CVE-2013-4911

Cross-site request forgery CSRF vulnerability in Siemens WinCC TIA Portal 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product...

CVE-2013-4912

Open redirect vulnerability in Siemens WinCC TIA Portal 11 and 12 before 12 SP1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels by the WinCC product...

PT-2013-5266

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal versions 11 through 12 before 12 SP1 Description A cross-site request forgery CSRF issue exists due to improper configuration of SIMATIC HMI panels by the WinCC product, allowing remote attackers to hijack the...

PT-2013-5267

Name of the Vulnerable Software and Affected Versions Siemens WinCC TIA Portal versions 11 and 12 before 12 SP1 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels. This is d...

CVE-2013-4912: Improper Input Validation

Open redirect vulnerability in Siemens WinCC TIA Portal 11 and 12 before 12 SP1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels by the WinCC product...

CVE-2013-4911: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Siemens WinCC TIA Portal 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product...

Siemens SIMATIC WinCC RegReader ActiveX Control Buffer Overflow (CVE-2013-0674)

A stack-based buffer overflow vulnerability has been reported in Siemens SIMATIC WinCC...

CVE-2013-3959

The Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, exhibits different behavior for NetBIOS user names depending on whether the user account exists, which allows remote authenticated users to enumerate account names via crafted U...

CVE-2013-3957

SQL injection vulnerability in the login screen in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-3958

The login implementation in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, has a hardcoded account, which makes it easier for remote attackers to obtain access via an unspecified request...

Code injection

The Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, exhibits different behavior for NetBIOS user names depending on whether the user account exists, which allows remote authenticated users to enumerate account names via crafted U...

Sql injection

SQL injection vulnerability in the login screen in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Hardcoded credentials

The login implementation in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, has a hardcoded account, which makes it easier for remote attackers to obtain access via an unspecified request...

CVE-2013-3958

The login implementation in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, has a hardcoded account, which makes it easier for remote attackers to obtain access via an unspecified request...

CVE-2013-3959

The Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, exhibits different behavior for NetBIOS user names depending on whether the user account exists, which allows remote authenticated users to enumerate account names via crafted U...

CVE-2013-3957

CVE-2013-3957 describes an SQL injection vulnerability in the Web Navigator login screen of Siemens WinCC prior to version 7.2 Update 1 (used in SIMATIC PCS7 8.0 SP1 and earlier). The issue arises from input handling in the login/UI that can be manipulated to inject SQL statements through unspeci...

CVE-2013-3959

The CVE-2013-3959 issue affects Siemens WinCC Web Navigator (before 7.2 Update 1, used in SIMATIC PCS7 8.0 SP1 and earlier). The root cause is improper handling of NetBIOS user name checks via crafted URL parameters, allowing remote authenticated users to enumerate valid user names (forced browsi...

CVE-2013-3958

CVE-2013-3958 affects Siemens WinCC Web Navigator (7.2 and earlier, used with SIMATIC PCS7 8.0 SP1 and related products). The root cause is hard-coded credentials in the Web Navigator login system, enabling remote attackers with network access to log in as an authenticated user and potentially ex...

CVE-2013-3957

SQL injection vulnerability in the login screen in the Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2013-1049

Name of the Vulnerable Software and Affected Versions Siemens WinCC versions prior to 7.2 Update 1 Description The issue exists due to different behavior for NetBIOS user names in the Web Navigator component of Siemens WinCC, depending on whether a user account exists. This allows remote...