Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-27388 State: PUBLISHED Published: 2021-06-15T19:40:24 Last Updated: 2024-08-03T20:48:16.713Z Vendors: n/a Products: SINAMICS Medium Voltage Products, Remote Access Problem Types: CWE-20 Description: SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated attacker to cause a denial-of-service condition, and/or execution of limited configuration modifications and/or execution of limited control commands on the SINAMICS Medium Voltage Products, Remote Access (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions). Additional Analyst Notes: - C
INAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-131-04
CVE ID: CVE-2021-27389 State: PUBLISHED Published: 2021-04-22T20:42:21 Last Updated: 2024-08-03T20:48:16.625Z Vendors: Siemens Products: Opcenter Quality, QMS Automotive Problem Types: CWE-321 Description: A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the product without adequate protection. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-788287.pdf
CVE ID: CVE-2021-27390 State: PUBLISHED Published: 2021-06-08T19:47:16 Last Updated: 2024-08-03T20:48:16.964Z Vendors: Siemens Products: JT2Go, Teamcenter Visualization Problem Types: CWE-787 Description: A vulnerability has been identified in JT2Go (All versions < V13.1.0.3), Teamcenter Visualization (All versions < V13.1.0.3). The TIFF_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13131) Additional Analyst Notes: - CVE Program Cont
lity to execute code in the context of the current process. (ZDI-CAN-13131) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-645530.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-694/
CVE ID: CVE-2021-27391 State: PUBLISHED Published: 2021-09-14T10:47:31.000Z Last Updated: 2025-04-23T19:28:38.162Z Vendors: Siemens Products: APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (P2 Ethernet), APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), TALON TC Compact (BACnet), TALON TC Modular (BACnet) Problem Types: CWE-120 Description: A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modul
PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cer
h root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-944498.pdf
CVE ID: CVE-2021-27392 State: PUBLISHED Published: 2021-04-22T20:42:21 Last Updated: 2024-08-03T20:48:16.928Z Vendors: Siemens Products: Siveillance Video Open Network Bridge Problem Types: CWE-321 Description: A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for t
e (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf
CVE ID: CVE-2021-27393 State: PUBLISHED Published: 2021-04-22T20:42:21 Last Updated: 2024-08-03T20:48:16.739Z Vendors: Siemens Products: Nucleus NET, Nucleus ReadyStart V3, Nucleus Source Code Problem Types: CWE-330 Description: A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2013.08), Nucleus Source Code (Versions including affected DNS modules). The DNS client does not properly randomize UDP port numbers of DNS requests. That could allow an attacker to poison the DNS cache or spoof DNS resolving. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-201384.pdf
CVE ID: CVE-2021-27394 State: PUBLISHED Published: 2021-04-16T20:00:14 Last Updated: 2024-08-03T20:48:16.703Z Vendors: Siemens Products: Mendix Applications using Mendix 7, Mendix Applications using Mendix 8, Mendix Applications using Mendix 8 (V8.12), Mendix Applications using Mendix 8 (V8.6), Mendix Applications using Mendix 9 Problem Types: CWE-269 Description: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.19), Mendix Applications using Mendix 8 (All versions < V8.17.0), Mendix Applications using Mendix 8 (V8.12) (All versions < V8.12.5), Mendix Applications using Mendix 8 (V8.6) (All versions < V8.6.9), Mendix Applications using Mendix 9
sions < V8.12.5), Mendix Applications using Mendix 8 (V8.6) (All versions < V8.6.9), Mendix Applications using Mendix 9 (All versions < V9.0.5). Authenticated, non-administrative users could modify their privileges by manipulating the user role under certain circumstances, allowing them to gain administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-875726.pdf
CVE ID: CVE-2021-27395 State: PUBLISHED Published: 2021-10-12T09:49:20 Last Updated: 2024-08-03T20:48:16.821Z Vendors: Siemens Products: SIMATIC Process Historian 2013 and earlier, SIMATIC Process Historian 2014, SIMATIC Process Historian 2019, SIMATIC Process Historian 2020 Problem Types: CWE-306 Description: A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to mal
n the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-766247.pdf
CVE ID: CVE-2021-27396 State: PUBLISHED Published: 2021-05-12T13:18:23 Last Updated: 2024-08-03T20:48:16.848Z Vendors: Siemens Products: Tecnomatix Plant Simulation Problem Types: CWE-121 Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a stack based buffer overflow, a different vulnerability than CVE-2021-27398. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13279) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemen
ent process. (ZDI-CAN-13279) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-568/
CVE ID: CVE-2021-27397 State: PUBLISHED Published: 2021-05-12T13:18:23 Last Updated: 2024-08-03T20:48:16.678Z Vendors: Siemens Products: Tecnomatix Plant Simulation Problem Types: CWE-119 Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13287) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdf - https://
Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-569/
CVE ID: CVE-2021-27398 State: PUBLISHED Published: 2021-05-12T13:18:23 Last Updated: 2024-08-03T20:48:16.969Z Vendors: Siemens Products: Tecnomatix Plant Simulation Problem Types: CWE-121 Description: A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a stack based buffer overflow, a different vulnerability than CVE-2021-27396. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13290) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemen
ent process. (ZDI-CAN-13290) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-983548.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-570/
CVE ID: CVE-2021-27399 State: PUBLISHED Published: 2021-06-08T19:47:16 Last Updated: 2024-08-03T20:48:16.662Z Vendors: Siemens Products: Simcenter Femap 2020.2, Simcenter Femap 2021.1 Problem Types: CWE-787 Description: A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27387. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-
