CVE-2022-43958

CVE-2022-43958 | Siemens QMS Automotive : All versions prior to v12.39 store user credentials in plaintext in the database (no hashing). This enables credential exposure and potential user impersonation. Evidence sources describe plaintext password storage as the root cause and assign CVSS scores...

CVE-2023-40732

CVE-2023-40732 affects Siemens QMS Automotive: the QMS.Mobile module does not invalidate the session token on logout for all versions before V12.39, enabling potential session hijacking. Impact is limited to user sessions; CVSS v3.1 base score 3.9 (LOW). Remediation per sources: update to V12.39 ...

CVE-2023-40729

CVE-2023-40729 affects Siemens QMS Automotive: all versions prior to V12.39 are vulnerable due to unencrypted (HTTPS-free) communications, enabling MITM manipulation or theft of confidential data. Connected documents confirm the issue in QMS Automotive and specify the root cause as lack of securi...

CVE-2023-40725

CVE-2023-40725 affects Siemens QMS Automotive (all versions prior to v12.39). The issue arises from inconsistent login error messages in response to invalid credentials, enabling attacker-controlled username enumeration. Public sources (NVD/Red Hat security page and Siemens ProductCERT advisory S...

CVE-2023-40726

CVE-2023-40726 affects Siemens QMS Automotive (all versions prior to 12.39). The Red Hat, NVD, and related records describe an information-disclosure vulnerability where the application server responds with sensitive server data, potentially enabling direct access to the database. Public sources ...

CVE-2023-40724

The CVE-2023-40724 entry applies to Siemens QMS Automotive (all versions prior to v12.39). Root cause: user credentials are stored in plaintext in memory, enabling an attacker with the ability to perform a memory dump to access credentials and impersonate users. Impact, per sources: credential ex...

CVE-2023-40727

CVE-2023-40727 affects Siemens QMS Automotive, specifically the QMS.Mobile module in all versions before v12.39. The root cause is a weak, outdated application signing mechanism that could allow an attacker to tamper the application code. This vulnerability can lead to code tampering, potentially...

CVE-2023-40728

The CVE-2023-40728 entry pertains to Siemens QMS Automotive, affecting all versions earlier than v12.39, specifically the QMS.Mobile module that stores sensitive data in an external insecure storage. The root cause is insecure external storage allowing content manipulation, which could enable arb...

CVE-2023-40730

Summary : CVE-2023-40730 affects Siemens QMS Automotive, specifically the QMS.Mobile module in all versions prior to 12.39. The root cause is insufficient authorization checks that could let an attacker access confidential information, perform administrative actions, or cause a denial-of-service....

CVE-2023-40731

Siemens QMS Automotive (all versions before v12.39) is affected by CVE-2023-40731 due to an unrestricted upload of file types in the application, enabling upload of malicious files that could lead to code tampering. Reported exposure is network-based with low attack complexity and requires vulner...

CVE-2021-27389

Opcenter Quality (Siemens) and QMS Automotive are affected by CVE-2021-27389 due to a private signing key shipped with the product without adequate protection. Affected products: Opcenter Quality for all versions < V12.2 and QMS Automotive for all versions