PT-2013-34: Cross-Site Scripting in Siemens Simatic WinCC TIA Portal

The specialists of the Positive Research center have detected "Cross-Site Scripting" vulnerability in Siemens Simatic WinCC TIA Portal. If a user clicks on a malicious link which seems to lead to a HMI web application, it is possible to display any data to the user server-side script injection. H...

PT-2015-10: Privilege Gaining in Siemens SIMATIC STEP 7 (TIA Portal)

The specialists of the Positive Research center have detected a Privilege Gaining vulnerability in Siemens SIMATIC STEP 7 TIA Portal. Vulnerability exists in TIA Portal due to improper integrity protection of project-file fields containing user’s privileges, which allows attackers to modify user...

PT-2013-33: CRLF Injection in Siemens Simatic WinCC TIA Portal

The specialists of the Positive Research center have detected "CRLF Injection" vulnerability in Siemens Simatic WinCC TIA Portal. If a user clicks on a malicious link which seems to lead to a HMI web application, it is possible to display any data to the user HTTP response splitting. How to fix...

PT-2013-30: Denial of Service in Siemens Simatic WinCC TIA Portal

The specialists of the Positive Research center have detected "Denial of Service" vulnerability in Siemens Simatic WinCC TIA Portal. By manipulating HTTP requests an authenticated attacker may crash the HMI’s web application. The web application will become unavailable until the device is...

PT-2013-31: Cross-Site Scripting in Siemens Simatic WinCC TIA Portal

The specialists of the Positive Research center have detected "Cross-Site Scripting" vulnerability in Siemens Simatic WinCC TIA Portal. The HMI’s web application is susceptible to stored Cross-Site-Scripting attacks. An authenticated user may store data on the web application, which will execute...

Siemens SIMATIC WinCC HMI Web Server Multiple Input Validation Vulnerabilities - Active Check

Siemens SIMATIC WinCC is prone to an HTTP-header-injection issue, a directory-traversal issue, and an arbitrary memory-read access issue because the application fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from...

Siemens SIMATIC S7-1200 SSL Private Key Reuse Spoofing Vulnerability (SSA-240718)

Siemens SIMATIC S7-1200 devices are prone to a security vulnerability that may allow attackers to spoof SSL certificates. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2012-3032

SQL injection vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to execute arbitrary SQL commands via a crafted SOAP message...

Sql injection

SQL injection vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to execute arbitrary SQL commands via a crafted SOAP message...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allow remote attackers to inject arbitrary web script or HTML via a 1 GET parameter, 2 POST parameter, or 3 Referer HTTP header...

CVE-2012-3034

WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a username and password via crafted parameters to unspecified methods in ActiveX controls...

CVE-2012-3031

CVE-2012-3031 affects Siemens WinCC WebNavigator (Web interface for WinCC) in WinCC 7.0 SP3 and earlier. The vulnerability is reflected XSS (via a GET parameter, a POST parameter, or the Referer header) that could let an attacker inject arbitrary script/HTML. ICS-CERT notes the issues could allow...

CVE-2012-3028

CVE-2012-3028 affects Siemens WinCC WebNavigator (7.0 SP3 and earlier). A CSRF flaw lets remote attackers hijack a user’s session to perform data-modifying actions or cause a denial of service. Mitigation: Siemens released SSA-864051 and an update for WinCC 7.0 SP3; apply the patch and limit expo...

PT-2013-50: Cross-Site Request Forgery (CSRF) in Siemens Simatic WinCC TIA Portal

The specialists of the Positive Research center have detected "Cross-Site Request Forgery" vulnerability in Siemens Simatic WinCC TIA Portal. Cross-site request forgery CSRF vulnerability in Siemens WinCC TIA Portal allows remote attackers to hijack the authentication of unspecified victims by...

PT-2013-29: Information Disclosure in Siemens Simatic WinCC and PCS 7

The specialists of the Positive Research center have detected "Information Disclosure" vulnerability in Siemens Simatic WinCC and PCS 7. By opening a manipulated project file, sensitive data can be transmitted over the network or a DoS condition can be provoked. How to fix Update your software up...

PT-2013-28: Buffer Overflow in Siemens Simatic WinCC and PCS 7

The specialists of the Positive Research center have detected "Buffer Overflow" vulnerability in Siemens Simatic WinCC and PCS 7. An ActiveX control "RegReader", which is installed in the user’s web browser, is susceptible to a buffer overflow. An attacker might trick a victim into visiting a...

CVE-2012-3017

Siemens SIMATIC S7-400 PN CPU devices with firmware 5.x allow remote attackers to cause a denial of service defect-mode transition and service outage via 1 malformed HTTP traffic or 2 malformed IP packets...

CVE-2012-3017

Summary: CVE-2012-3017 affects Siemens SIMATIC S7-400 PN CPU devices running firmware 5.x. The vulnerability allows remote attackers to trigger a denial of service (defect-mode transition and service outage) by sending malformed HTTP traffic or malformed IP packets. The publicly provided document...

CVE-2012-3015

Untrusted search path vulnerability in Siemens SIMATIC STEP7 before 5.5 SP1, as used in SIMATIC PCS7 7.1 SP3 and earlier and other products, allows local users to gain privileges via a Trojan horse DLL in a STEP7 project folder...

Design/Logic Flaw

Untrusted search path vulnerability in Siemens SIMATIC STEP7 before 5.5 SP1, as used in SIMATIC PCS7 7.1 SP3 and earlier and other products, allows local users to gain privileges via a Trojan horse DLL in a STEP7 project folder...