CVE-2012-2596

The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack...

PT-2012-4126

Name of the Vulnerable Software and Affected Versions Siemens WinCC versions 7.0 SP3 through Update 2 Description The issue is related to a buffer overflow in the DiagAgent web server, which can be exploited by remote attackers to cause a denial of service, resulting in an agent outage. This can ...

PT-2012-4125

Name of the Vulnerable Software and Affected Versions Siemens WinCC version 7.0 SP3 before Update 2 Description The issue allows remote authenticated users to read arbitrary files via a crafted parameter in a URL, due to multiple directory traversal vulnerabilities. Recommendations For Siemens...

PT-2012-4123

Name of the Vulnerable Software and Affected Versions Siemens WinCC version 7.0 SP3 before Update 2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in unspecified web applications. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML...

PT-2012-4124

Name of the Vulnerable Software and Affected Versions Siemens WinCC version 7.0 SP3 before Update 2 Description The issue concerns the XPath functionality in web applications, which does not properly handle special characters in parameters. This allows remote authenticated users to read or modify...

PT-2012-4427

Name of the Vulnerable Software and Affected Versions Siemens WinCC version 7.0 SP3 before Update 2 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a GET request. This can be achieved by including a malicious URL in...

CVE-2012-2597: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Siemens WinCC 7.0 SP3 before Update 2 allow remote authenticated users to read arbitrary files via a crafted parameter in a URL...

CVE-2012-2596: Improper Control of Generation of Code

The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack...

CVE-2012-2595: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 allow remote attackers to inject arbitrary web script or HTML via vectors involving special characters in parameters...

CVE-2012-3003: Improper Input Validation

Open redirect vulnerability in an unspecified web application in Siemens WinCC 7.0 SP3 before Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a GET request...

CVE-2012-2598: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the DiagAgent web server in Siemens WinCC 7.0 SP3 through Update 2 allows remote attackers to cause a denial of service agent outage via crafted input...

MiniWeb Content-Length Denial Of Service

Exploit for windows platform in category dos / poc !/usr/bin/env python miniweb Content-Length DoS PoC Not a 0day, sadly. aluigi found this ages back, I independantly rediscovered it fuzzing and noticed it was still unpatched. Oh well, better disclose so! vuln version at code.google.com/p/miniweb...

PT-2013-51: Open Redirect Vulnerability in Siemens Simatic WinCC TIA Portal

The specialists of the Positive Research center have detected "Open Redirect" vulnerability in Siemens Simatic WinCC TIA Portal. Open redirect vulnerability in Siemens WinCC TIA Portal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging...

Siemens WinCC Insecure SQL Server Authentication

Overview Siemens has released a software update for an insecure SQL server authentication vulnerability in Siemens’ SIMATIC WinCC and SIMATIC PCS 7 software. Previous versions of SIMATIC WinCC use default SQL server credentials that allowed administrative access to the database. The default...

Siemens WinCC Multiple Vulnerabilities

Overview Independent researchers Gleb Gritsai, Alexander Zaitsev, Sergey Scherbel, Yuri Goltsev, Dmitry Serebryannikov, Sergey Bobrov, Denis Baranov, Andrey Medov from Positive Technologies have identified multiple vulnerabilities in the Siemens WinCC application. In evaluating these reported...

CVE-2011-4879

miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 aka TIA portal before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime does not properly handle UR...

CVE-2011-4878

Directory traversal vulnerability in miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 aka TIA portal before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexibl...

CVE-2011-4508

The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 aka TIA portal before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime generates predictable authentication token...

CVE-2011-4514

The TELNET daemon in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 aka TIA portal; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime does not perform authentication, which makes it easier for remote attacker...

CVE-2011-4875

Stack-based buffer overflow in HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 aka TIA portal; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime, when Transfer Mode is enabled,...