22 matches found
Design/Logic Flaw
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier All versions, SIMATIC PCS 7 V8.1 All versions V8.1 with WinCC V7.3 Upd 19, SIMATIC PCS 7 V8.2 All versions V8.2 SP1 with WinCC V7.4 SP1 Upd11, SIMATIC PCS 7 V9.0 All versions V9.0 SP2 with WinCC V7.4 SP1 Upd11, SIMATIC WinCC TI...
CVE-2019-6572: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15.1 Update 1, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15.1 Update 1, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F All versions V15.1 Update 1, SIMATIC WinCC...
CVE-2019-6577: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15.1 Update 1, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15.1 Update 1, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F All versions V15.1 Update 1, SIMATIC WinCC...
CVE-2019-6576: Undefined Security Weakness
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15.1 Update 1, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15.1 Update 1, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F All versions V15.1 Update 1, SIMATIC WinCC...
CVE-2018-13813
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...
CVE-2018-13813: URL Redirection to Untrusted Site
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...
CVE-2018-13812: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...
CVE-2018-11453: Incorrect Default Permissions
A vulnerability has been identified in SIMATIC STEP 7 TIA Portal and WinCC TIA Portal V10, V11, V12 All versions, SIMATIC STEP 7 TIA Portal and WinCC TIA Portal V13 All versions V13 SP2 Update 2, SIMATIC STEP 7 TIA Portal and WinCC TIA Portal V14 All versions V14 SP1 Update 6, SIMATIC STEP 7 TIA...
CVE-2018-11454: Incorrect Default Permissions
A vulnerability has been identified in SIMATIC STEP 7 TIA Portal and WinCC TIA Portal V10, V11, V12 All versions, SIMATIC STEP 7 TIA Portal and WinCC TIA Portal V13 All versions V13 SP2 Update 2, SIMATIC STEP 7 TIA Portal and WinCC TIA Portal V14 All versions V14 SP1 Update 6, SIMATIC STEP 7 TIA...
CVE-2013-4911: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in Siemens WinCC TIA Portal 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product...
CVE-2013-4912: Improper Input Validation
Open redirect vulnerability in Siemens WinCC TIA Portal 11 and 12 before 12 SP1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels by the WinCC product...
Siemens WinCC TIA Portal Vulnerabilities
OVERVIEW Researchers Timur Yunusov and Sergey Bobrov of Positive Technologies have identified several vulnerabilities in the Siemens WinCC TIA Portal. A software update has been produced by Siemens that mitigates these vulnerabilities. Siemens has tested the software update to validate that it...
DHS, ICS-CERT Warn of Siemens HMI Vulnerabilities
The Department of Homeland Security and the ICS-CERT issued an advisory yesterday warning of serious vulnerabilities in Siemens industrial control software deployed in a number of industries including water, gas and oil, and chemical. Siemens said it has patched the flaws in a new version of its...
CVE-2013-0670: Improper Input Validation
CRLF injection vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL...
CVE-2011-4515: Undefined Security Weakness
Siemens WinCC TIA Portal 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging 1 physical access or 2 Sm@rt Server access...
CVE-2013-0669: Improper Input Validation
The HMI web application in Siemens WinCC TIA Portal 11 allows remote authenticated users to cause a denial of service daemon crash via a crafted HTTP request...
CVE-2013-0672: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data...
CVE-2013-0668: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the HMI web application in Siemens WinCC TIA Portal 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL...
CVE-2013-0671: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Siemens WinCC TIA Portal 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL...
CVE-2013-0667: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the HMI web application in Siemens WinCC TIA Portal 11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...