Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-38404 State: PUBLISHED Published: 2021-09-17T18:54:45.055Z Last Updated: 2025-04-23T19:27:36.639Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft 2 Problem Types: CWE-122 Description: Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-252
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02
CVE ID: CVE-2021-38405 State: PUBLISHED Published: 2023-11-21T18:19:10.557Z Last Updated: 2024-08-04T01:37:16.588Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-119 Description: The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF files. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf - https://www.cisa.gov/news-events/ics-advisori
rences: - https://cert-portal.siemens.com/productcert/pdf/ssa-301589.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-22-041-07
CVE ID: CVE-2021-38406 State: PUBLISHED Published: 2021-09-17T18:54:29.386Z Last Updated: 2025-10-21T23:25:32.113Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft 2 Problem Types: CWE-787 Description: Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://us-cert.cisa.gov/ics/advisories/i
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02
CVE ID: CVE-2021-38407 State: PUBLISHED Published: 2021-11-03T19:05:29.498484Z Last Updated: 2024-09-17T00:02:16.946Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-79 Description: Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices, which may allow an attacker to remotely execute code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
CVE ID: CVE-2021-38408 State: PUBLISHED Published: 2021-09-09T11:24:58 Last Updated: 2024-08-04T01:37:16.572Z Vendors: n/a Products: Advantech WebAccess Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-245-03
CVE ID: CVE-2021-38409 State: PUBLISHED Published: 2021-12-20T20:08:46 Last Updated: 2024-08-04T01:37:16.652Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: V-Server Lite, Tellus Lite V-Simulator Problem Types: CWE-824 Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an access of uninitialized pointer, which may allow an attacker read from or write to unexpected memory locations, leading to a denial-of-service. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE ID: CVE-2021-38410 State: PUBLISHED Published: 2022-07-27T20:23:04.000Z Last Updated: 2025-04-17T15:49:43.702Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: AVEVA Products: Platform Common Services (PCS) Portal Problem Types: CVE-427 Description: AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-01 - https://www.av
ainer: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-01 - https://www.aveva.com/en/support-and-success/cyber-security-updates/
CVE ID: CVE-2021-38411 State: PUBLISHED Published: 2021-11-03T19:04:57.862819Z Last Updated: 2024-09-16T23:11:29.456Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-79 Description: Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remotely execute code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
CVE ID: CVE-2021-38412 State: PUBLISHED Published: 2021-09-17T19:07:49.497542Z Last Updated: 2024-09-17T00:06:58.547Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: Digi International Products: PortServer TS 16 Problem Types: CWE-287 Description: Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Rack device do not require authentication or authentication tokens. This vulnerability could allow an attacker to enable the SNMP service and manipulate the community strings to achieve further control in. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ic
achieve further control in. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-257-01
CVE ID: CVE-2021-38413 State: PUBLISHED Published: 2021-12-20T20:08:49 Last Updated: 2024-08-04T01:44:22.252Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: V-Server Lite, Tellus Lite V-Simulator Problem Types: CWE-121 Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to a stack-based buffer overflow, which may allow an attacker to achieve code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE ID: CVE-2021-38415 State: PUBLISHED Published: 2021-12-20T20:08:48 Last Updated: 2024-08-04T01:44:22.244Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: V-Server Lite, Tellus Lite V-Simulator Problem Types: CWE-122 Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable a heap-based buffer overflow when parsing a specially crafted project file, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE ID: CVE-2021-38416 State: PUBLISHED Published: 2021-11-03T19:05:48.466463Z Last Updated: 2024-09-16T18:54:21.395Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-427 Description: Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
CVE ID: CVE-2021-38417 State: PUBLISHED Published: 2022-07-27T20:20:43.000Z Last Updated: 2025-04-17T15:50:29.866Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: VISAM Products: VBASE Pro-RT/ Server-RT (Web Remote) Problem Types: CVE-284 Improper Access Control Description: VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01
CVE ID: CVE-2021-38418 State: PUBLISHED Published: 2021-11-03T19:05:03.549740Z Last Updated: 2024-09-16T19:35:30.633Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-319 Description: Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
CVE ID: CVE-2021-38419 State: PUBLISHED Published: 2021-12-20T20:08:50 Last Updated: 2024-08-04T01:44:22.450Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: V-Server Lite, Tellus Lite V-Simulator Problem Types: CWE-787 Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds write, which can result in data corruption, a system crash, or code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE ID: CVE-2021-38420 State: PUBLISHED Published: 2021-11-03T19:05:35.434770Z Last Updated: 2024-09-16T18:08:35.145Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-427 Description: Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacker to modify the installation directory and upload malicious files. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
CVE ID: CVE-2021-38421 State: PUBLISHED Published: 2021-12-20T20:08:48 Last Updated: 2024-08-04T01:44:22.159Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: V-Server Lite, Tellus Lite V-Simulator Problem Types: CWE-125 Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds read, which may allow an attacker to read sensitive information from other memory locations or cause a crash. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE ID: CVE-2021-38422 State: PUBLISHED Published: 2021-11-03T19:05:10.286502Z Last Updated: 2024-09-16T17:47:43.779Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-312 Description: Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory and escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
CVE ID: CVE-2021-38423 State: PUBLISHED Published: 2022-05-05T15:23:21.000Z Last Updated: 2025-04-16T16:23:18.566Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: GurumNetworks Products: GurumDDS Problem Types: CWE-131 Description: All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02
