Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-32996 State: PUBLISHED Published: 2022-01-07T22:39:08.821Z Last Updated: 2025-04-17T18:48:35.554Z Vendors: FANUC Products: R-30iA, R-30iA Mate, R-30iB, R-30iB Mate, R-30iB Compact, R-30iB Plus, R-30iB Mate Plus, R-30iB Compact Plus, R-30iB Mini Plus Problem Types: CWE-192 Description: The FANUC R-30iA and R-30iB series controllers are vulnerable to integer coercion errors, which cause the device to crash. A restart is required. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-243-02
CVE ID: CVE-2021-32997 State: PUBLISHED Published: 2022-05-25T13:33:43.000Z Last Updated: 2025-04-16T16:18:14.096Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Bentley Nevada, a Baker Hughes subsidiary Products: 3500 System 1 6.x, Part No. 3060/00, 3500 System 1, Part No. 3071/xx & 3072/xx, 3500 Rack Configuration, Part No. 129133-01, 3500/22M Firmware, Part No. 288055-01 Problem Types: CWE-916 Description: The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and
. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500/22M Firmware, Part No. 288055-01 versions 5.05 and prior) utilize a weak encryption algorithm for storage and transmission of sensitive data, which may allow an attacker to more easily obtain credentials used for access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-231-02
CVE ID: CVE-2021-32998 State: PUBLISHED Published: 2022-01-07T22:39:09.663Z Last Updated: 2025-04-17T18:48:26.223Z Vendors: FANUC Products: R-30iA, R-30iA Mate, R-30iB, R-30iB Mate, R-30iB Compact, R-30iB Plus, R-30iB Mate Plus, R-30iB Compact Plus, R-30iB Mini Plus Problem Types: CWE-787 Description: The FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. INIT START/restore from backup required. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-243-02
CVE ID: CVE-2021-32999 State: PUBLISHED Published: 2021-09-23T13:33:13.193968Z Last Updated: 2024-09-16T16:27:33.462Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AVEVA Software, LLC Products: AVEVA System Platform 2020, AVEVA InTouch 2020, AVEVA Historian 2020, AVEVA Communication Drivers Pack 2020, AVEVA Batch Management 2020, AVEVA MES 2014 Problem Types: CWE-755 Description: Improper handling of exceptional conditions in SuiteLink server while processing command 0x01 Additional Analyst Notes: - CVE Program Container: References: - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-003.pdf
CVE ID: CVE-2021-33000 State: PUBLISHED Published: 2021-06-24T17:30:20 Last Updated: 2024-08-03T23:42:19.123Z Vendors: n/a Products: WebAccess HMI Designer Problem Types: CWE-122 Description: Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code execution. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01
CVE ID: CVE-2021-33001 State: PUBLISHED Published: 2022-05-16T17:52:30.861Z Last Updated: 2025-04-16T16:21:09.406Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: xArrow Products: xArrow SCADA Problem Types: CWE-79 Description: xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03
CVE ID: CVE-2021-33002 State: PUBLISHED Published: 2021-06-24T17:38:19 Last Updated: 2024-08-03T23:42:19.122Z Vendors: n/a Products: WebAccess HMI Designer Problem Types: CWE-787 Description: Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. User interaction is require on the WebAccess HMI Designer (versions 2.1.9.95 and prior). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01
CVE ID: CVE-2021-33003 State: PUBLISHED Published: 2021-08-30T17:10:59 Last Updated: 2024-08-03T23:42:19.603Z Vendors: n/a Products: Delta Electronics DIAEnergie Problem Types: CWE-916 Description: Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03
CVE ID: CVE-2021-33004 State: PUBLISHED Published: 2021-06-24T17:34:07 Last Updated: 2024-08-03T23:42:19.880Z Vendors: n/a Products: WebAccess HMI Designer Problem Types: CWE-119 Description: The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to execute arbitrary code. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior). Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01
CVE ID: CVE-2021-33005 State: PUBLISHED Published: 2022-05-13T15:18:40.002Z Last Updated: 2025-04-16T16:21:55.101Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: mySCADA Products: myPRO Problem Types: CWE-22 Description: mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary directories. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-217-03 - https://www.myscada.org/version-8-20-0-released-security-update
CVE ID: CVE-2021-33007 State: PUBLISHED Published: 2021-08-30T16:29:39 Last Updated: 2024-08-03T23:42:19.138Z Vendors: n/a Products: Delta Electronics TPEditor Problem Types: CWE-122 Description: A heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-236-03
CVE ID: CVE-2021-33008 State: PUBLISHED Published: 2022-04-04T19:45:51.000Z Last Updated: 2025-04-16T17:56:37.416Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AVEVA Products: AVEVA System Platform Problem Types: CWE-306 Description: AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requires a provable user identity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05 - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf
CVE ID: CVE-2021-33009 State: PUBLISHED Published: 2022-05-13T15:19:06.387Z Last Updated: 2025-04-16T16:21:47.203Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: mySCADA Products: myPRO Problem Types: CWE-434 Description: mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-217-03 - https://www.myscada.org/version-8-20-0-released-security-update
CVE ID: CVE-2021-33010 State: PUBLISHED Published: 2022-04-04T19:45:48.000Z Last Updated: 2025-04-16T16:32:04.533Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: AVEVA Products: AVEVA System Platform Problem Types: CWE-248 Description: An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught, which may cause a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05 - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.
