Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-31867 State: PUBLISHED Published: 2021-08-04T22:20:35.450666Z Last Updated: 2024-09-16T17:34:30.111Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Pimcore Products: Pimcore Customer Data Framework Problem Types: CWE-89 Description: Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentController.php component of the application. This issue was fixed in version 3.0.2 of the product. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixe
m Container: References: - https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/
CVE ID: CVE-2021-31868 State: PUBLISHED Published: 2021-08-19T15:25:10.545322Z Last Updated: 2024-09-17T01:16:12.557Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Rapid7 Products: Nexpose Problem Types: CWE-306 Description: Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticketing feature, regardless of the assignment of the ticket. This issue was resolved in version 6.6.96, released on August 4, 2021. Additional Analyst Notes: - CVE Program Container: References: - https://docs.rapid7.com/release-notes/nexpose/20210804/
CVE ID: CVE-2021-31869 State: PUBLISHED Published: 2021-08-04T22:20:37.030807Z Last Updated: 2024-09-17T02:27:53.096Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Pimcore Products: Pimcore AdminBundle Problem Types: CWE-89 Description: Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was fixed in version 6.9.4 of the product. Additional Analyst Notes: - CVE Program Container: References: - https://www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/
CVE ID: CVE-2021-31870 State: PUBLISHED Published: 2021-04-30T05:19:13 Last Updated: 2024-08-03T23:10:30.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in klibc before 2.0.9. Multiplication in the calloc() function may result in an integer overflow and a subsequent heap buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://kernel.org/pub/linux/libs/klibc/2.0/ - https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=292650f04c2b5348b4efbad61fb014ed09b4f3f2 - https://lists.zytor.com/archives/klibc/2021-April/004593.html - http://www.openwall.com/lists/oss-security/2021/04/30/1 - https://lists.debian.org/debian
klibc/2021-April/004593.html - http://www.openwall.com/lists/oss-security/2021/04/30/1 - https://lists.debian.org/debian-lts-announce/2021/06/msg00025.html
CVE ID: CVE-2021-31871 State: PUBLISHED Published: 2021-04-30T05:18:52 Last Updated: 2024-08-03T23:10:30.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in klibc before 2.0.9. An integer overflow in the cpio command may result in a NULL pointer dereference on 64-bit systems. Additional Analyst Notes: - CVE Program Container: References: - https://kernel.org/pub/linux/libs/klibc/2.0/ - https://lists.zytor.com/archives/klibc/2021-April/004593.html - https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=2e48a12ab1e30d43498c2d53e878a11a1b5102d5 - http://www.openwall.com/lists/oss-security/2021/04/30/1 - https://lists.debian.org/debian-lts-announce
878a11a1b5102d5 - http://www.openwall.com/lists/oss-security/2021/04/30/1 - https://lists.debian.org/debian-lts-announce/2021/06/msg00025.html
CVE ID: CVE-2021-31872 State: PUBLISHED Published: 2021-04-30T05:19:04 Last Updated: 2024-08-03T23:10:31.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in klibc before 2.0.9. Multiple possible integer overflows in the cpio command on 32-bit systems may result in a buffer overflow or other security impact. Additional Analyst Notes: - CVE Program Container: References: - https://kernel.org/pub/linux/libs/klibc/2.0/ - https://lists.zytor.com/archives/klibc/2021-April/004593.html - https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=9b1c91577aef7f2e72c3aa11a27749160bd278ff - http://www.openwall.com/lists/oss-security/2021/04/30/1 - https://list
it/?id=9b1c91577aef7f2e72c3aa11a27749160bd278ff - http://www.openwall.com/lists/oss-security/2021/04/30/1 - https://lists.debian.org/debian-lts-announce/2021/06/msg00025.html
CVE ID: CVE-2021-31873 State: PUBLISHED Published: 2021-04-30T00:00:00 Last Updated: 2024-08-03T23:10:30.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://kernel.org/pub/linux/libs/klibc/2.0/ - https://lists.zytor.com/archives/klibc/2021-April/004593.html - https://git.kernel.org/pub/scm/libs/klibc/klibc.git/commit/?id=a31ae8c508fc8d1bca4f57e9f9f88127572d5202 - http://www.openwall.com/lists/oss-security/2021/04/30/1 - https://lists.debian.org/debian-lts-
a4f57e9f9f88127572d5202 - http://www.openwall.com/lists/oss-security/2021/04/30/1 - https://lists.debian.org/debian-lts-announce/2021/06/msg00025.html - https://github.com/huolinjue/klibc/commit/a31ae8c508fc8d1bca4f57e9f9f88127572d5202
CVE ID: CVE-2021-31874 State: PUBLISHED Published: 2021-07-02T17:13:22 Last Updated: 2024-08-03T23:10:30.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application. Additional Analyst Notes: - CVE Program Container: References: - https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6104-released-with-an-important-security-fixes - https://blog.stmcyber.com/vulns/cve-2021-31874/
CVE ID: CVE-2021-31875 State: PUBLISHED Published: 2021-04-29T00:00:00 Last Updated: 2024-08-03T23:10:30.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because "there isn’t very much of an opportunity to exploit this reliably for an information leak, so there isn’t any real security impact." Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1-other-mjs/ - htt
impact." Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1-other-mjs/ - https://github.com/418sec/mjs/pull/2 - https://github.com/cesanta/mjs/releases/tag/1.26
CVE ID: CVE-2021-31876 State: PUBLISHED Published: 2021-05-13T21:03:38 Last Updated: 2024-08-03T23:10:31.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction with nSequence = 0xff_ff_ff_ff, spending an unconfirmed parent with nSequence <= 0xff_ff_ff_fd, should be replaceable because there is inherited signaling by the child transaction. However, the actual PreChecks implementation does not e
e because there is inherited signaling by the child transaction. However, the actual PreChecks implementation does not enforce this. Instead, mempool rejects the replacement attempt of the unconfirmed child transaction. Additional Analyst Notes: - CVE Program Container: References: - https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2021-31876 - https://bitcoinops.org/en/topics/replace-by-fee/ - https://github.com/bitcoin/bitcoin - https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2021-May/018893.html - https://bitcoinops.org/en/newsletters/2021/05/12/
CVE ID: CVE-2021-31877 State: REJECTED Published: 2021-05-10T15:26:43 Last Updated: 2021-05-10T15:30:36 Description: No description available.
