Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004 2005 2007 and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP OP MP Comfort Panels and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2011-4510.