CVE ID: CVE-2021-38424 State: PUBLISHED Published: 2021-11-03T19:05:22.305682Z Last Updated: 2024-09-16T20:41:42.309Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-1236 Description: The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
CVE ID: CVE-2021-38425 State: PUBLISHED Published: 2022-05-05T15:24:24.000Z Last Updated: 2025-04-16T16:23:11.495Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: eProsima Products: Fast DDS Problem Types: CWE-406 Description: eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood a target device with unwanted traffic, which may result in a denial-of-service condition and information exposure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02 - https://github.com/eProsima/Fast-DD
nrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02 - https://github.com/eProsima/Fast-DDS
CVE ID: CVE-2021-38426 State: PUBLISHED Published: 2021-10-18T12:38:33.374895Z Last Updated: 2024-09-16T20:03:40.188Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: WinProladder Problem Types: CWE-787 Description: FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE ID: CVE-2021-38427 State: PUBLISHED Published: 2022-05-05T15:25:21.000Z Last Updated: 2025-04-16T16:23:03.124Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: RTI Products: Connext DDS Professional, Connext DDS Secure Problem Types: CWE-121 Description: RTI Connext DDS Professional and Connext DDS Secure Versions 4.2.x to 6.1.0 are vulnerable to a stack-based buffer overflow, which may allow a local attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02 - https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2F
CVE ID: CVE-2021-38428 State: PUBLISHED Published: 2021-11-03T19:05:41.591359Z Last Updated: 2024-09-17T02:56:47.240Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-79 Description: Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
CVE ID: CVE-2021-38429 State: PUBLISHED Published: 2022-05-05T15:26:18.000Z Last Updated: 2025-04-16T16:22:55.082Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: OCI Products: OpenDDS Problem Types: CWE-406 Description: OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target devices with unwanted traffic, which may result in a denial-of-service condition and information exposure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02 - https://opendds.org/
CVE ID: CVE-2021-38430 State: PUBLISHED Published: 2021-10-18T12:38:28.447427Z Last Updated: 2024-09-16T16:53:33.583Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: WinProladder Problem Types: CWE-121 Description: FATEK Automation WinProladder versions 3.30 and prior proper validation of user-supplied data when parsing project files, which could result in a stack-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE ID: CVE-2021-38431 State: PUBLISHED Published: 2021-10-15T12:29:48.409422Z Last Updated: 2024-09-16T18:28:58.187Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Advantech Products: WebAccess SCADA Problem Types: CWE-862 Description: An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-285-01
CVE ID: CVE-2021-38432 State: PUBLISHED Published: 2021-10-15T14:13:54.937998Z Last Updated: 2024-09-16T18:54:26.198Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: Communication Server Problem Types: CWE-121 Description: FATEK Automation Communication Server Versions 1.13 and prior lacks proper validation of user-supplied data, which could result in a stack-based buffer overflow condition and allow an attacker to remotely execute code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-280-07
CVE ID: CVE-2021-38433 State: PUBLISHED Published: 2022-05-05T15:27:08.000Z Last Updated: 2025-04-16T16:22:48.159Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: RTI Products: Connext DDS Professional, Connext DDS Secure Problem Types: CWE-121 Description: RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 vulnerable to a stack-based buffer overflow, which may allow a local attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02 - https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2F
CVE ID: CVE-2021-38434 State: PUBLISHED Published: 2021-10-18T12:38:53.598755Z Last Updated: 2024-09-16T22:39:58.739Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: WinProladder Problem Types: CWE-194 Description: FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an unexpected sign extension. An attacker could leverage this vulnerability to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE ID: CVE-2021-38435 State: PUBLISHED Published: 2022-05-05T15:27:58.000Z Last Updated: 2025-04-16T16:22:40.873Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: RTI Products: Connext DDS Professional, Connext DDS Secure Problem Types: CWE-131 Description: RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, which may result in a buffer overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02 - https://support.rti.com/s/login/?ec=302&startURL=%2Fs%2F
CVE ID: CVE-2021-38436 State: PUBLISHED Published: 2021-10-18T12:39:07.705556Z Last Updated: 2024-09-17T01:22:08.017Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: WinProladder Problem Types: CWE-119 Description: FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a memory-corruption condition. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE ID: CVE-2021-38438 State: PUBLISHED Published: 2021-10-18T12:39:01.079974Z Last Updated: 2024-09-16T20:58:00.669Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: WinProladder Problem Types: CWE-416 Description: A use after free vulnerability in FATEK Automation WinProladder versions 3.30 and prior may be exploited when a valid user opens a malformed project file, which may allow arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE ID: CVE-2021-38439 State: PUBLISHED Published: 2022-05-05T15:14:38.000Z Last Updated: 2025-04-16T16:24:16.450Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: GurumNetworks Products: GurumDDS Problem Types: CWE-122 Description: All versions of GurumDDS are vulnerable to heap-based buffer overflow, which may cause a denial-of-service condition or remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02
CVE ID: CVE-2021-38440 State: PUBLISHED Published: 2021-10-18T12:38:47.229996Z Last Updated: 2024-09-17T04:09:30.941Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: FATEK Automation Products: WinProladder Problem Types: CWE-125 Description: FATEK Automation WinProladder versions 3.30 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to read unauthorized information. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06
CVE ID: CVE-2021-38441 State: PUBLISHED Published: 2022-05-05T15:15:57.000Z Last Updated: 2025-04-16T16:24:09.254Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Eclipse Products: CycloneDDS Problem Types: CWE-123 Description: Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-315-02 - https://projects.eclipse.org/projects/iot.cyclonedds
CVE ID: CVE-2021-38442 State: PUBLISHED Published: 2021-10-18T12:38:40.737727Z Last Updated: 2024-09-16T22:55:38.055Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: WinProladder Problem Types: CWE-119 Description: FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a heap-corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-280-06