CVE-2020-9351

Summary of vulnerability (CVE-2020-9351) : In SmartClient 12.0, an unauthenticated attacker can send a POST to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML in the _transaction parameter, causing the server to return a verbose error that reveals the absolute path...

Siemens Patches Authentication Bypass Flaw in SiPass Server

A handful of vulnerabilities in Siemens’ SiPass integrated server have been patched, including one that allows an attacker to bypass authentication on the box. SiPass is the company’s integrated access control server managing physical access in a number of industries and use cases. The product...

Siemens SIMATIC WinCC Sm@rtClient for Android Man-in-the-Middle Attack Vulnerability

Siemens SIMATIC WinCC Sm@rtClient for Android is a client program on Android systems.Siemens SIMATIC is an automation software with a single engineering environment. A man-in-the-middle attack vulnerability exists in Siemens SIMATIC WinCC Sm@rtClient for Android, where an existing implementation ...

SQL Injection Vulnerability in SmartClient.asmx?op Page of Xinwei Software E-learning System

E-learning management system is an online learning platform of Shenzhen Xinwei Software Co. A SQL injection vulnerability exists in the SmartClient.asmx?op page of Xinwei Software's E-learning system. An attacker can exploit the vulnerability to obtain sensitive information from the website...

CVE-2015-5084

The CVE-2015-5084 issue affects Siemens SIMATIC WinCC Sm@rtClient and Sm@rtClient Lite for Android prior to 01.00.01.00. The root cause is improper storage of Sm@rtServer passwords, enabling a locally proximate attacker to retrieve sensitive credentials via unspecified vectors. Impact is credenti...

Siemens SIMATIC WinCC Sm@rtClient app Information Disclosure Vulnerability

Siemens SIMATIC WinCC is the monitoring control and data acquisition SCADA and HMI system. An information disclosure vulnerability exists in Siemens SIMATIC WinCC Sm@rtClient app versions prior to 1.0.2, which allows an attacker to discover Sm@rtServer credentials by exploiting an error in the...

Design/Logic Flaw

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to extract the password from storage via unspecified vectors...

CVE-2014-5231

The Siemens SIMATIC WinCC Sm@rtClient app before 1.0.2 for iOS allows physically proximate attackers to extract the password from storage via unspecified vectors...

NewvCommon.ocx ActiveX Remote Code Execution Vulnerability

NewvCommon.ocx ActiveX Remote Code Execution Vulnerability ======== Vulnerable:All Version Vendor:www.newv.com.cn Details: ======== A remote buffer overflow vulnerability has been found in NewV SmartClient. The specific flaw exists within the WriteTextFile method of the Newv ActiveX control...

NewvCommon.ocx ActiveX Insecure Method Vulnerability

NewvCommon.ocx ActiveX Insecure Method Vulnerability ======== Vulnerable:All Version Vendor:www.newv.com.cn Details: ======== A Insecure method vulnerability has been found in NewV SmartClient. The specific flaw exists within the DelFile method of the Newv ActiveX control NewvCommon.ocx. The...

NewV SmartClient ActiveX multiple security vulnerabilities

Buffer overflows, files access, code execution...

NewvCommon.ocx Active-X Insecure Method

NewvCommon.ocx ActiveX Insecure Method Vulnerability ======== Vulnerable:All Version Vendor:www.newv.com.cn Details: ======== A Insecure method vulnerability has been found in NewV SmartClient. The specific flaw exists within the DelFile method of the Newv ActiveX control NewvCommon.ocx. The...

Newv SmartClient 1.1.0 - 'NewvCommon.ocx' ActiveX Control Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/45751/info The Newv SmartClient ActiveX control is prone to multiple insecure-method vulnerabilities and a stack-based buffer-overflow vulnerability. Successfully exploiting these issues allows remote attackers to create or overwrite arbitrary local files...

NewV Smartclient 1.0.0.18 Command Execution

Vendor: NewV http:// www.newv.com.cn/ Product: NewV smartclient http://demo.newv.com.cn/lds/module/smartclientsetting.exe Vulnerable Version: 1.0.0.18 Status: Not Fixed, Vendor Alerted Risk level: High Credit: Yu Guoyuguo.cngmail.com Description: An input validation issue exists in the NewV Activ...