Vulnerabilities > Siemens > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2014-02-07 | CVE-2014-1696 | Cryptographic Issues vulnerability in Siemens Simatic Wincc Open Architecture Siemens SIMATIC WinCC OA before 3.12 P002 January uses a weak hash algorithm for passwords, which makes it easier for remote attackers to obtain access via a brute-force attack. | 5.0 |
| 2013-12-10 | CVE-2013-6840 | Permissions, Privileges, and Access Controls vulnerability in Siemens Comos Siemens COMOS before 9.2.0.8.1, 10.0 before 10.0.3.1.40, and 10.1 before 10.1.0.0.2 allows local users to gain database privileges via unspecified vectors. | 6.9 |
| 2013-08-01 | CVE-2013-4912 | Improper Input Validation vulnerability in Siemens Wincc 11.0/12.0 Open redirect vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks by leveraging improper configuration of SIMATIC HMI panels by the WinCC product. | 5.8 |
| 2013-08-01 | CVE-2013-4911 | Cross-Site Request Forgery (CSRF) vulnerability in Siemens Wincc 11.0/12.0 Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the authentication of unspecified victims by leveraging improper configuration of SIMATIC HMI panels by the WinCC product. | 6.8 |
| 2013-08-01 | CVE-2013-4651 | Credentials Management vulnerability in Siemens products Siemens Scalance W7xx devices with firmware before 4.5.4 use the same hardcoded X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship. | 6.6 |
| 2013-07-18 | CVE-2013-4779 | Cross-Site Scripting vulnerability in Siemens products Cross-site scripting (XSS) vulnerability in core/handleTw.php on the Siemens Enterprise OpenScape Branch appliance and OpenScape Session Border Controller (SBC) before 2 R0.32.0, and 7 before 7 R1.7.0, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2013-06-18 | CVE-2013-3927 | Local Security Bypass vulnerability in Siemens Comos 10.0/9.2 Unspecified vulnerability in the client library in Siemens COMOS 9.2 before 9.2.0.6.10 and 10.0 before 10.0.3.0.4 allows local users to obtain unintended write access to the database by leveraging read access. | 4.6 |
| 2013-06-14 | CVE-2013-3959 | Information Exposure vulnerability in Siemens Simatic Pcs7 and Wincc The Web Navigator in Siemens WinCC before 7.2 Update 1, as used in SIMATIC PCS7 8.0 SP1 and earlier and other products, exhibits different behavior for NetBIOS user names depending on whether the user account exists, which allows remote authenticated users to enumerate account names via crafted URL parameters. | 4.0 |
| 2013-03-21 | CVE-2013-0679 | Path Traversal vulnerability in Siemens Simatic Pcs7 and Wincc Directory traversal vulnerability in the web server in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote authenticated users to read arbitrary files via vectors involving a query for a pathname. | 4.0 |
| 2013-03-21 | CVE-2013-0678 | Credentials Management vulnerability in Siemens Simatic Pcs7 and Wincc Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly represent WebNavigator credentials in a database, which makes it easier for remote authenticated users to obtain sensitive information via a SQL query. | 4.0 |