Siemens Qms Automotive vulnerabilities

11 CVEs affecting Siemens Qms Automotive, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-40732, published 2023-09-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-27389, published 2021-04-22. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the product without adequate protection.
CVE-2023-40726, published 2023-09-12. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application server responds with sensitive information about the server. This could allow an attacker to…
CVE-2023-40730, published 2023-09-12. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application lacks sufficient authorization checks. This could allow an attacker to…
CVE-2023-40731, published 2023-09-12. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to upload arbitrary file types. This could allow an attacker to upload malicious…
CVE-2022-43958, published 2022-11-08. High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext in the database without any hashing…
CVE-2023-40729, published 2023-09-12. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unencrypted communication without HTTPS. An attacker who…
CVE-2023-40728, published 2023-09-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensitive application data in an external insecure storage.…
CVE-2023-40725, published 2023-09-12. Medium severity, CVSS 4.0. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages in response to invalid user credentials during login…
CVE-2023-40732, published 2023-09-12. Low severity, CVSS 3.9. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not invalidate the session token on logout. This could allow an…
CVE-2023-40727, published 2023-09-12. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application uses weak outdated application signing mechanism. This could allow an…

Latest

CVE-2023-40724, published 2023-09-12. High severity, CVSS 7.3. EPSS: 0.1% chance of exploitation in the next 30 days. A vulnerability has been identified in QMS Automotive (All versions < V12.39). User credentials are found in memory as plaintext. An attacker could perform a memory dump, and get access to…