Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
res.xml or macrosignatures.xml stream within the document to combine multiple certificate data, which when opened caused LibreOffice to display a validly signed indicator but whose content was unrelated to the signature shown. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25633 - https://www.debian.org/security/2021/dsa-4988
CVE ID: CVE-2021-25634 State: PUBLISHED Published: 2021-10-12T13:33:54.266254Z Last Updated: 2024-09-17T00:46:33.587Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-295 Description: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue
timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25634 - https://www.debian.org/security/2021/dsa-4988
CVE ID: CVE-2021-25635 State: PUBLISHED Published: 2025-03-21T14:52:50.484Z Last Updated: 2025-03-21T15:13:24.100Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-295 Description: An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person This issue affects LibreOffice: from 7.0 before 7.0.5, from 7.1 before 7.1.1. Additional Analyst Notes:
trusted person This issue affects LibreOffice: from 7.0 before 7.0.5, from 7.1 before 7.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2021-25635/
CVE ID: CVE-2021-25636 State: PUBLISHED Published: 2022-02-22T00:00:00 Last Updated: 2024-08-03T20:11:27.083Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-347 Description: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to contain both "X509Data" and "KeyValue" children of the "KeyInfo" ta
or macrosignatures.xml stream within the document to contain both "X509Data" and "KeyValue" children of the "KeyInfo" tag, which when opened caused LibreOffice to verify using the "KeyValue" but to report verification with the unrelated "X509Data" value. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25636/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NE6UIBCPZWRBWPSEGJOPNWPPT3CCMVH2/ - https://lists.debian.org/debian-lts-announce/2023/03/msg00022.html
CVE ID: CVE-2021-25640 State: PUBLISHED Published: 2021-05-31T07:25:12 Last Updated: 2024-08-03T20:11:27.531Z Vendors: Apache Software Foundation Products: Apache Dubbo Problem Types: CWE-918 Description: In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3E - https://lists.apache.org/thread.html/re4cab8855361a454d2af106fb3dad76259e723015fd7e09cb4f9eb77%40%3Cdev.dubbo.apache.org%3E
CVE ID: CVE-2021-25641 State: PUBLISHED Published: 2021-05-29T07:30:12 Last Updated: 2024-08-03T20:11:27.972Z Vendors: Apache Software Foundation Products: Apache Dubbo Problem Types: Remote Code Execution by tempering the serialization id on server side. Description: Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is so
struction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r99ef7fa35585d3a68762de07e8d2b2bc48b8fa669a03e8d84b9673f3%40%3Cdev.dubbo.apache.org%3E
CVE ID: CVE-2021-25642 State: PUBLISHED Published: 2022-08-25T00:00:00 Last Updated: 2024-08-03T20:11:28.113Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: CWE-502 Description: ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozh
Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/g6vf2h4wdgzzdgk91mqozhs58wotq150 - https://security.netapp.com/advisory/ntap-20221201-0003/
CVE ID: CVE-2021-25643 State: PUBLISHED Published: 2021-05-26T20:09:11 Last Updated: 2024-08-03T20:11:27.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @cbq-engine-cbauth and @index-cbauth, leak credentials in cleartext in the indexer.log file when they make a /listCreateTokens, /listRebalanceTokens, or /listMetadataTokens call. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2021-25644 State: PUBLISHED Published: 2021-05-19T18:50:52 Last Updated: 2024-08-03T20:11:27.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leaked authentication information being stored in cleartext in the debug.log and info.log files, and is also shown in the UI visible to administrators. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts - https://www.couchbase.com/downloads
CVE ID: CVE-2021-25645 State: PUBLISHED Published: 2021-05-10T12:59:28 Last Updated: 2024-08-03T20:11:27.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with administrator privileges, @ns_server, leaks credentials in cleartext in the cbcollect_info.log, debug.log, ns_couchdb.log, indexer.log, and stats.log files. NOTE: updating the product does not automatically address leaks that occurred in the past. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts - https://www.couchb
- CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts - https://www.couchbase.com/downloads
CVE ID: CVE-2021-25646 State: PUBLISHED Published: 2021-01-29T19:15:12.000Z Last Updated: 2025-02-13T16:27:49.264Z Vendors: Apache Software Foundation Products: Apache Druid Problem Types: Remote code execution Description: Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on th
