CVE-2018-4847

MEDIUM Year: 2018
CVSS v3 Score
4.6
Medium
CVSS v2 Score
2.1
Low
Weakness Type
CWE-538
View all →

Vulnerability Description

A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive information (e.g. session key for accessing server) in Siemens WinCC OA Operator iOS app could allow an attacker with physical access to the mobile device to read unencrypted data from the app's directory. Siemens provides mitigations to resolve the security issue.

Related Vulnerabilities

CVE-2022-20864

MEDIUM
CVSS:4.6(Medium)

A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches could allow an unauthenticated, local attacker to recover the configu...

CWE-5382022

CVE-2022-43933

MEDIUM
CVSS:4.4(Medium)

An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supportsave. Supportsave file is generated by an ...

CWE-5382022

CVE-2018-16970

MEDIUM
CVSS:4.3(Medium)

Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified id parameter.

CWE-5382018

CVE-2019-10320

MEDIUM
CVSS:4.3(Medium)

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and...

CWE-5382019

CVE-2019-12623

MEDIUM
CVSS:4.3(Medium)

A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enume...

CWE-5382019

CVE-2021-1406

MEDIUM
CVSS:4.9(Medium)

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker ...

CWE-5382021