CVE-2023-46098

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an overly permissive CORS policy. This could allow an attacker to trick a legitimate user to trigger unwanted behavior.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-942

Affected software

No affected versions have been published.

Timeline

Published: Nov 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-460994.8A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). There is a stored cross-site scripting vulnerability in the Ad CVE-2023-461005.5in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource.CVE-2023-461028.8The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to CVE-2023-461034.7Sequence of processor instructions leads to unexpected behavior in Intel(R) Core(TM) Ultra Processors may allow an authenticated user to pot CVE-2023-461046.5Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or CVE-2023-46116.3A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race bet CVE-2023-461155.5Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri cod CVE-2023-461168.8Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to versio CVE-2023-461178.8reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding o CVE-2023-461184.9RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for d CVE-2023-461197.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading CVE-2023-46129.8Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Auth