CVE-2023-40726

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application server responds with sensitive information about the server. This could allow an attacker to directly access the database...

CVE-2023-40726

CVE-2023-40726 affects Siemens QMS Automotive (all versions prior to 12.39). The Red Hat, NVD, and related records describe an information-disclosure vulnerability where the application server responds with sensitive server data, potentially enabling direct access to the database. Public sources ...

CVE-2023-40725

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application returns inconsistent error messages in response to invalid user credentials during login session. This allows an attacker to enumerate usernames, and identify valid usernames...

CVE-2023-40725

CVE-2023-40725 affects Siemens QMS Automotive (all versions prior to v12.39). The issue arises from inconsistent login error messages in response to invalid credentials, enabling attacker-controlled username enumeration. Public sources (NVD/Red Hat security page and Siemens ProductCERT advisory S...

CVE-2023-40725

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application returns inconsistent error messages in response to invalid user credentials during login session. This allows an attacker to enumerate usernames, and identify valid usernames...

CVE-2023-40724

A vulnerability has been identified in QMS Automotive All versions V12.39. User credentials are found in memory as plaintext. An attacker could perform a memory dump, and get access to credentials, and use it for impersonation...

CVE-2023-40724

The CVE-2023-40724 entry applies to Siemens QMS Automotive (all versions prior to v12.39). Root cause: user credentials are stored in plaintext in memory, enabling an attacker with the ability to perform a memory dump to access credentials and impersonate users. Impact, per sources: credential ex...

PT-2023-5189 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: The issue is related to the QMS.Mobile module of the QMS Automotive software, which does not properly invalidate session tokens upon logout. This could allow an attacker to perform session...

CVE-2023-40729: Cleartext Transmission of Sensitive Information

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application lacks security control to prevent unencrypted communication without HTTPS. An attacker who managed to gain machine-in-the-middle position could manipulate, or steal confidential information...

PT-2023-5185 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: A vulnerability has been identified in the affected application, which lacks security control to prevent unencrypted communication without HTTPS. This could allow an attacker who gains a...

Siemens QMS Automotive 安全漏洞

Siemens QMS Automotive is a quality management system for the automotive industry from Siemens, Germany. Siemens QMS Automotive has an information disclosure hole that can be exploited by an attacker to gain direct access to the database...

PT-2023-5183 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: The issue is related to the disclosure of information via a server error message, potentially allowing a remote attacker to gain unauthorized access to the database. The affected applicatio...

CVE-2023-40727: Improper Verification of Cryptographic Signature

A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application uses weak outdated application signing mechanism. This could allow an attacker to tamper the application code...

PT-2023-5186 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: The issue is related to the QMS.Mobile module of the QMS Automotive software, which stores sensitive application data in an external insecure storage. This could allow an attacker to alter...

CVE-2023-40728: Insecure Storage of Sensitive Information

A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application stores sensitive application data in an external insecure storage. This could allow an attacker to alter content, leading to arbitrary code execution or denial-of-service...

Siemans QMS Automotive

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

PT-2023-5188 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: A vulnerability has been identified in the affected application, allowing users to upload arbitrary file types. This could allow an attacker to upload malicious files, potentially leading t...

CVE-2023-40724: Cleartext Storage of Sensitive Information in Memory

A vulnerability has been identified in QMS Automotive All versions V12.39. User credentials are found in memory as plaintext. An attacker could perform a memory dump, and get access to credentials, and use it for impersonation...

CVE-2023-40732: Insufficient Session Expiration

A vulnerability has been identified in QMS Automotive All versions V12.39. The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an attacker to perform session hijacking attacks...

Siemens QMS Automotive 代码问题漏洞

Siemens QMS Automotive is a quality management system for the automotive industry from Siemens, Germany. A code issue vulnerability exists in Siemens QMS Automotive, which stems from the affected application's QMS.Mobile module not invalidating session tokens upon logout. An attacker could exploi...