Cisco ClamAV HFS+ contains a buffer overflow vulnerability that can allow an unauthenticated remote attacker to execute arbitrary code.

Sources: CISA, CISCO

Delta Electronics DIAEnergie (Update B) contains cross-site scripting, SQL injection and authorization bypass vulnerabilities that can allow an attacker to inject arbitrary code to retrieve and modify database contents and execute system commands.

Sources: CISA, Delta Electronics

BD Alaris Infusion Central contains a credentials management errors vulnerability that can lead to gained access to the Alaris Infusion Central database, resulting in disclosure of resident personal data.

Sources: CISA, BD

Sub-IoT DASH 7 Alliance Protocol stack implementation contains an out-of-bounds write vulnerability that can allow an attacker to create an out-of-bounds write condition.

Sources: CISA, Sub-IoT

Siemens SCALANCE X200 IRT contains an improper input validation vulnerability that can allow remote attackers to cause a denial-of-service condition.

Sources: CISA, Siemens

Siemens SIMATIC industrial products contain a T=time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow a privileged user to potentially enable escalation of privilege via local access.

Sources: CISA, Siemens

Siemens JT Open, JT Utilities and Parasolid contain stack-based buffer overflow, improper restriction of operations within the bounds of a memory buffer and out-of-bounds read vulnerabilities that can allow a threat actor to open a JT file with any of the affected products, leading to arbitrary code execution.

Sources: CISA, Siemens

Siemens TIA Project-server contains an untrusted search path vulnerability that can allow an attacker to escalate privileges when tricking a legitimate user to start the service from an attacker-controlled path.

Sources: CISA, Siemens

Siemens SiPass integrated AC5102/ACC-G2 and ACC-AP contain an improper input validation vulnerability that could allow an authenticated user to escalate privileges by injecting arbitrary commands executed with root privileges.

Sources: CISA, Siemens CERT

Microsoft Office Publisher contains a bypass vulnerability that allows for a local, authenticated attack on a targeted system.

Sources: NIST, Microsoft