Page 3 of 31 results (0.002 seconds)

CVSS: 7.5EPSS: 1%CPEs: 11EXPL: 0

CVE-2012-3030

https://notcve.org/view.php?id=CVE-2012-3030

18 Sep 2012 — WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, stores sensitive information under the web root with insufficient access control, which allows remote attackers to read a (1) log file or (2) configuration file via a direct request. WebNavigator en Siemens WinCC v7.0 SP3 y anteriores, como las usadas en SIMATIC PCS7 y otros productos, almacena información sensible bajo l directorio web raiz con un control de acceso no suficiente, lo que permite a atacantes remoto... • http://en.securitylab.ru/lab/PT-2012-43 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.1EPSS: 1%CPEs: 11EXPL: 0

CVE-2012-3031

https://notcve.org/view.php?id=CVE-2012-3031

18 Sep 2012 — Multiple cross-site scripting (XSS) vulnerabilities in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allow remote attackers to inject arbitrary web script or HTML via a (1) GET parameter, (2) POST parameter, or (3) Referer HTTP header. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Web Navigator en Siemens WinCC v7.0 SP3 y versiones anteriores, tal y como se usan en SIMATIC PCS v7 y otros productos, permiten a atacantes remoto... • http://en.securitylab.ru/lab/PT-2012-42 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 1%CPEs: 11EXPL: 0

CVE-2012-3032

https://notcve.org/view.php?id=CVE-2012-3032

18 Sep 2012 — SQL injection vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to execute arbitrary SQL commands via a crafted SOAP message. Vulnerabilidad de inyección SQL en Siemens WinCC v7.0 SP3 y anteriores, como se usa en SIMATIC PCS7 y otros productos, permite a atacantes remotos ejecutar comandos SQL de su elección a través de un mensaje SOAP modificado. • http://en.securitylab.ru/lab/PT-2012-44 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 9.1EPSS: 1%CPEs: 11EXPL: 0

CVE-2012-3034

https://notcve.org/view.php?id=CVE-2012-3034

18 Sep 2012 — WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a username and password via crafted parameters to unspecified methods in ActiveX controls. WebNavigator en Siemens WinCC v7.0 SP3 y anteriores, como se usa en SIMATIC PCS7 y otros productos, permite a atacantes remotos descubrir un nombre de usuario y contraseña a través de parámetros modificados en métodos no especificados de controles ActiveX • http://en.securitylab.ru/lab/PT-2012-45 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.8EPSS: 0%CPEs: 16EXPL: 0

CVE-2011-4508

https://notcve.org/view.php?id=CVE-2011-4508

03 Feb 2012 — The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime generates predictable authentication tokens for cookies, which makes it easier for remote attackers to bypass authentication via a crafted cookie. El servidor web HMI de Siemens WinCC flexible v2004, v2005, v2007 y v2008 antes de SP3, WinCC V11 (también c... • http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdf • CWE-287: Improper Authentication •

CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0

CVE-2011-4510

https://notcve.org/view.php?id=CVE-2011-4510

03 Feb 2012 — Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4511. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en el se... • http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0

CVE-2011-4511

https://notcve.org/view.php?id=CVE-2011-4511

03 Feb 2012 — Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4510. Existe una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) e... • http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.8EPSS: 0%CPEs: 16EXPL: 0

CVE-2011-4512

https://notcve.org/view.php?id=CVE-2011-4512

03 Feb 2012 — CRLF injection vulnerability in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Vulnerabilidad de inyección CRLF en el servidor web HMI de Siemens WinCC flexible 2004, 2005, 200... • http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-345442.pdf • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 9.1EPSS: 39%CPEs: 16EXPL: 2

CVE-2011-4879 – Siemens SIMATIC WinCC Flexible (Runtime) - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2011-4879

03 Feb 2012 — miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime does not properly handle URIs beginning with a 0xfa character, which allows remote attackers to read data from arbitrary memory locations or cause a denial of service (application crash) via a crafted POST request. miniweb.exe del servidor ... • https://www.exploit-db.com/exploits/18166 • CWE-20: Improper Input Validation •

CVSS: 7.8EPSS: 33%CPEs: 16EXPL: 2

CVE-2011-4878 – Siemens SIMATIC WinCC Flexible (Runtime) - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2011-4878

03 Feb 2012 — Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to read arbitrary files via a ..%5c (dot dot backslash) in a URI. Vulnerabilidad de salto de directorio en miniweb.exe de servidor web HMI de Siemens WinCC flexible 2004, 2005, 20... • https://www.exploit-db.com/exploits/18166 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •