Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    6 vulnerabilities by datalogics

    CVE-2026-9613 (GCVE-0-2026-9613)

    Vulnerability from nvd – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
    VLAI
    Title
    Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
    Summary
    The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-19 13:17 UTC
    CWE
    Assigner
    References
    Impacted products
    Credits
    Benedictus Jovan (aillesiM)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9613",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:17:09.324009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T13:51:18.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Datalogics Ecommerce Delivery \u2013 Datalogics",
          "vendor": "datalogics",
          "versions": [
            {
              "lessThanOrEqual": "2.6.65",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Benedictus Jovan (aillesiM)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Datalogics Ecommerce Delivery \u2013 Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store\u0027s stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin\u0027s stored API token, and trigger shipping notification emails to customers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-19T08:27:23.913Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ed27b8-dbdc-4927-8019-52a622bfbff6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L679"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L691"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L809"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L198"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L244"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L5"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L76"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L646"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L679"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L691"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L809"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L198"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L244"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L5"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L76"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L646"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3552733%40datalogics\u0026new=3552733%40datalogics"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-18T19:54:22.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Datalogics Ecommerce Delivery \u003c= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-9613",
    "datePublished": "2026-09-19T08:27:23.913Z",
    "dateReserved": "2026-05-26T16:29:51.747Z",
    "dateUpdated": "2026-09-19T13:51:18.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-39583 (GCVE-0-2026-39583)

    Vulnerability from nvd – Published: 2026-06-15 20:18 – Updated: 2026-06-16 13:43
    VLAI
    Title
    WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability
    Summary
    Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-16 13:41 UTC
    CWE
    • CWE-266 - Incorrect Privilege Assignment
    Assigner
    References
    Impacted products
    Vendor Product Version
    Datalogics Datalogics Ecommerce Delivery Affected: n/a , ≤ 2.6.62 (custom)
    		Create a notification for this product.
    Credits
    Jarno Vos (jrn5151) | Patchstack Bug Bounty Program
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39583",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T13:41:18.938385Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T13:43:10.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "datalogics",
          "product": "Datalogics Ecommerce Delivery",
          "vendor": "Datalogics",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.6.63",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.6.62",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Jarno Vos (jrn5151) | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery \u003c= 2.6.62 versions."
            }
          ],
          "value": "Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery \u003c= 2.6.62 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266 Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-15T20:18:08.042Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/datalogics/vulnerability/wordpress-datalogics-ecommerce-delivery-plugin-2-6-62-privilege-escalation-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Datalogics Ecommerce Delivery Plugin to the latest available version (at least 2.6.63)."
            }
          ],
          "value": "Update the WordPress Datalogics Ecommerce Delivery Plugin to the latest available version (at least 2.6.63)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Datalogics Ecommerce Delivery plugin \u003c= 2.6.62 - Privilege Escalation vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-39583",
    "datePublished": "2026-06-15T20:18:08.042Z",
    "dateReserved": "2026-04-07T10:48:44.714Z",
    "dateUpdated": "2026-06-16T13:43:10.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-1709 (GCVE-0-2023-1709)

    Vulnerability from nvd – Published: 2023-06-07 20:36 – Updated: 2025-01-06 19:59
    VLAI
    Title
    Datalogics Library APDFL Stack-based Buffer Overflow
    Summary
    Datalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-01-06 19:59 UTC
    CWE
    • CWE-121 - Stack-based Buffer Overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    Siemens JT2Go Affected: 0 , < 14.2.0.2 (custom)
    		Create a notification for this product.
    Siemens Teamcenter Visualization Affected: 13.2 , < 13.2.0.13 (custom)
    Affected: 13.3 , < 13.3.0.9 (custom)
    Affected: 14.0 , < 14.0.0.5 (custom)
    Affected: 14.1 , < 14.1.0.7 (custom)
    Affected: 14.2 , < 14.2.0.2 (custom)
    		Create a notification for this product.
    Datalogics Library APDFL Affected: 0 , ≤ v18.0.4PlusP1e (custom)
    		Create a notification for this product.
