Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-34204 State: PUBLISHED Published: 2021-06-16T19:55:40 Last Updated: 2024-08-04T00:05:52.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text. It does not use linux user management. In addition, the passwords of all devices are the same, and they cannot be modified by normal users. An attacker can easily log in to the target router through the serial port and obtain root privileges. Additional Analyst Notes: - CVE Program Container: References: - http://d-link.com - https://www.dlink.com/en/security-bulletin
nal Analyst Notes: - CVE Program Container: References: - http://d-link.com - https://www.dlink.com/en/security-bulletin/ - http://dir-2640-us.com - https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-34204
CVE ID: CVE-2021-34207 State: PUBLISHED Published: 2021-08-20T16:43:08 Last Updated: 2024-08-04T00:05:52.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Domain Name" field, "Server Address" field, "User Name/Email", or "Password/Key" field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
CVE ID: CVE-2021-34215 State: PUBLISHED Published: 2021-08-20T16:44:37 Last Updated: 2024-08-04T00:05:52.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Service Name" field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
CVE ID: CVE-2021-34218 State: PUBLISHED Published: 2021-08-20T16:46:09 Last Updated: 2024-08-04T00:05:52.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /add/ , /img/, /js/, and /mobile directories via GET Parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R%20Directory%20Indexing
CVE ID: CVE-2021-34220 State: PUBLISHED Published: 2021-08-20T16:47:55 Last Updated: 2024-08-04T00:05:52.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "User Name" field or "Password" field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
CVE ID: CVE-2021-34223 State: PUBLISHED Published: 2021-08-20T16:48:48 Last Updated: 2024-08-04T00:05:52.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "URL Address" field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
CVE ID: CVE-2021-34228 State: PUBLISHED Published: 2021-08-20T16:49:24 Last Updated: 2024-08-04T00:05:52.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Description" field and "Service Name" field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
CVE ID: CVE-2021-34235 State: PUBLISHED Published: 2022-02-11T17:41:45 Last Updated: 2024-08-04T00:05:52.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tokheim Profleet DiaLOG 11.005.02 is affected by SQL Injection. The component is the Field__UserLogin parameter on the logon page. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/165944/Tokheim-Profleet-DiaLOG-Fuel-Management-System-11.005.02-SQL-Injection-Code-Execution.html
CVE ID: CVE-2021-34236 State: PUBLISHED Published: 2022-09-07T23:58:32 Last Updated: 2024-08-04T00:05:52.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow in Netgear R8000 Router with firmware v1.0.4.56 allows remote attackers to execute arbitrary code or cause a denial-of-service by sending a crafted POST to '/bd_genie_create_account.cgi' with a sufficiently long parameter 'register_country'. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Davidteeri/Bug-Report/blob/main/netgear-8000.md
CVE ID: CVE-2021-34243 State: PUBLISHED Published: 2021-06-22T13:21:35 Last Updated: 2024-08-04T00:05:52.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross site scripting (XSS) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web scripts or HTML via a crafted file uploaded into the Document Management tab. The exploit is triggered when a user visits the upload location of the crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xoffense/POC/blob/main/Stored%20XSS%20via%20malicious%20file%20upload%20in%20ICE%20Hrm%20Version%2029.0.0.OS.md
CVE ID: CVE-2021-34244 State: PUBLISHED Published: 2021-06-22T13:21:39 Last Updated: 2024-08-04T00:05:52.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site request forgery (CSRF) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or change users' passwords. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xoffense/POC/blob/main/Account%20takeover%20using%20CSRF%20in%20ICE%20Hrm%20Version%2029.0.0.OS.md
CVE ID: CVE-2021-34248 State: REJECTED Published: N/A Last Updated: 2023-02-27T00:00:00 Description: No description available.
CVE ID: CVE-2021-34249 State: PUBLISHED Published: 2023-02-24T00:00:00.000Z Last Updated: 2025-03-12T15:43:34.857Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in sourcecodester online-book-store 1.0 allows remote attackers to view sensitive information via the id paremeter in application URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/48775 - https://packetstormsecurity.com/files/159000/Online-Book-Store-1.0-SQL-Injection.html
CVE ID: CVE-2021-34250 State: REJECTED Published: N/A Last Updated: 2023-02-17T00:00:00 Description: No description available.
CVE ID: CVE-2021-34254 State: PUBLISHED Published: 2021-06-28T15:24:35 Last Updated: 2024-08-04T00:05:52.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/umbraco/Umbraco-CMS/issues/9782
CVE ID: CVE-2021-34257 State: PUBLISHED Published: 2022-03-31T15:57:38 Last Updated: 2024-08-04T00:05:52.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image. Additional Analyst Notes: - CVE Program Container: References: - https://latestpcsolution.wordpress.com/2021/06/05/wpanel4-cms-authenticated-rce/ - https://github.com/Sentinal920/WPanel4-Authenticated-RCE
CVE ID: CVE-2021-34259 State: PUBLISHED Published: 2021-07-22T19:40:34 Last Updated: 2024-08-04T00:05:52.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/STMicroelectronics/STM32CubeH7/issues/76
CVE ID: CVE-2021-34260 State: PUBLISHED Published: 2021-07-22T19:40:35 Last Updated: 2024-08-04T00:05:52.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/STMicroelectronics/STM32CubeH7/issues/83
CVE ID: CVE-2021-34261 State: PUBLISHED Published: 2021-07-22T19:40:36 Last Updated: 2024-08-04T00:05:52.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system hanging when trying to set a remote wake-up feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/STMicroelectronics/STM32CubeH7/issues/78
CVE ID: CVE-2021-34262 State: PUBLISHED Published: 2021-07-22T19:40:37 Last Updated: 2024-08-04T00:05:52.405Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/STMicroelectronics/STM32CubeH7/issues/81
CVE ID: CVE-2021-34267 State: PUBLISHED Published: 2021-07-22T19:47:43 Last Updated: 2024-08-04T00:05:52.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) when the system tries to communicate with the connected endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/STMicroelectronics/STM32CubeH7/issues/80
CVE ID: CVE-2021-34268 State: PUBLISHED Published: 2021-07-22T19:47:46 Last Updated: 2024-08-04T00:05:52.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) via a malformed USB device packet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/STMicroelectronics/STM32CubeH7/issues/75
CVE ID: CVE-2021-34270 State: PUBLISHED Published: 2021-08-03T21:24:55 Last Updated: 2024-08-04T00:05:52.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in the mintToken function of a smart contract implementation for Doftcoin Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MRdoulestar/SC-RCVD/blob/main/Vulnerabilities/Doftcoin.md
CVE ID: CVE-2021-34272 State: PUBLISHED Published: 2021-08-03T21:24:57 Last Updated: 2024-08-04T00:05:52.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security flaw in the 'owned' function of a smart contract implementation for RobotCoin (RBTC), a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MRdoulestar/SC-RCVD/blob/main/Vulnerabilities/RobotCoin.md
CVE ID: CVE-2021-34273 State: PUBLISHED Published: 2021-08-03T21:24:59 Last Updated: 2024-08-04T00:05:52.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security flaw in the 'owned' function of a smart contract implementation for BTC2X (B2X), a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MRdoulestar/SC-RCVD/blob/main/Vulnerabilities/BTC2X.md
CVE ID: CVE-2021-34280 State: PUBLISHED Published: 2021-06-08T14:28:29 Last Updated: 2024-08-04T00:05:52.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.dll that may cause a Remote Code Execution. To exploit the vulnerability, someone must open a crafted PDF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dlehgus1023/CVE/tree/master/CVE-2021-34280
CVE ID: CVE-2021-34291 State: PUBLISHED Published: 2021-07-13T11:03:07 Last Updated: 2024-08-04T00:05:52.396Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-787 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12956) Additional Analyst Notes: - CVE Program Container: Ref
ecute code in the context of the current process. (ZDI-CAN-12956) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-870/
CVE ID: CVE-2021-34292 State: PUBLISHED Published: 2021-07-13T11:03:08 Last Updated: 2024-08-04T00:05:52.424Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-125 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12959) Additional Analyst Notes: - CVE Program Container: Refer
