Vulnerabilities > Siemens
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-06-08 | CVE-2012-3003 | Improper Input Validation vulnerability in Siemens Wincc 7.0 Open redirect vulnerability in an unspecified web application in Siemens WinCC 7.0 SP3 before Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a GET request. | 5.8 |
| 2012-06-08 | CVE-2012-2598 | Buffer Errors vulnerability in Siemens Wincc 7.0 Buffer overflow in the DiagAgent web server in Siemens WinCC 7.0 SP3 through Update 2 allows remote attackers to cause a denial of service (agent outage) via crafted input. | 4.3 |
| 2012-06-08 | CVE-2012-2597 | Path Traversal vulnerability in Siemens Wincc 7.0 Multiple directory traversal vulnerabilities in Siemens WinCC 7.0 SP3 before Update 2 allow remote authenticated users to read arbitrary files via a crafted parameter in a URL. | 4.0 |
| 2012-06-08 | CVE-2012-2596 | Code Injection vulnerability in Siemens Wincc 7.0 The XPath functionality in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 does not properly handle special characters in parameters, which allows remote authenticated users to read or modify settings via a crafted URL, related to an "XML injection" attack. | 5.5 |
| 2012-06-08 | CVE-2012-2595 | Cross-Site Scripting vulnerability in Siemens Wincc 7.0 Multiple cross-site scripting (XSS) vulnerabilities in unspecified web applications in Siemens WinCC 7.0 SP3 before Update 2 allow remote attackers to inject arbitrary web script or HTML via vectors involving special characters in parameters. | 4.3 |
| 2012-04-28 | CVE-2012-2441 | Weak Password Requirements vulnerability in Siemens Ruggedcom Rugged Operating System 3.2.5 RuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address field in a banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) SSH or (2) HTTPS session, a different vulnerability than CVE-2012-1803. | 8.5 |
| 2012-04-28 | CVE-2012-1803 | Cryptographic Issues vulnerability in Siemens Ruggedcom Rugged Operating System RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) TELNET, (2) remote shell (aka rsh), or (3) serial-console session. | 8.5 |
| 2012-04-18 | CVE-2012-1802 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Siemens products Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1, X308-2M before 3.7.2, X-300EEC before 3.7.2, XR-300 before 3.7.2, and X-300 before 3.7.2 allows remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL. | 7.8 |
| 2012-04-18 | CVE-2012-1800 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Siemens products Stack-based buffer overflow in the Profinet DCP protocol implementation on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 allows remote attackers to cause a denial of service (device outage) or possibly execute arbitrary code via a crafted DCP frame. | 6.1 |
| 2012-04-18 | CVE-2012-1799 | Improper Authentication vulnerability in Siemens products The web server on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 does not limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password. | 10.0 |