Siemens SINEC INS 1.0 Service Pack 2 Update 2

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:*

part: a version: 1.0 update: sp2_update_2

VendorSiemens (4bd2a91b-02ad-5c3d-b25f-70697e0c9d7f)
ProductSinec Ins (a288376f-d511-5203-8f3d-8ad627dc8a24)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-46894 vulnerable 2026-06-08 06:48:10.793747 Details available
MEDIUM (6.3)
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate authorization of a user to query the "/api/sftp/users" endpoint. This could allow an authenticated remote attacker to gain knowledge about the list of configured users of the SFTP service and also modify that configuration.
Published: 2024-11-12T12:49:45.831Z
Updated: 2024-11-12T14:19:46.429Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-46892 vulnerable 2026-06-08 06:48:10.790950 Details available
MEDIUM (4.9)
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly invalidate sessions when the associated user is deleted or disabled or their permissions are modified. This could allow an authenticated attacker to continue performing malicious actions even after their user account has been disabled.
Published: 2024-11-12T12:49:44.470Z
Updated: 2024-11-12T14:21:32.457Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-46891 vulnerable 2026-06-08 06:48:10.790382 Details available
MEDIUM (5.3)
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly restrict the size of generated log files. This could allow an unauthenticated remote attacker to trigger a large amount of logged events to exhaust the system's resources and create a denial of service condition.
Published: 2024-11-12T12:49:43.155Z
Updated: 2024-11-12T14:25:48.481Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-46890 vulnerable 2026-06-08 06:48:10.786930 Details available
CRITICAL (9.1)
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate input sent to specific endpoints of its web API. This could allow an authenticated remote attacker with high privileges on the application to execute arbitrary code on the underlying OS.
Published: 2024-11-12T12:49:41.829Z
Updated: 2024-11-12T14:28:21.227Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-46889 vulnerable 2026-06-08 06:48:10.786304 Details available
MEDIUM (5.3)
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application uses hard-coded cryptographic key material to obfuscate configuration files. This could allow an attacker to learn that cryptographic key material through reverse engineering of the application binary and decrypt arbitrary backup files.
Published: 2024-11-12T12:49:40.474Z
Updated: 2024-11-12T14:30:25.375Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-46888 vulnerable 2026-06-08 06:48:10.785362 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-44487 vulnerable 2026-06-08 06:12:41.446931 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.