ovided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/01/29/6 - https://lists.apache.org/thread.html/r64431c2b97209f566b5dff92415e7afba0ed3bfab4695ebaa8a62e5d%40%3Cdev.druid.apache.org%3E - https://lists.apache.org/thread.html/rc167d5e57f3120578718a7a458ce3e73b3830ac4efbb1b085bd06b92%40%3Cdev.druid.apache.org%3E - https://lists
e.org/thread.html/rc167d5e57f3120578718a7a458ce3e73b3830ac4efbb1b085bd06b92%40%3Cdev.druid.apache.org%3E - https://lists.apache.org/thread.html/r20e0c3b10ae2c05a3aad40f1476713c45bdefc32c920b9986b941d8f%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/r4f84b542417ea46202867c0a8b3eaf3b4cfed30e09174a52122ba210%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rea9436a4063927a567d698431ddae55e760c3f876c22ac5b9813685f%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r121abe8014d381943b63c60615149d40bde9dc1c868bcee90d0d0848%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rfeb775822cd3baef1595b60f6860f5ca849eb190
0d0848%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rfeb775822cd3baef1595b60f6860f5ca849eb1903236483f3297bd5c%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r04fa1ba93599487c95a8497044d37f8c02a439bfcf92b4567bfb7c8f%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r87aa94e28dd21ee2252d30c63f01ab9cb5474ee5bdd98dd8d7d734aa%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r7dff4790e7a5c697fc0360adf11f5aeb31cd6ad80644fffee690673c%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/ra4225912f501016bc5e0ac44e14b8d6779173a3a1dc7baacaabcc9ba%40%3Ccommits.druid.apache.org%3E - https://
he.org/thread.html/ra4225912f501016bc5e0ac44e14b8d6779173a3a1dc7baacaabcc9ba%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r5ef625076982aee7d23c23f07717e626b73f421fba5154d1e4de15e1%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r443e2916c612fbd119839c0fc0729327d6031913a75081adac5b43ad%40%3Cdev.druid.apache.org%3E - http://packetstormsecurity.com/files/162345/Apache-Druid-0.20.0-Remote-Command-Execution.html
CVE ID: CVE-2021-25647 State: PUBLISHED Published: 2021-01-28T18:49:44 Last Updated: 2024-08-03T20:11:27.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly or using the mobile application. Additional Analyst Notes: - CVE Program Container: References: - https://vrls.ws/posts/2021/01/cve-2021-25647-mobile-application-testes-de-codigo-stored-xss/
CVE ID: CVE-2021-25648 State: PUBLISHED Published: 2021-02-16T14:45:08 Last Updated: 2024-08-03T20:11:27.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the boolean value of parameters "isAdmin" and "isPremium" located on device storage. Additional Analyst Notes: - CVE Program Container: References: - https://vrls.ws/posts/2021/02/cve-2021-25648-mobile-application-testes-de-codigo-privilege-escalation/
CVE ID: CVE-2021-25649 State: PUBLISHED Published: 2021-06-24T08:55:23 Last Updated: 2024-08-03T20:11:27.744Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Avaya Products: Avaya Aura Utility Services Problem Types: CWE-200 Description: An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user. Affects all 7.x versions of Avaya Aura Utility Services Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Ref
versions of Avaya Aura Utility Services Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.avaya.com/css/P8/documents/101072728
CVE ID: CVE-2021-25650 State: PUBLISHED Published: 2021-06-24T08:55:25 Last Updated: 2024-08-03T20:11:27.548Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Avaya Products: Avaya Aura Utility Services Problem Types: CWE-250 Description: A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts as a privileged user. Affects all 7.x versions of Avaya Aura Utility Services Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.avaya.com/css/P8/documents/101072728
CVE ID: CVE-2021-25651 State: PUBLISHED Published: 2021-06-24T08:55:26 Last Updated: 2024-08-03T20:11:27.598Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Avaya Products: Avaya Aura Utility Services Problem Types: CWE-250 Description: A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges. Affects all 7.x versions of Avaya Aura Utility Services Additional Analyst Notes: - CVE Program Container: References: - https://support.avaya.com/css/P8/documents/101072728
CVE ID: CVE-2021-25652 State: PUBLISHED Published: 2021-06-24T08:55:28 Last Updated: 2024-08-03T20:11:27.657Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Avaya Products: Avaya Aura Appliance Virtualization Platform Utilities Problem Types: CWE-200 Description: An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Appliance Virtualization Platform Utilities (AVPU). This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user. Affects versions 8.0.0.0 through 8.1.3.1 of AVPU. Additional Analyst Notes