E-2021-27387. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12820) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-133038.pdf - https://www.zerodayinitiative.com/advisories/ZDI-21-781/
CVE ID: CVE-2021-27400 State: PUBLISHED Published: 2021-04-22T16:48:07 Last Updated: 2024-08-03T20:48:16.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1 Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2021-10-vault-s-cassandra-integrations-did-not-validate-tls-certificates/23463
CVE ID: CVE-2021-27401 State: PUBLISHED Published: 2021-08-13T15:18:28 Last Updated: 2024-08-03T20:48:16.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due to insufficient input validation, aka Cross-Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0004
CVE ID: CVE-2021-27402 State: PUBLISHED Published: 2021-08-13T15:25:36 Last Updated: 2024-08-03T20:48:16.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0004
CVE ID: CVE-2021-27403 State: PUBLISHED Published: 2021-02-19T03:53:19 Last Updated: 2024-08-03T20:48:16.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bokanrb/XSS-Askey
CVE ID: CVE-2021-27404 State: PUBLISHED Published: 2021-02-19T03:53:07 Last Updated: 2024-08-03T20:48:16.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bokanrb/HostHeaderInjection-Askey
CVE ID: CVE-2021-27405 State: PUBLISHED Published: 2021-02-19T04:03:48 Last Updated: 2024-08-03T20:48:16.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/progfay/scrapbox-parser/pull/519 - https://github.com/progfay/scrapbox-parser/pull/539 - https://github.com/progfay/scrapbox-parser/pull/540 - https://security.netapp.com/advisory/ntap-20210326-0002/
CVE ID: CVE-2021-27406 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-04-16T17:46:31.383Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PerFact Products: OpenVPN-Client Problem Types: CWE-15 Description: An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host machine to force the back-end server into initializing a new open-VPN instance with arbitrary open-VPN configuration. This could result in the attacker achieving execution with privileges of a SYSTEM user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
g execution with privileges of a SYSTEM user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-056-01
CVE ID: CVE-2021-27408 State: PUBLISHED Published: 2021-06-11T16:31:58 Last Updated: 2024-08-03T20:48:16.852Z Vendors: n/a Products: Welch Allyn medical device management tools Problem Types: CWE-125 Description: The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central
: versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-21-152-01
CVE ID: CVE-2021-27410 State: PUBLISHED Published: 2021-06-11T16:33:21 Last Updated: 2024-08-03T20:48:16.754Z Vendors: n/a Products: Welch Allyn medical device management tools Problem Types: CWE-787 Description: The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monit
K): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-21-152-01
CVE ID: CVE-2021-27411 State: PUBLISHED Published: 2022-05-03T20:18:42.000Z Last Updated: 2025-04-16T16:25:25.119Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Micrium Products: Micrium OS Problem Types: CWE-190 Description: Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as very small blocks of memory being allocated instead of very large ones. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.c
very large ones. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04 - https://www.silabs.com/developers/micrium-os
CVE ID: CVE-2021-27412 State: PUBLISHED Published: 2021-07-02T10:52:04 Last Updated: 2024-08-03T20:48:16.918Z Vendors: n/a Products: Delta Electronics DOPSoft Problem Types: CWE-125 Description: Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-182-03
CVE ID: CVE-2021-27413 State: PUBLISHED Published: 2021-05-13T18:56:33 Last Updated: 2024-08-03T20:48:16.891Z Vendors: n/a Products: Omron CX-One Problem Types: CWE-121 Description: Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-21-588/ - https://us-cert.cisa.gov/ics/advisories/icsa-21-131-01
CVE ID: CVE-2021-27414 State: PUBLISHED Published: 2022-03-11T17:54:00.000Z Last Updated: 2025-04-16T16:43:12.665Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Hitachi ABB Power Grids Products: Ellipse Enterprise Asset Management (EAM) Problem Types: CWE-451 Description: An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a malicious website posing as a login page for the Ellipse application and gather authentication credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/adviso
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-01 - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-27416 State: PUBLISHED Published: 2022-03-11T17:53:59.000Z Last Updated: 2025-04-16T16:43:21.752Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Hitachi ABB Power Grids Products: Ellipse Enterprise Asset Management (EAM) Problem Types: CWE-79 Description: An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of confidential information, or even the takeover of the user’s session. Additional Analyst Notes:
ult in the compromise of confidential information, or even the takeover of the user’s session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-01 - https://search.abb.com/library/Download.aspx?DocumentID=9AKK107991A7777&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2021-27417 State: PUBLISHED Published: 2022-05-03T20:17:54.000Z Last Updated: 2025-04-16T16:25:33.142Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:H) Vendors: eCosCentric Products: eCosPro RTOS Problem Types: CWE-190 Description: eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04 - https://bugzilla.ecoscen
ISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04 - https://bugzilla.ecoscentric.com/show_bug.cgi?id=1002437
CVE ID: CVE-2021-27418 State: PUBLISHED Published: 2022-03-23T19:46:23.000Z Last Updated: 2025-04-16T16:41:07.211Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: GE Products: UR family Problem Types: CWE-20 Description: GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/
strings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02 - https://www.gegridsolutions.com/Passport/Login.aspx