CVE-2019-13947

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The user configuration menu in the web interface of the Control Center Server CCS transfers user passwords in clear to the client browser. An attacker with administrative privileges for the web interface could b...

CVE-2019-19293

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The web interface of the Control Center Server CCS contains a reflected Cross-site Scripting XSS vulnerability that could allow an unauthenticated remote attacker to steal sensitive data or execute administrativ...

CVE-2019-19290

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The DOWNLOADS section in the web interface of the Control Center Server CCS contains a path traversal vulnerability that could allow an authenticated remote attacker to access and download arbitrary files from t...

CVE-2019-19292

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS contains an SQL injection vulnerability in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. An authenticated remote attacker could exploit...

Siemens and PKE Control Center Server

1. EXECUTIVE SUMMARY CVSS v3 9.9 ATTENTION: Exploitable remotely/low attack complexity Vendors: Siemens/PKE Equipment: Control Center Server CCS Vulnerabilities: Cleartext Storage of Sensitive Information in GUI, Improper Authentication, Relative Path Traversal, Use of a Broken or Risky...

CVE-2019-19291

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0, SiNVR/SiVMS Video Server All versions V5.0.0. The FTP services of the SiVMS/SiNVR Video Server and the Control Center Server CCS maintain log files that store login credentials in cleartext. In configurations...

CVE-2019-19290

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The DOWNLOADS section in the web interface of the Control Center Server CCS contains a path traversal vulnerability that could allow an authenticated remote attacker to access and download arbitrary files from t...

CVE-2019-19293

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The web interface of the Control Center Server CCS contains a reflected Cross-site Scripting XSS vulnerability that could allow an unauthenticated remote attacker to steal sensitive data or execute administrativ...

CVE-2019-19295

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS does not enforce logging of security-relevant activities in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. An authenticated remote...

CVE-2019-19294

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The web interface of the Control Center Server CCS contains multiple stored Cross-site Scripting XSS vulnerabilities in several input fields. This could allow an authenticated remote attacker to inject malicious...

CVE-2019-19292

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS contains an SQL injection vulnerability in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. An authenticated remote attacker could exploit...

Sql injection

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS contains an SQL injection vulnerability in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. An authenticated remote attacker could exploit...

Design/Logic Flaw

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0, SiNVR/SiVMS Video Server All versions V5.0.0. The FTP services of the SiVMS/SiNVR Video Server and the Control Center Server CCS maintain log files that store login credentials in cleartext. In configurations...

Design/Logic Flaw

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS does not enforce logging of security-relevant activities in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. An authenticated remote...

Cross site scripting

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The web interface of the Control Center Server CCS contains multiple stored Cross-site Scripting XSS vulnerabilities in several input fields. This could allow an authenticated remote attacker to inject malicious...

Path traversal

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The DOWNLOADS section in the web interface of the Control Center Server CCS contains a path traversal vulnerability that could allow an authenticated remote attacker to access and download arbitrary files from t...

Cross site scripting

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The web interface of the Control Center Server CCS contains a reflected Cross-site Scripting XSS vulnerability that could allow an unauthenticated remote attacker to steal sensitive data or execute administrativ...

CVE-2019-19290

CVE-2019-19290 affects Siemens/SINVR CCS (Control Center Server) prior to v1.5.0. A path traversal vulnerability in the CCS web interface DOWNLOADS area could allow an authenticated remote attacker to access/download arbitrary server files. The issue is explicitly tied to CCS versions

CVE-2019-19290

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The DOWNLOADS section in the web interface of the Control Center Server CCS contains a path traversal vulnerability that could allow an authenticated remote attacker to access and download arbitrary files from t...

CVE-2019-19292

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The Control Center Server CCS contains an SQL injection vulnerability in its XML-based communication protocol as provided by default on ports 5444/tcp and 5440/tcp. An authenticated remote attacker could exploit...