    Credits
    Michael Heinzl reported this vulnerability to Siemens.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:25.034Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-11"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-629917.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-164-01"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1709",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-06T19:59:18.928582Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-06T19:59:28.270Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JT2Go",
          "vendor": "Siemens ",
          "versions": [
            {
              "lessThan": "14.2.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamcenter Visualization",
          "vendor": "Siemens ",
          "versions": [
            {
              "lessThan": "13.2.0.13",
              "status": "affected",
              "version": "13.2",
              "versionType": "custom"
            },
            {
              "lessThan": "13.3.0.9",
              "status": "affected",
              "version": "13.3",
              "versionType": "custom"
            },
            {
              "lessThan": "14.0.0.5",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.1.0.7",
              "status": "affected",
              "version": "14.1",
              "versionType": "custom"
            },
            {
              "lessThan": "14.2.0.2",
              "status": "affected",
              "version": "14.2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Library APDFL",
          "vendor": "Datalogics",
          "versions": [
            {
              "lessThanOrEqual": "v18.0.4PlusP1e",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Michael Heinzl reported this vulnerability to Siemens. "
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\nDatalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.\n\n \n\n"
            }
          ],
          "value": "\nDatalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.\n\n \n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-14T20:17:02.964Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-11"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-629917.html"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-164-01"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\u003cdiv\u003eSiemens has released updates for the affected products and recommends updating to the latest versions:\u003c/div\u003e\u003cul\u003e\u003cli\u003eJT2Go: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html\"\u003eUpdate to V14.2.0.2\u003c/a\u003e or later version\u003c/li\u003e\u003cli\u003eTeamcenter Visualization V13.2: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eUpdate to V13.2.0.13\u003c/a\u003e\u0026nbsp; or later version \u003c/li\u003e\u003cli\u003eTeamcenter Visualization V13.3: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eUpdate to V13.3.0.9\u003c/a\u003e\u0026nbsp; or later version \u003c/li\u003e\u003cli\u003eTeamcenter Visualization V14.0: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eUpdate to V14.0.0.5\u003c/a\u003e\u0026nbsp; or later version \u003c/li\u003e\u003cli\u003eTeamcenter Visualization V14.1: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eUpdate to V14.1.0.7\u003c/a\u003e\u0026nbsp; or later version \u003c/li\u003e\u003cli\u003eTeamcenter Visualization V14.2: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eUpdate to V14.2.0.2\u003c/a\u003e\u0026nbsp; or later version \n\n\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "Siemens has released updates for the affected products and recommends updating to the latest versions:\n\n  *  JT2Go:  Update to V14.2.0.2 https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html  or later version\n  *  Teamcenter Visualization V13.2:  Update to V13.2.0.13 https://support.sw.siemens.com/ \u00a0 or later version \n  *  Teamcenter Visualization V13.3:  Update to V13.3.0.9 https://support.sw.siemens.com/ \u00a0 or later version \n  *  Teamcenter Visualization V14.0:  Update to V14.0.0.5 https://support.sw.siemens.com/ \u00a0 or later version \n  *  Teamcenter Visualization V14.1:  Update to V14.1.0.7 https://support.sw.siemens.com/ \u00a0 or later version \n  *  Teamcenter Visualization V14.2:  Update to V14.2.0.2 https://support.sw.siemens.com/ \u00a0 or later version \n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Datalogics Library APDFL Stack-based Buffer Overflow",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\u003cp\u003eSiemens has identified the following specific workarounds and mitigations that users can apply to reduce risks: \u003c/p\u003e\n\u003cul\u003e\u003cli\u003eAvoid opening untrusted files in JT2Go and Teamcenter Visualization \u003c/li\u003e\n\u003c/ul\u003e\u003cp\u003eAs a general security measure, Siemens recommends protecting \nnetwork access to devices with appropriate mechanisms. To operate the \ndevices in a protected IT environment, Siemens recommends configuring \nthe environment according to Siemens\u0027 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.siemens.com/cert/operational-guidelines-industrial-security\"\u003eoperational guidelines for industrial security\u003c/a\u003e,\n and to follow the recommendations in the product manuals. Additional \ninformation on industrial security by Siemens can be found at the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.siemens.com/industrialsecurity\"\u003eSiemens Industrial Security web page\u003c/a\u003e. \n\u003c/p\u003e\u003cp\u003eFor further inquiries on security vulnerabilities in Siemens products and solutions, users should contact the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.siemens.com/cert/advisories\"\u003eSiemens ProductCERT\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Siemens has identified the following specific workarounds and mitigations that users can apply to reduce risks: \n\n\n  *  Avoid opening untrusted files in JT2Go and Teamcenter Visualization \n\n\n\nAs a general security measure, Siemens recommends protecting \nnetwork access to devices with appropriate mechanisms. To operate the \ndevices in a protected IT environment, Siemens recommends configuring \nthe environment according to Siemens\u0027  operational guidelines for industrial security https://www.siemens.com/cert/operational-guidelines-industrial-security ,\n and to follow the recommendations in the product manuals. Additional \ninformation on industrial security by Siemens can be found at the  Siemens Industrial Security web page https://www.siemens.com/industrialsecurity . \n\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, users should contact the  Siemens ProductCERT https://www.siemens.com/cert/advisories .\n\n"
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\u003cp\u003eDatalogics recommends users to update to APDFL v18.0.4PlusP1g. \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.datalogics.com/datalogics-contact-us\"\u003eContact Datalogics\u003c/a\u003e\u0026nbsp;for more information on obtaining this update.\u003c/p\u003e\u003cp\u003eFor more information, refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://dev.datalogics.com/adobe-pdf-library/release-notes-adobe-pdf-library-v-18/\"\u003eDatalogic\u2019s release notes\u003c/a\u003e.\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Datalogics recommends users to update to APDFL v18.0.4PlusP1g.  Contact Datalogics https://www.datalogics.com/datalogics-contact-us \u00a0for more information on obtaining this update.\n\nFor more information, refer to  Datalogic\u2019s release notes https://dev.datalogics.com/adobe-pdf-library/release-notes-adobe-pdf-library-v-18/ .\n\n\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2023-1709",
    "datePublished": "2023-06-07T20:36:05.055Z",
    "dateReserved": "2023-03-29T22:59:38.901Z",
    "dateUpdated": "2025-01-06T19:59:28.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2026-9613 (GCVE-0-2026-9613)

    Vulnerability from cvelistv5 – Published: 2026-09-19 08:27 – Updated: 2026-09-19 13:51
    VLAI
    Title
    Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)
    Summary
    The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-19 13:17 UTC
    CWE
    Assigner
    References
    Impacted products
    Credits
    Benedictus Jovan (aillesiM)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9613",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:17:09.324009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T13:51:18.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Datalogics Ecommerce Delivery \u2013 Datalogics",
          "vendor": "datalogics",
          "versions": [
            {
              "lessThanOrEqual": "2.6.65",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Benedictus Jovan (aillesiM)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Datalogics Ecommerce Delivery \u2013 Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store\u0027s stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin\u0027s stored API token, and trigger shipping notification emails to customers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-19T08:27:23.913Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c0ed27b8-dbdc-4927-8019-52a622bfbff6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L679"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L691"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L809"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L198"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L244"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L5"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L76"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.65/actions.php#L646"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L679"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L691"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L809"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L198"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L244"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L5"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L76"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/datalogics/tags/2.6.63/actions.php#L646"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3552733%40datalogics\u0026new=3552733%40datalogics"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-18T19:54:22.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Datalogics Ecommerce Delivery \u003c= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-9613",
    "datePublished": "2026-09-19T08:27:23.913Z",
    "dateReserved": "2026-05-26T16:29:51.747Z",
    "dateUpdated": "2026-09-19T13:51:18.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-39583 (GCVE-0-2026-39583)

    Vulnerability from cvelistv5 – Published: 2026-06-15 20:18 – Updated: 2026-06-16 13:43
    VLAI
    Title
    WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability
    Summary
    Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-16 13:41 UTC
    CWE
    • CWE-266 - Incorrect Privilege Assignment
    Assigner
    References
    Impacted products
    Vendor Product Version
    Datalogics Datalogics Ecommerce Delivery Affected: n/a , ≤ 2.6.62 (custom)
    		Create a notification for this product.
    Credits
    Jarno Vos (jrn5151) | Patchstack Bug Bounty Program
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39583",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T13:41:18.938385Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T13:43:10.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "datalogics",
          "product": "Datalogics Ecommerce Delivery",
          "vendor": "Datalogics",
          "versions": [
            {
              "changes": [
                {
                  "at": "2.6.63",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "2.6.62",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Jarno Vos (jrn5151) | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery \u003c= 2.6.62 versions."
            }
          ],
          "value": "Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery \u003c= 2.6.62 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266 Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-15T20:18:08.042Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/datalogics/vulnerability/wordpress-datalogics-ecommerce-delivery-plugin-2-6-62-privilege-escalation-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Datalogics Ecommerce Delivery Plugin to the latest available version (at least 2.6.63)."
            }
          ],
          "value": "Update the WordPress Datalogics Ecommerce Delivery Plugin to the latest available version (at least 2.6.63)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Datalogics Ecommerce Delivery plugin \u003c= 2.6.62 - Privilege Escalation vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-39583",
    "datePublished": "2026-06-15T20:18:08.042Z",
    "dateReserved": "2026-04-07T10:48:44.714Z",
    "dateUpdated": "2026-06-16T13:43:10.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2023-1709 (GCVE-0-2023-1709)

    Vulnerability from cvelistv5 – Published: 2023-06-07 20:36 – Updated: 2025-01-06 19:59
    VLAI
    Title
    Datalogics Library APDFL Stack-based Buffer Overflow
    Summary
    Datalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-01-06 19:59 UTC
    CWE
    • CWE-121 - Stack-based Buffer Overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    Siemens JT2Go Affected: 0 , < 14.2.0.2 (custom)
    		Create a notification for this product.
    Siemens Teamcenter Visualization Affected: 13.2 , < 13.2.0.13 (custom)
    Affected: 13.3 , < 13.3.0.9 (custom)
    Affected: 14.0 , < 14.0.0.5 (custom)
    Affected: 14.1 , < 14.1.0.7 (custom)
    Affected: 14.2 , < 14.2.0.2 (custom)
    		Create a notification for this product.
    Datalogics Library APDFL Affected: 0 , ≤ v18.0.4PlusP1e (custom)
    		Create a notification for this product.
    Credits
    Michael Heinzl reported this vulnerability to Siemens.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:25.034Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-11"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-629917.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-164-01"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1709",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-06T19:59:18.928582Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-06T19:59:28.270Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JT2Go",
          "vendor": "Siemens ",
          "versions": [
            {
              "lessThan": "14.2.0.2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Teamcenter Visualization",
          "vendor": "Siemens ",
          "versions": [
            {
              "lessThan": "13.2.0.13",
              "status": "affected",
              "version": "13.2",
              "versionType": "custom"
            },
            {
              "lessThan": "13.3.0.9",
              "status": "affected",
              "version": "13.3",
              "versionType": "custom"
            },
            {
              "lessThan": "14.0.0.5",
              "status": "affected",
              "version": "14.0",
              "versionType": "custom"
            },
            {
              "lessThan": "14.1.0.7",
              "status": "affected",
              "version": "14.1",
              "versionType": "custom"
            },
            {
              "lessThan": "14.2.0.2",
              "status": "affected",
              "version": "14.2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Library APDFL",
          "vendor": "Datalogics",
          "versions": [
            {
              "lessThanOrEqual": "v18.0.4PlusP1e",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Michael Heinzl reported this vulnerability to Siemens. "
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\nDatalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.\n\n \n\n"
            }
          ],
          "value": "\nDatalogics Library APDFLThe v18.0.4PlusP1e and prior contains a stack-based buffer overflow due to documents containing corrupted fonts, which could allow an attack that causes an unhandled crash during the rendering process.\n\n \n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-14T20:17:02.964Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-103-11"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-629917.html"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-164-01"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\u003cdiv\u003eSiemens has released updates for the affected products and recommends updating to the latest versions:\u003c/div\u003e\u003cul\u003e\u003cli\u003eJT2Go: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html\"\u003eUpdate to V14.2.0.2\u003c/a\u003e or later version\u003c/li\u003e\u003cli\u003eTeamcenter Visualization V13.2: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eUpdate to V13.2.0.13\u003c/a\u003e\u0026nbsp; or later version \u003c/li\u003e\u003cli\u003eTeamcenter Visualization V13.3: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eUpdate to V13.3.0.9\u003c/a\u003e\u0026nbsp; or later version \u003c/li\u003e\u003cli\u003eTeamcenter Visualization V14.0: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eUpdate to V14.0.0.5\u003c/a\u003e\u0026nbsp; or later version \u003c/li\u003e\u003cli\u003eTeamcenter Visualization V14.1: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eUpdate to V14.1.0.7\u003c/a\u003e\u0026nbsp; or later version \u003c/li\u003e\u003cli\u003eTeamcenter Visualization V14.2: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.sw.siemens.com/\"\u003eUpdate to V14.2.0.2\u003c/a\u003e\u0026nbsp; or later version \n\n\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "Siemens has released updates for the affected products and recommends updating to the latest versions:\n\n  *  JT2Go:  Update to V14.2.0.2 https://www.plm.automation.siemens.com/global/en/products/plm-components/jt2go.html  or later version\n  *  Teamcenter Visualization V13.2:  Update to V13.2.0.13 https://support.sw.siemens.com/ \u00a0 or later version \n  *  Teamcenter Visualization V13.3:  Update to V13.3.0.9 https://support.sw.siemens.com/ \u00a0 or later version \n  *  Teamcenter Visualization V14.0:  Update to V14.0.0.5 https://support.sw.siemens.com/ \u00a0 or later version \n  *  Teamcenter Visualization V14.1:  Update to V14.1.0.7 https://support.sw.siemens.com/ \u00a0 or later version \n  *  Teamcenter Visualization V14.2:  Update to V14.2.0.2 https://support.sw.siemens.com/ \u00a0 or later version \n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Datalogics Library APDFL Stack-based Buffer Overflow",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\u003cp\u003eSiemens has identified the following specific workarounds and mitigations that users can apply to reduce risks: \u003c/p\u003e\n\u003cul\u003e\u003cli\u003eAvoid opening untrusted files in JT2Go and Teamcenter Visualization \u003c/li\u003e\n\u003c/ul\u003e\u003cp\u003eAs a general security measure, Siemens recommends protecting \nnetwork access to devices with appropriate mechanisms. To operate the \ndevices in a protected IT environment, Siemens recommends configuring \nthe environment according to Siemens\u0027 \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.siemens.com/cert/operational-guidelines-industrial-security\"\u003eoperational guidelines for industrial security\u003c/a\u003e,\n and to follow the recommendations in the product manuals. Additional \ninformation on industrial security by Siemens can be found at the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.siemens.com/industrialsecurity\"\u003eSiemens Industrial Security web page\u003c/a\u003e. \n\u003c/p\u003e\u003cp\u003eFor further inquiries on security vulnerabilities in Siemens products and solutions, users should contact the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.siemens.com/cert/advisories\"\u003eSiemens ProductCERT\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Siemens has identified the following specific workarounds and mitigations that users can apply to reduce risks: \n\n\n  *  Avoid opening untrusted files in JT2Go and Teamcenter Visualization \n\n\n\nAs a general security measure, Siemens recommends protecting \nnetwork access to devices with appropriate mechanisms. To operate the \ndevices in a protected IT environment, Siemens recommends configuring \nthe environment according to Siemens\u0027  operational guidelines for industrial security https://www.siemens.com/cert/operational-guidelines-industrial-security ,\n and to follow the recommendations in the product manuals. Additional \ninformation on industrial security by Siemens can be found at the  Siemens Industrial Security web page https://www.siemens.com/industrialsecurity . \n\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, users should contact the  Siemens ProductCERT https://www.siemens.com/cert/advisories .\n\n"
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\u003cp\u003eDatalogics recommends users to update to APDFL v18.0.4PlusP1g. \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.datalogics.com/datalogics-contact-us\"\u003eContact Datalogics\u003c/a\u003e\u0026nbsp;for more information on obtaining this update.\u003c/p\u003e\u003cp\u003eFor more information, refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://dev.datalogics.com/adobe-pdf-library/release-notes-adobe-pdf-library-v-18/\"\u003eDatalogic\u2019s release notes\u003c/a\u003e.\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Datalogics recommends users to update to APDFL v18.0.4PlusP1g.  Contact Datalogics https://www.datalogics.com/datalogics-contact-us \u00a0for more information on obtaining this update.\n\nFor more information, refer to  Datalogic\u2019s release notes https://dev.datalogics.com/adobe-pdf-library/release-notes-adobe-pdf-library-v-18/ .\n\n\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2023-1709",
    "datePublished": "2023-06-07T20:36:05.055Z",
    "dateReserved": "2023-03-29T22:59:38.901Z",
    "dateUpdated": "2025-01-06T19:59:28.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}