hould only be available to a privileged user. Affects versions 8.0.0.0 through 8.1.3.1 of AVPU. Additional Analyst Notes: - CVE Program Container: References: - https://support.avaya.com/css/P8/documents/101076479
CVE ID: CVE-2021-25653 State: PUBLISHED Published: 2021-06-24T08:55:29 Last Updated: 2024-08-03T20:11:27.517Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Avaya Products: Avaya Aura Appliance Virtualization Platform Utilities Problem Types: CWE-250 Description: A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially allow a local user to escalate privileges. Affects 8.0.0.0 through 8.1.3.1 versions of AVPU. Additional Analyst Notes: - CVE Program Container: References: - https://support.avaya.com/css/P8/documents/101076479
CVE ID: CVE-2021-25654 State: PUBLISHED Published: 2021-06-25T20:15:12 Last Updated: 2024-08-03T20:11:28.332Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Avaya Products: Avaya Aura Devices Services Problem Types: CWE-378 Description: An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services. Additional Analyst Notes: - CVE Program Container: References: - https://support.avaya.com/css/P8/documents/101076523
CVE ID: CVE-2021-25655 State: PUBLISHED Published: 2021-06-24T08:55:31 Last Updated: 2024-08-03T20:11:27.870Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: Avaya Products: Avaya Experience Portal Problem Types: CWE-601 Description: A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix). Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101076234
CVE ID: CVE-2021-25656 State: PUBLISHED Published: 2021-06-24T08:55:32 Last Updated: 2024-08-03T20:11:28.258Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Avaya Products: Product Problem Types: CWE-79 Description: Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix). Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/101076234
CVE ID: CVE-2021-25657 State: PUBLISHED Published: 2022-09-02T01:05:08.862143Z Last Updated: 2024-09-17T01:46:04.516Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Avaya Products: IP Office Problem Types: CWE-269 Description: A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://support.avaya.com/css/P8/documents/101083319 - https://github.com/mandiant/Vulnerability-Disclosures/b
rences: - https://support.avaya.com/css/P8/documents/101083319 - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0037/MNDT-2022-0037.md
CVE ID: CVE-2021-25659 State: PUBLISHED Published: 2021-08-10T10:35:25 Last Updated: 2024-08-03T20:11:27.685Z Vendors: Siemens Products: Automation License Manager 5, Automation License Manager 6 Problem Types: CWE-400 Description: A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0 SP9 Update 2). Sending specially crafted packets to port 4410/tcp of an affected system could lead to extensive memory being consumed and as such could cause a denial-of-service preventing legitimate users from using the system. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productc
ng the system. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-158827.pdf
CVE ID: CVE-2021-25660 State: PUBLISHED Published: 2021-05-12T13:18:22 Last Updated: 2024-08-03T20:11:27.734Z Vendors: Siemens Products: SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) , SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) , SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F, SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F , SIMATIC WinCC Runtime Advanced V15, SIMATIC WinCC Runtime Advanced V16 Problem Types: CWE-788 Description: A vulnera
F , SIMATIC WinCC Runtime Advanced V15, SIMATIC WinCC Runtime Advanced V16 Problem Types: CWE-788 Description: A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels
Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4). SmartVNC has an out-of-bounds memory access vulnerability that could be triggered on the server side when sending data from the client, which could result in a Denial-of-Service condition. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf
CVE ID: CVE-2021-25661 State: PUBLISHED Published: 2021-05-12T13:18:22 Last Updated: 2024-08-03T20:11:27.591Z Vendors: Siemens Products: SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) , SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) , SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F, SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F , SIMATIC WinCC Runtime Advanced V15, SIMATIC WinCC Runtime Advanced V16 Problem Types: CWE-788 Description: A vulnera
Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4). SmartVNC has an out-of-bounds memory access vulnerability that could be triggered on the client side when sending data from the server, which could result in a Denial-of-Service condition. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12 - https://cert-portal.siemens.com/productcert/pdf/ssa-538
nces: - https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12 - https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf