Siemens RUGGEDCOM ROS
Improper neutralization of special characters on the web server configuration page could allow an attacker, in a privileged position, to retrieve sensitive information via cross-site scripting. A timing attack, in a third-party component, could make the retrieval of the private key possible, used for encryption of sensitive data. 

If a threat actor were to exploit this, the data integrity and security could be compromised. A new variant of the POODLE attack has left a third-party component vulnerable due to the implementation flaws of the CBC encryption mode in TLS 1.0 to 1.2.

If an attacker were to exploit this, they could act as a man-in-the-middle and eavesdrop on encrypted communications. Within a third-party component, whenever memory allocation is requested, the out of bound size is not checked.

Therefore, if size exceeding the expected allocation is assigned, it could allocate a smaller buffer instead. If an attacker were to exploit this, they could cause a heap overflow. Within a third-party component, the process to allocate partition size fails to check memory boundaries.

Therefore, if a large amount is requested by an attacker, due to an integer-wrap around, it could result in a small size being allocated instead. The third-party component, in its TFTP functionality fails to check for null terminations in file names.

If an attacker were to exploit this, it could result in data corruption, and possibly a hard-fault of the application.