CVE-2016-7960

LowCVSS 2.5/10Last modified Jun 17, 2026

Description

Siemens SIMATIC STEP 7 (TIA Portal) before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors.

Metrics

CVSS 3.0 2.5/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/93551Third Party Advisory, VDB Entry
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-869766.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-16-287-03Mitigation, Patch, Third Party Advisory, US Government Resource, VDB Entry
http://www.securityfocus.com/bid/93551Third Party Advisory, VDB Entry
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-869766.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-16-287-03Mitigation, Patch, Third Party Advisory, US Government Resource, VDB Entry

Timeline

Published: Oct 13, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-79648.6The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enable CVE-2016-79656.5DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to p CVE-2016-79667.3Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser CVE-2016-79678.1KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file CVE-2016-79686.5KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript a CVE-2016-79697.5The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds re CVE-2016-79707.5Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service CVE-2016-79727.5The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory a CVE-2016-79739.8The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.CVE-2016-79749.8The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions.CVE-2016-79759.8The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print().CVE-2016-79768.8The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.