ute code in the context of the current process. (ZDI-CAN-12959) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-871/
CVE ID: CVE-2021-34293 State: PUBLISHED Published: 2021-07-13T11:03:10 Last Updated: 2024-08-04T00:05:52.493Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-787 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13020) Additional Analyst Notes: - CVE Program Container: Ref
ecute code in the context of the current process. (ZDI-CAN-13020) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-850/
CVE ID: CVE-2021-34294 State: PUBLISHED Published: 2021-07-13T11:03:11 Last Updated: 2024-08-04T00:05:52.553Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-125 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13023 Additional Analyst Notes: - CVE Program Container: Referenc
e code in the context of the current process. (ZDI-CAN-13023 Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-851/
CVE ID: CVE-2021-34295 State: PUBLISHED Published: 2021-07-13T11:03:12 Last Updated: 2024-08-04T00:05:52.512Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-787 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Gif_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing GIF files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13024) Additional Analyst Notes: - CVE Program Container: Ref
ecute code in the context of the current process. (ZDI-CAN-13024) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-852/
CVE ID: CVE-2021-34296 State: PUBLISHED Published: 2021-07-13T11:03:13 Last Updated: 2024-08-04T00:05:52.570Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-125 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13057) Additional Analyst Notes: - CVE Program Container: Referen
e code in the context of the current process. (ZDI-CAN-13057) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-831/
CVE ID: CVE-2021-34297 State: PUBLISHED Published: 2021-07-13T11:03:14 Last Updated: 2024-08-04T00:05:52.481Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-787 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13059) Additional Analyst Notes: - CVE Program Container: Ref
ecute code in the context of the current process. (ZDI-CAN-13059) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-832/
CVE ID: CVE-2021-34298 State: PUBLISHED Published: 2021-07-13T11:03:15 Last Updated: 2024-08-04T00:05:52.453Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-416 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing BMP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13060) Additional Analyst Notes: - CVE Program Container: References: - https://cert-por
f the current process. (ZDI-CAN-13060) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-872/
CVE ID: CVE-2021-34299 State: PUBLISHED Published: 2021-07-13T11:03:16 Last Updated: 2024-08-04T00:05:52.611Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-126 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-13192) Additional Analyst Notes: - CVE Program Container: R
information in the context of the current process. (ZDI-CAN-13192) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-845/
CVE ID: CVE-2021-34300 State: PUBLISHED Published: 2021-07-13T11:03:17 Last Updated: 2024-08-04T00:05:52.482Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-787 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The Tiff_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out of bounds write past the end of an allocated buffer. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13194) Additional Analyst Notes: - CVE Program Container: Refe
cute code in the context of the current process. (ZDI-CAN-13194) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-846/
CVE ID: CVE-2021-34301 State: PUBLISHED Published: 2021-07-13T11:03:18 Last Updated: 2024-08-04T00:05:52.555Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-416 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing BMP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13196) Additional Analyst Notes: - CVE Program Container: References: - https://cert-por
f the current process. (ZDI-CAN-13196) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-873/
CVE ID: CVE-2021-34302 State: PUBLISHED Published: 2021-07-13T11:03:19 Last Updated: 2024-08-04T00:05:52.571Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-126 Description: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out of bounds read past the end of an allocated buffer. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-13197) Additional Analyst Notes: - CVE Program Container: Ref
nformation in the context of the current process. (ZDI-CAN-13197) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-483182.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-847/