CVE-2023-40724

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in QMS Automotive (All versions < V12.39). User credentials are found in memory as plaintext. An attacker could perform a memory dump, and get access to credentials, and use it for impersonation.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-316

Affected software

VendorProductVersions
SiemensQMS AutomotiveAll versions < V12.39

References

Timeline

Published
Sep 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-407254.0A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application returns inconsistent error messages CVE-2023-407268.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application server responds with sensitive inforCVE-2023-407277.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application uses weak oCVE-2023-407287.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application stores sensCVE-2023-407297.4A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application lacks security control to prevent unCVE-2023-40738.8Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap cCVE-2023-407308.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application lacks suffiCVE-2023-407318.8A vulnerability has been identified in QMS Automotive (All versions < V12.39). The affected application allows users to upload arbitrary filCVE-2023-407323.9A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected application does not inCVE-2023-407357.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (ArchitectuCVE-2023-40748.8Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruCVE-2023-407439.8** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service t
CVE-2023-40724: High severity, CVSS 7.3 | Vulnix