0-05 - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdf
CVE ID: CVE-2021-33011 State: PUBLISHED Published: 2021-09-10T11:28:07 Last Updated: 2024-08-03T23:42:19.259Z Vendors: n/a Products: JTEKT Corporation TOYOPUC products Problem Types: CWE-770 Description: All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series products may not be able to properly process an ICMP flood, which may allow an attacker to deny Ethernet communications between affected devices. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-245-02
CVE ID: CVE-2021-33012 State: PUBLISHED Published: 2021-07-09T14:03:55 Last Updated: 2024-08-03T23:42:19.616Z Vendors: n/a Products: Rockwell Automation MicroLogix 1100 Problem Types: CWE-20 Description: Rockwell Automation MicroLogix 1100, all versions, allows a remote, unauthenticated attacker sending specially crafted commands to cause the PLC to fault when the controller is switched to RUN mode, which results in a denial-of-service condition. If successfully exploited, this vulnerability will cause the controller to fault whenever the controller is switched to RUN mode. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-189-01
CVE ID: CVE-2021-33013 State: PUBLISHED Published: 2022-05-13T15:19:35.805Z Last Updated: 2025-04-16T16:21:39.950Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: mySCADA Products: myPRO Problem Types: CWE-284 Description: mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-217-03 - https://www.myscada.org/version-8-20-0-released-security-update
CVE ID: CVE-2021-33014 State: PUBLISHED Published: 2022-05-26T16:33:08.000Z Last Updated: 2025-04-16T17:53:08.881Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: KUKA Products: KR C4, KSS (KUKA.SystemSoftware) Problem Types: CWE-798 Description: An attacker can gain VxWorks Shell after login due to hard-coded credentials on a KUKA KR C4 control software for versions prior to 8.7 or any product running KSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-01
CVE ID: CVE-2021-33015 State: PUBLISHED Published: 2021-08-25T18:13:26 Last Updated: 2024-08-03T23:42:18.963Z Vendors: n/a Products: Cscape Problem Types: CWE-824 Description: Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write via an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-224-02
CVE ID: CVE-2021-33016 State: PUBLISHED Published: 2022-05-26T16:32:36.000Z Last Updated: 2025-04-16T16:18:06.589Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: KUKA Products: KR C4, KSS (KUKA.SystemSoftware) Problem Types: CWE-798 Description: An attacker can gain full access (read/write/delete) to sensitive folders due to hard-coded credentials on KUKA KR C4 control software for versions prior to 8.7 or any product running KSS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-01
CVE ID: CVE-2021-33017 State: PUBLISHED Published: 2021-12-27T18:48:21.413430Z Last Updated: 2024-09-16T20:16:50.573Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Philips Products: IntelliBridge EC 40 Hub, IntelliBridge EC 80 Hub Problem Types: CWE-288 Description: The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-322-01
CVE ID: CVE-2021-33018 State: PUBLISHED Published: 2022-04-01T22:17:21.000Z Last Updated: 2025-04-16T17:58:08.329Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Philips Products: Vue PACS, Vue MyVue, Vue Speech, Vue Motion Problem Types: CWE-327 Description: The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 - http://www.philips.com/productsecurity
CVE ID: CVE-2021-33019 State: PUBLISHED Published: 2021-08-30T17:09:35 Last Updated: 2024-08-03T23:42:18.999Z Vendors: n/a Products: Delta Electronics DOPSoft Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a specially crafted project file, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-238-04 - https://www.zerodayinitiative.com/advisories/ZDI-21-1059/
CVE ID: CVE-2021-33020 State: PUBLISHED Published: 2022-04-01T22:17:17.000Z Last Updated: 2025-04-16T16:33:04.592Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Philips Products: Vue PACS, Vue MyVue, Vue Speech, Vue Motion Problem Types: CWE-324 Description: Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 - http://www.philips.com/productsecur
richment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 - http://www.philips.com/productsecurity
CVE ID: CVE-2021-33021 State: PUBLISHED Published: 2022-05-16T17:53:01.000Z Last Updated: 2025-04-16T16:21:01.016Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: xArrow Products: xArrow SCADA Problem Types: CWE-79 Description: xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03
CVE ID: CVE-2021-33022 State: PUBLISHED Published: 2022-04-01T22:17:20.000Z Last Updated: 2025-04-16T16:32:46.240Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Philips Products: Vue PACS, Vue MyVue, Vue Speech, Vue Motion Problem Types: CWE-319 Description: Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 - http://www.philips.com/productsecurity
CVE ID: CVE-2021-33023 State: PUBLISHED Published: 2021-10-18T12:41:08.470089Z Last Updated: 2024-09-17T03:49:19.278Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: WebAccess Problem Types: CWE-122 Description: Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-285-02
CVE ID: CVE-2021-33024 State: PUBLISHED Published: 2022-04-01T22:17:18.000Z Last Updated: 2025-04-16T16:32:54.151Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Philips Products: Vue PACS, Vue MyVue, Vue Speech, Vue Motion Problem Types: CWE-522 Description: Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or retrieval. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 - http://www.philips.com/productsecurity
CVE ID: CVE-2021-33025 State: PUBLISHED Published: 2022-05-16T17:53:33.333Z Last Updated: 2025-04-16T16:20:53.298Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: xArrow Products: xArrow SCADA Problem Types: CWE-79 Description: xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-229-03
CVE ID: CVE-2021-33026 State: PUBLISHED Published: 2021-05-13T22:51:20 Last Updated: 2024-08-03T23:42:19.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code. NOTE: a third party indicates that exploitation is extremely unlikely unless the machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and gen
machine is already compromised; in other cases, the attacker would be unable to write their payload to the cache and generate the required collision Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/sh4nks/flask-caching/pull/209 - https://github.com/pallets-eco/flask-caching/pull/209#issuecomment-1136397937
CVE ID: CVE-2021-33027 State: PUBLISHED Published: 2021-07-19T11:52:00 Last Updated: 2024-08-03T23:42:19.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/sylabs - https://support.sylabs.io/a/solutions/articles/42000086439
CVE ID: CVE-2021-33031 State: PUBLISHED Published: 2021-06-10T15:28:01 Last Updated: 2024-08-03T23:42:19.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email address if the attacker knows details of the victim such as the exact roles and group roles, ID, and remote authentication ID settings. These must be sent in a modified save API request. It was fixed in 6.3.0.03. Additional Analyst
hentication ID settings. These must be sent in a modified save API request. It was fixed in 6.3.0.03. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md - https://labcup.net/privacy-data-security/
CVE ID: CVE-2021-33032 State: PUBLISHED Published: 2021-07-22T17:45:35 Last Updated: 2024-08-03T23:42:19.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://novag.github.io/posts/homematic-unauthenticated-remote-code-execution/ - https://www.eq-3.de/downloads/software/HM-CCU2-Firmware_Updates/HM-CCU-2.59.7/HM-CCU2-Change
ed-remote-code-execution/ - https://www.eq-3.de/downloads/software/HM-CCU2-Firmware_Updates/HM-CCU-2.59.7/HM-CCU2-Changelog.2.59.7.pdf - https://www.eq-3.de/downloads/software/firmware/ccu3-firmware/CCU3-Changelog.3.59.6.pdf
CVE ID: CVE-2021-33033 State: PUBLISHED Published: 2021-05-14T22:57:17 Last Updated: 2024-08-03T23:42:19.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.7 - https://syzkaller.appspot.com/bug?id=96e7d345748d8814901c91cd92084ed04b46701e - https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-cipso_v4_gen
7d345748d8814901c91cd92084ed04b46701e - https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-cipso_v4_genopt - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ad5d07f4a9cd671233ae20983848874731102c08 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1165affd484889d4986cf3b724318935a0b120d8 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.14
CVE ID: CVE-2021-33034 State: PUBLISHED Published: 2021-05-14T22:57:07 Last Updated: 2024-08-03T23:42:19.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. Additional Analyst Notes: - CVE Program Container: References: - https://syzkaller.appspot.com/bug?id=2e1943a94647f7732dd6fc60368642d6e8dc91b1 - https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-hci_send_acl - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5c4c8c9544099bb9043a10a5318130a943e32fc3 - https:/
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5c4c8c9544099bb9043a10a5318130a943e32fc3 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GI7Z7UBWBGD3ABNIL2DC7RQDCGA4UVQW/ - https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html - https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html