CVE ID: CVE-2021-31878 State: PUBLISHED Published: 2021-07-27T05:17:05 Last Updated: 2024-08-03T23:10:30.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. To exploit, a re-INVITE without SDP must be received after Asterisk has sent a BYE request. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2021/Jul/48 - http://packetstormsecurity.com/files/163638/Asterisk-Project-Security-Advisory-AST-2021-007.html - http://downloads.asterisk.org/pub/security/AST-2021-007.html - https://issues.asterisk.org/jira/browse/ASTERISK-29381 - https://downloads.digium.co
rg/pub/security/AST-2021-007.html - https://issues.asterisk.org/jira/browse/ASTERISK-29381 - https://downloads.digium.com/pub/security/AST-2021-007.html
CVE ID: CVE-2021-31879 State: PUBLISHED Published: 2021-04-29T03:03:15 Last Updated: 2024-08-03T23:10:30.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007. Additional Analyst Notes: - CVE Program Container: References: - https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html - https://security.netapp.com/advisory/ntap-20210618-0002/
CVE ID: CVE-2021-31881 State: PUBLISHED Published: 2021-11-09T11:31:54 Last Updated: 2025-03-11T09:47:40.916Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: Siemens Products: Capital Embedded AR Classic 431-422, Capital Embedded AR Classic R20-11 Problem Types: CWE-125 Description: A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP OFFER message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0008) Additional Analyst Notes: - CVE Program Container: Refer
n(s), leading to Denial-of-Service conditions. (FSMD-2021-0008) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf - https://cert-portal.siemens.com/productcert/html/ssa-114589.html - https://cert-portal.siemens.com/productcert/html/ssa-044112.html - https://cert-portal.siemens.com/productcert/html/ssa-620288.html
CVE ID: CVE-2021-31882 State: PUBLISHED Published: 2021-11-09T11:31:55 Last Updated: 2025-03-11T09:47:42.320Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: Capital Embedded AR Classic 431-422, Capital Embedded AR Classic R20-11 Problem Types: CWE-119 Description: A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). The DHCP client application does not validate the length of the Domain Name Server IP option(s) (0x06) when processing DHCP ACK packets. This may lead to Denial-of-Service conditions. (FSMD-2021-0011) Additional Analyst Notes: - CVE
essing DHCP ACK packets. This may lead to Denial-of-Service conditions. (FSMD-2021-0011) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf - https://cert-portal.siemens.com/productcert/html/ssa-114589.html - https://cert-portal.siemens.com/productcert/html/ssa-044112.html - https://cert-portal.siemens.com/productcert/html/ssa-620288.html
CVE ID: CVE-2021-31883 State: PUBLISHED Published: 2021-11-09T11:31:56 Last Updated: 2025-03-11T09:47:43.750Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: Siemens Products: Capital Embedded AR Classic 431-422, Capital Embedded AR Classic R20-11 Problem Types: CWE-119 Description: A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013) Additional Analyst Notes: - CVE Program Container: Referen
s), leading to Denial-of-Service conditions. (FSMD-2021-0013) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf - https://cert-portal.siemens.com/productcert/html/ssa-114589.html - https://cert-portal.siemens.com/productcert/html/ssa-044112.html - https://cert-portal.siemens.com/productcert/html/ssa-620288.html
CVE ID: CVE-2021-31884 State: PUBLISHED Published: 2021-11-09T11:31:57 Last Updated: 2024-08-03T23:10:30.775Z Vendors: Siemens Products: APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet), APOGEE MEC (PPC) (P2 Ethernet), APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), Capital VSTAR, Desigo PXC00-E.D, Desigo PXC00-U, Desigo PXC001-E.D, Desigo PXC100-E.D, Desigo PXC12-E.D, Desigo PXC128-U, Desigo PXC200-E.D, Desigo PXC22-E.D, Desigo PXC22.1-E.D, Desigo PXC36.1-E.D, Desigo PXC50-E.D, Desigo PXC64-U, Desigo PXM20-E, Nucleus NET, Nucleus ReadyStart V3, Nucleus Source Code, TALON TC Comp
Desigo PXC50-E.D, Desigo PXC64-U, Desigo PXM20-E, Nucleus NET, Nucleus ReadyStart V3, Nucleus Source Code, TALON TC Compact (BACnet), TALON TC Modular (BACnet) Problem Types: CWE-170 Description: A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Capital VSTAR (All versions with enabled Ethernet options), Des
OGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Capital VSTAR (All versions with enabled Ethernet options), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PX
PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). The DHCP client application assumes that the data supplied with the “Hostname” DHCP option is NULL terminated. In cases when global hostname variable is not defined, this may lead to Out-of-bound reads, wr
ption is NULL terminated. In cases when global hostname variable is not defined, this may lead to Out-of-bound reads, writes, and Denial-of-service conditions. (FSMD-2021-0014) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-620288.pdf
CVE ID: CVE-2021-31885 State: PUBLISHED Published: 2021-11-09T11:31:58 Last Updated: 2024-08-03T23:10:30.607Z Vendors: Siemens Products: APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet), APOGEE MEC (PPC) (P2 Ethernet), APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), Desigo PXC00-E.D, Desigo PXC00-U, Desigo PXC001-E.D, Desigo PXC100-E.D, Desigo PXC12-E.D, Desigo PXC128-U, Desigo PXC200-E.D, Desigo PXC22-E.D, Desigo PXC22.1-E.D, Desigo PXC36.1-E.D, Desigo PXC50-E.D, Desigo PXC64-U, Desigo PXM20-E, Nucleus NET, Nucleus ReadyStart V3, Nucleus ReadyStart V4, Nucleus Source Code, PLUSC
D, Desigo PXC64-U, Desigo PXM20-E, Nucleus NET, Nucleus ReadyStart V3, Nucleus ReadyStart V4, Nucleus Source Code, PLUSCONTROL 1st Gen, TALON TC Compact (BACnet), TALON TC Modular (BACnet) Problem Types: CWE-805 Description: A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >=
) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 a
.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.1), Nucleus Source Code (All versions), PLUSCONTROL 1st Gen (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). TFTP server application allows for reading the contents of the TFTP memory buffer via sending malformed TFTP commands. (FSMD-2021-0009) Additional Analys
r reading the contents of the TFTP memory buffer via sending malformed TFTP commands. (FSMD-2021-0009) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf
CVE ID: CVE-2021-31886 State: PUBLISHED Published: 2021-11-09T11:31:59 Last Updated: 2024-08-03T23:10:30.838Z Vendors: Siemens Products: APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet), APOGEE MEC (PPC) (P2 Ethernet), APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), Desigo PXC00-E.D, Desigo PXC00-U, Desigo PXC001-E.D, Desigo PXC100-E.D, Desigo PXC12-E.D, Desigo PXC128-U, Desigo PXC200-E.D, Desigo PXC22-E.D, Desigo PXC22.1-E.D, Desigo PXC36.1-E.D, Desigo PXC50-E.D, Desigo PXC64-U, Desigo PXM20-E, Nucleus NET, Nucleus ReadyStart V3, Nucleus Source Code, TALON TC Compact (BACnet), T
D, Desigo PXC64-U, Desigo PXM20-E, Nucleus NET, Nucleus ReadyStart V3, Nucleus Source Code, TALON TC Compact (BACnet), TALON TC Modular (BACnet) Problem Types: CWE-170 Description: A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All v
r (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All version
versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “USER” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0010) Additional Analyst Notes: - CVE Program Container: References: - https://ce
and Remote Code Execution. (FSMD-2021-0010) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-114589.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf
CVE ID: CVE-2021-31887 State: PUBLISHED Published: 2021-11-09T11:32:00 Last Updated: 2024-08-03T23:10:30.650Z Vendors: Siemens Products: APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet), APOGEE MEC (PPC) (P2 Ethernet), APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), Desigo PXC00-E.D, Desigo PXC00-U, Desigo PXC001-E.D, Desigo PXC100-E.D, Desigo PXC12-E.D, Desigo PXC128-U, Desigo PXC200-E.D, Desigo PXC22-E.D, Desigo PXC22.1-E.D, Desigo PXC36.1-E.D, Desigo PXC50-E.D, Desigo PXC64-U, Desigo PXM20-E, Nucleus NET, Nucleus ReadyStart V3, Nucleus Source Code, TALON TC Compact (BACnet), T
versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “PWD/XPWD” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0016) Additional Analyst Notes: - CVE Program Container: References: - https: