07.2019 SB2019071205
#VU15888 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2018-13813		 CWE-601 Low
No
No
 15 Update 4 14.11.2018 SB2018111410
#VU15887 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2018-13812		 CWE-22 Medium
No
No
 15 Update 4 13.11.2018 SB2018111410
#VU15889 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2018-13814		 CWE-113 Low
No
No
 15 Update 4 13.11.2018 SB2018111410
#VU11448 - Improper input validation
CVE-2018-4832		 CWE-20 Low
No
No
 - 02.04.2018 SB2018040201
SB2019121918
#VU8071 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2017-12069		 CWE-611 Low
No
No
 - 01.09.2017 SB2017090106