Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-38362 State: PUBLISHED Published: 2022-03-30T21:43:55 Last Updated: 2024-08-04T01:37:16.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: In RSA Archer 6.x through 6.9 SP3 (6.9.3.0), an authenticated attacker can make a GET request to a REST API endpoint that is vulnerable to an Insecure Direct Object Reference (IDOR) issue and retrieve sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fireeye/Vulnerability-Disclosures - https://www.archerirm.community/t5/security-advisories/archer-an-rsa-business-update-for-multiple-vulnerabilities/ta-p/674497 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/
ess-update-for-multiple-vulnerabilities/ta-p/674497 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0021/MNDT-2022-0021.md
CVE ID: CVE-2021-38363 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:17:36.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONOS 2.5.1. In IntentManager, the install-requested intent (which causes an exception) remains in pendingMap (in memory) forever. Deletion is possible neither by a user nor by the intermittent Intent Cleanup process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://opennetworking.org/onos/ - https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf
CVE ID: CVE-2021-38364 State: PUBLISHED Published: 2023-04-20T00:00:00.000Z Last Updated: 2025-02-05T15:16:33.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently modify or delete the existing flow rules related to other intents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://opennetworking.org/onos/ - https://www.usenix.org/system/files/sec23fall-prepub-285_kim-jiwon.pdf
CVE ID: CVE-2021-38365 State: PUBLISHED Published: 2021-08-10T13:18:48 Last Updated: 2024-08-04T01:37:16.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Winner (aka ToneWinner) desktop speakers through 2021-08-09 allow remote attackers to recover speech signals from the power-indicator LED via a telescope and an electro-optical sensor, aka a "Glowworm" attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.nassiben.com/glowworm-attack - http://www.tonewinner.com
CVE ID: CVE-2021-38366 State: PUBLISHED Published: 2021-08-12T20:22:53 Last Updated: 2024-08-04T01:37:16.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL. Additional Analyst Notes: - CVE Program Container: References: - https://blog.istern.dk/2021/08/10/sitecore-10-authenticated-file-upload-to-rce/
CVE ID: CVE-2021-38370 State: PUBLISHED Published: 2021-08-10T00:00:00 Last Updated: 2024-08-04T01:37:16.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS. Additional Analyst Notes: - CVE Program Container: References: - https://nostarttls.secvuln.info - https://alpine.x10host.com - https://bugs.gentoo.org/807613#c4 - https://security.gentoo.org/glsa/202301-07
CVE ID: CVE-2021-38371 State: PUBLISHED Published: 2021-08-10T14:06:09.000Z Last Updated: 2025-11-03T21:45:12.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending. Additional Analyst Notes: - CVE Program Container: References: - https://nostarttls.secvuln.info - https://www.exim.org - https://www.exim.org/static/doc/security/CVE-2021-38371.txt
CVE ID: CVE-2021-38372 State: PUBLISHED Published: 2021-08-10T14:51:05 Last Updated: 2024-08-04T01:37:16.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS. Additional Analyst Notes: - CVE Program Container: References: - https://nostarttls.secvuln.info - https://bugs.kde.org/show_bug.cgi?id=432353
CVE ID: CVE-2021-38373 State: PUBLISHED Published: 2021-08-10T14:51:25 Last Updated: 2024-08-04T01:37:16.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked. Additional Analyst Notes: - CVE Program Container: References: - https://nostarttls.secvuln.info - https://bugs.kde.org/show_bug.cgi?id=423423
CVE ID: CVE-2021-38374 State: PUBLISHED Published: 2021-11-22T08:38:06 Last Updated: 2024-08-04T01:37:16.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - http://seclists.org/fulldisclosure/2021/Nov/43 - http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html - http://seclists.org/fulldisclosure/2022/Jul/11 - http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting
ldisclosure/2022/Jul/11 - http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
CVE ID: CVE-2021-38375 State: PUBLISHED Published: 2021-11-22T08:40:38 Last Updated: 2024-08-04T01:37:16.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - https://seclists.org/fulldisclosure/2021/Nov/43 - http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html
CVE ID: CVE-2021-38376 State: PUBLISHED Published: 2021-11-22T08:43:36 Last Updated: 2024-08-04T01:37:16.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - https://seclists.org/fulldisclosure/2021/Nov/43 - http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html
CVE ID: CVE-2021-38377 State: PUBLISHED Published: 2021-11-22T08:51:24 Last Updated: 2024-08-04T01:37:16.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - https://seclists.org/fulldisclosure/2021/Nov/43 - http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html
CVE ID: CVE-2021-38378 State: PUBLISHED Published: 2021-11-22T08:54:35 Last Updated: 2024-08-04T01:37:16.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name. Additional Analyst Notes: - CVE Program Container: References: - https://www.open-xchange.com - https://seclists.org/fulldisclosure/2021/Nov/43 - http://packetstormsecurity.com/files/165038/OX-App-Suite-7.10.5-Cross-Site-Scripting-Information-Disclosure.html
CVE ID: CVE-2021-38379 State: PUBLISHED Published: 2021-10-27T14:25:52 Last Updated: 2024-08-04T01:37:16.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://docs.cfengine.com/docs/3.18/enterprise-cfengine-guide.html - https://cfengine.com/blog/2021/cve-2021-38379-and-cve-2021-36756/
CVE ID: CVE-2021-38380 State: PUBLISHED Published: 2021-08-10T17:16:22 Last Updated: 2024-08-04T01:37:16.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack. Additional Analyst Notes: - CVE Program Container: References: - http://lists.live555.com/pipermail/live-devel/2021-August/021954.html - http://www.live555.com/liveMedia/public/changelog.txt#%5B2021.08.04%5D
CVE ID: CVE-2021-38381 State: PUBLISHED Published: 2021-08-10T17:16:11 Last Updated: 2024-08-04T01:37:16.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash. Additional Analyst Notes: - CVE Program Container: References: - http://lists.live555.com/pipermail/live-devel/2021-August/021961.html - http://www.live555.com/liveMedia/public/changelog.txt#%5B2021.08.09%5D
CVE ID: CVE-2021-38382 State: PUBLISHED Published: 2021-08-10T17:15:59 Last Updated: 2024-08-04T01:37:16.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash. Additional Analyst Notes: - CVE Program Container: References: - http://lists.live555.com/pipermail/live-devel/2021-August/021959.html - http://www.live555.com/liveMedia/public/changelog.txt#%5B2021.08.06%5D
CVE ID: CVE-2021-38383 State: PUBLISHED Published: 2021-08-10T17:14:47 Last Updated: 2024-08-04T01:37:16.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/owntone/owntone-server/commit/246d8ae0cef27377e5dfe9ee3ad87e864d6b6266
CVE ID: CVE-2021-38384 State: PUBLISHED Published: 2021-08-10T17:35:41 Last Updated: 2024-08-04T01:37:16.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dherault/serverless-offline/issues/1259
CVE ID: CVE-2021-38385 State: PUBLISHED Published: 2021-08-30T00:00:00 Last Updated: 2024-08-04T01:37:16.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007. Additional Analyst Notes: - CVE Program Container: References: - https://blog.torproject.org - https://blog.torproject.org/node/2062 - https://bugs.torproject.org/tpo/core/tor/40078 - https://security.gentoo.org/glsa/202305-11
CVE ID: CVE-2021-38386 State: PUBLISHED Published: 2021-08-10T18:59:39 Last Updated: 2024-08-04T01:37:16.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Contiki 3.0, a buffer overflow in the Telnet service allows remote attackers to cause a denial of service because the ls command is mishandled when a directory has many files with long names. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-os/contiki/issues/2687
CVE ID: CVE-2021-38387 State: PUBLISHED Published: 2021-08-10T18:59:23 Last Updated: 2024-08-04T01:37:16.521Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop and waiting forever, which may cause excessive CPU consumption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/contiki-os/contiki/issues/2688
CVE ID: CVE-2021-38388 State: PUBLISHED Published: 2021-09-08T17:50:45 Last Updated: 2025-05-12T01:31:17.817Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: LINE Corporation Products: Central Dogma Problem Types: n/a Description: Central Dogma allows privilege escalation with mirroring to the internal dogma repository that has a file managing the authorization of the project. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/line/centraldogma/pull/621
CVE ID: CVE-2021-38389 State: PUBLISHED Published: 2021-10-18T12:41:14.173603Z Last Updated: 2024-09-16T22:24:38.131Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: WebAccess Problem Types: CWE-121 Description: Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-285-02
CVE ID: CVE-2021-38390 State: PUBLISHED Published: 2021-08-30T17:33:30 Last Updated: 2024-08-04T01:37:16.567Z Vendors: n/a Products: Delta Electronics DIAEnergie Problem Types: CWE-89 Description: A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER. Additional Analyst Notes: - CVE Program Container: References: - https://us-ce
in the context of NT SERVICE\MSSQLSERVER. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03
CVE ID: CVE-2021-38391 State: PUBLISHED Published: 2021-08-30T17:30:50 Last Updated: 2024-08-04T01:37:16.565Z Vendors: n/a Products: Delta Electronics DIAEnergie Problem Types: CWE-89 Description: A Blind SQL injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.ci
e context of NT SERVICE\MSSQLSERVER. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03
CVE ID: CVE-2021-38392 State: PUBLISHED Published: 2021-10-04T17:35:13.879926Z Last Updated: 2024-09-17T03:33:08.540Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L) Vendors: Boston Scientific Products: ZOOM LATITUDE Problem Types: CWE-284 Description: A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to change the telemetry region and could use this setting to interrogate or program an implantable device in any region in the world. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01
CVE ID: CVE-2021-38393 State: PUBLISHED Published: 2021-08-30T17:31:10 Last Updated: 2024-08-04T01:37:16.590Z Vendors: n/a Products: Delta Electronics DIAEnergie Problem Types: CWE-89 Description: A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER. Additional Analyst Notes: - CVE Program Container: References: - https://us-cer
n the context of NT SERVICE\MSSQLSERVER. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03
CVE ID: CVE-2021-38394 State: PUBLISHED Published: 2021-10-04T17:34:58.296378Z Last Updated: 2024-09-16T18:59:19.736Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L) Vendors: Boston Scientific Products: ZOOM LATITUDE Problem Types: CWE-1278 Description: An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engineer it, which could be used to create a physical duplicate of a valid hardware key. The hardware key allows access to special settings when inserted. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01
CVE ID: CVE-2021-38395 State: PUBLISHED Published: 2022-10-28T01:20:24.175Z Last Updated: 2025-04-16T16:07:52.218Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Honeywell Products: Experion PKS Problem Types: CWE-74 Description: Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04 - https://www.honeywellprocess.com/library/sup
: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04 - https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf
CVE ID: CVE-2021-38396 State: PUBLISHED Published: 2021-10-04T17:35:21.072612Z Last Updated: 2024-09-16T20:46:57.503Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L) Vendors: Boston Scientific Products: ZOOM LATITUDE Problem Types: CWE-353 Description: The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An attacker could leverage this weakness to install unauthorized software using a specially crafted USB. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01
CVE ID: CVE-2021-38397 State: PUBLISHED Published: 2022-10-28T01:21:35.576Z Last Updated: 2025-04-16T16:07:44.758Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Honeywell Products: Experion PKS Problem Types: CWE-434 Description: Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04 - https://www.honeywellprocess.com/library/support/notifications/Customer/
cisa.gov/uscert/ics/advisories/icsa-21-278-04 - https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf
CVE ID: CVE-2021-38398 State: PUBLISHED Published: 2021-10-04T17:35:06.578644Z Last Updated: 2024-09-16T17:58:22.688Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L) Vendors: Boston Scientific Products: ZOOM LATITUDE Problem Types: CWE-1329 Description: The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access to the affected device could exploit these vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01
CVE ID: CVE-2021-38399 State: PUBLISHED Published: 2022-10-28T01:19:02.691Z Last Updated: 2025-04-16T16:07:59.274Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Honeywell Products: Experion PKS Problem Types: CWE-23 Description: Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized files and directories. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04 - https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pd
21-278-04 - https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf
CVE ID: CVE-2021-38400 State: PUBLISHED Published: 2021-10-04T17:35:28.144047Z Last Updated: 2024-09-16T23:31:04.619Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L) Vendors: Boston Scientific Products: ZOOM LATITUDE Problem Types: CWE-916 Description: An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted USB to extract the password hash for brute force reverse engineering of the system password. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsma-21-273-01
CVE ID: CVE-2021-38401 State: PUBLISHED Published: 2021-12-20T20:08:47 Last Updated: 2024-08-04T01:37:16.513Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: V-Server Lite, Tellus Lite V-Simulator Problem Types: CWE-822 Description: Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference, which may allow an attacker to execute arbitrary code and cause the application to crash. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01
CVE ID: CVE-2021-38402 State: PUBLISHED Published: 2021-09-17T18:54:37.590Z Last Updated: 2025-04-23T19:27:44.541Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DOPSoft 2 Problem Types: CWE-121 Description: Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could lead to a stack-based buffer overflow while trying to copy to a buffer during font string handling. An attacker could leverage this vulnerability to execute code in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02
CVE ID: CVE-2021-38403 State: PUBLISHED Published: 2021-11-03T19:05:15.432908Z Last Updated: 2024-09-17T01:01:27.067Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Delta Electronics Products: DIALink Problem Types: CWE-79 Description: Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter supplier of the API maintenance, which may allow an attacker to remotely execute code. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02