Directory traversal

Directory traversal vulnerability in Siemens WinCC TIA Portal 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL...

Design/Logic Flaw

Siemens WinCC TIA Portal 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging 1 physical access or 2 Sm@rt Server access...

Crlf injection

CRLF injection vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2013-0667

CVE-2013-0667 is a cross-site scripting (XSS) vulnerability in the HMI web application of Siemens WinCC (TIA Portal) 11. Affected product: WinCC (TIA Portal) V11 (all versions). Vulnerability: improper handling in the Web server may allow an authenticated user or an attacker with valid credential...

CVE-2011-4515

Summary of CVE-2011-4515 (Siemens WinCC TIA Portal): The vulnerability affects Siemens WinCC (TIA Portal) HMI Web server in version 11. It involves storing HMI Web-application passwords using a reversible scheme, leaving password data world-readable/writable and retrievable with local access or v...

CVE-2013-0671

Directory traversal vulnerability in Siemens WinCC TIA Portal 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL...

CVE-2013-0671

CVE-2013-0671 affects Siemens WinCC (TIA Portal) 11. The vulnerability is a Directory Traversal vulnerability in the HMI Web server, exploitable by manipulating the URL to read panel server-side source code and user-defined scripts. It requires authenticated access; exploitation is not remote wit...

CVE-2013-0668

Multiple cross-site scripting XSS vulnerabilities in the HMI web application in Siemens WinCC TIA Portal 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-0668

CVE-2013-0668 : In Siemens WinCC (TIA Portal) 11, the HMI Web application is vulnerable to cross-site scripting via crafted URLs. The issue is tied to input handling in the Web UI, enabling an authenticated or social-engineered user to trigger script execution in other users’ browsers. Affected p...

CVE-2011-4515

Siemens WinCC TIA Portal 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging 1 physical access or 2 Sm@rt Server access...

CVE-2013-0669

Siemens WinCC (TIA Portal) V11 HMI web application is affected by CVE-2013-0669. An authenticated user can craft HTTP requests that crash the HMI Web application, causing a denial of service. The root cause is Improper Input Validation in the Web server, with network attack vector and no confiden...

CVE-2013-0670

CRLF injection vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...

CVE-2013-0670

Siemens WinCC (TIA Portal) 11 HMI Web application is affected by CVE-2013-0670 (CRLF injection). A crafted URL can lead to HTTP header injection and HTTP response splitting via the HMI Web server. Public sources (NVD, Red Hat cve page, ICS-CERT advisory) confirm the vulnerability in WinCC V11 and...

CVE-2013-0668: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the HMI web application in Siemens WinCC TIA Portal 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2013-0671: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Siemens WinCC TIA Portal 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL...

PT-2013-2514

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description The issue allows remote authenticated users to cause a denial of service, resulting in a daemon crash, by sending a crafted HTTP request to the HMI web application. Recommendations For version 11...

PT-2013-2513

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the HMI web application. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via a crafted...

PT-2013-2515

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal version 11 Description The issue concerns a CRLF injection vulnerability in the HMI web application. This vulnerability allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attac...

CVE-2013-0672: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data...

CVE-2013-0670: Improper Input Validation

CRLF injection vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...