Siemens Teamcenter Active Workspace
By sending malformed requests, a remote attacker could leak an application token due to an error not properly handled by the system. A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected devices that could allow an attacker to execute malicious JavaScript code by tricking users into accessing a malicious link. The affected application allows verbose error messages which allow leaking of sensitive information, such as full paths.