Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdf
CVE ID: CVE-2021-40360 State: PUBLISHED Published: 2022-02-09T15:17:03 Last Updated: 2024-08-04T02:44:09.157Z Vendors: Siemens Products: SIMATIC PCS 7 V8.2, SIMATIC PCS 7 V9.0, SIMATIC PCS 7 V9.1, SIMATIC WinCC V15 and earlier, SIMATIC WinCC V16, SIMATIC WinCC V17, SIMATIC WinCC V7.4, SIMATIC WinCC V7.5 Problem Types: CWE-200 Description: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 S
All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The password hash of a local user account in the remote server could be granted via public API to a user on the affected system. An authenticated attacker could brute force the password hash and use it to login to the server. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-914168.pdf
CVE ID: CVE-2021-40363 State: PUBLISHED Published: 2022-02-09T15:17:04 Last Updated: 2024-08-04T02:44:09.640Z Vendors: Siemens Products: SIMATIC PCS 7 V8.2, SIMATIC PCS 7 V9.0, SIMATIC PCS 7 V9.1, SIMATIC WinCC V15 and earlier, SIMATIC WinCC V16, SIMATIC WinCC V17, SIMATIC WinCC V7.4, SIMATIC WinCC V7.5 Problem Types: CWE-538 Description: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V17 (All versions <= V17 Up
All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V17 (All versions <= V17 Update 4), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 6). The affected component stores the credentials of a local system account in a potentially publicly accessible project file using an outdated cipher algorithm. An attacker may use this to brute force the credentials and take over the system. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-914168.pdf
CVE ID: CVE-2021-40364 State: PUBLISHED Published: 2021-11-09T11:32:06 Last Updated: 2024-08-04T02:44:09.470Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC PCS 7 V8.2, SIMATIC PCS 7 V9.0, SIMATIC PCS 7 V9.1, SIMATIC WinCC V15 and earlier, SIMATIC WinCC V16, SIMATIC WinCC V17, SIMATIC WinCC V7.4, SIMATIC WinCC V7.5 Problem Types: CWE-532 Description: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V1
sions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIMATIC WinCC V16 (All versions < V16 Update 5), SIMATIC WinCC V17 (All versions < V17 Update 2), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 19), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 5). The affected systems store sensitive information in log files. An attacker with access to the log files could publicly expose the information or reuse it to develop further attacks on the system. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-840188.pdf
CVE ID: CVE-2021-40365 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-21T13:45:50.798Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC Drive Controller CPU 1504D TF, SIMATIC Drive Controller CPU 1507D TF, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU 1510SP F-1 PN, SIMATIC S7-1500 CPU 1510SP-1 PN, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511C-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1511T-1 PN, SIMATIC S7-1500 CPU 1511TF-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7
1511F-1 PN, SIMATIC S7-1500 CPU 1511T-1 PN, SIMATIC S7-1500 CPU 1511TF-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7-1500 CPU 1512SP F-1 PN, SIMATIC S7-1500 CPU 1512SP-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1513R-1 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515R-2 PN, SIMATIC S7-1500 CPU 1515T-2 PN, SIMATIC S7-1500 CPU 1515TF-2 PN, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-1500 CPU 1516T-3 PN/DP, SIMATIC S7-1500 CPU 1516TF-3 PN/DP, SIMATIC S7-1500 CPU 1517-3 PN/DP, SIMATIC S7-1500 CPU 1517F-3 PN/DP, SIMATIC S7-1500 CPU 1517H-3 PN, SIMATIC S7-1500 CPU 1517T-
S7-1500 CPU 1517-3 PN/DP, SIMATIC S7-1500 CPU 1517F-3 PN/DP, SIMATIC S7-1500 CPU 1517H-3 PN, SIMATIC S7-1500 CPU 1517T-3 PN/DP, SIMATIC S7-1500 CPU 1517TF-3 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518HF-4 PN, SIMATIC S7-1500 CPU 1518T-4 PN/DP, SIMATIC S7-1500 CPU 1518TF-4 PN/DP, SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK, SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK, SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN, SIMATIC S7-1500 So
PRO-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN, SIMATIC S7-1500 Software Controller V2, SIMATIC S7-PLCSIM Advanced, SIPLUS ET 200SP CPU 1510SP F-1 PN, SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1510SP-1 PN, SIPLUS ET 200SP CPU 1510SP-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP-1 PN, SIPLUS ET 200SP CPU 1512SP-1 PN RAIL, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL, SIPLUS S7-1500 CPU 1511-1 PN TX RAIL, SIPLUS S7-1500 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1515F-2 PN, SIPLUS S7
00 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1515F-2 PN, SIPLUS S7-1500 CPU 1515F-2 PN RAIL, SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL, SIPLUS S7-1500 CPU 1515R-2 PN, SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL, SIPLUS S7-1500 CPU 1516F-3 PN/DP, SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1517H-3 PN, SIPLUS S7-1500 CPU 1518-4 PN/DP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518F-4 PN/DP, SIPLUS S7-1500 CPU 1518HF-4 PN, SIPLUS TIM 1531 IRC, TIM 1531 IRC Problem Types: CWE-20 Description: Affected devices don't
US S7-1500 CPU 1518HF-4 PN, SIPLUS TIM 1531 IRC, TIM 1531 IRC Problem Types: CWE-20 Description: Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf
CVE ID: CVE-2021-40366 State: PUBLISHED Published: 2021-11-09T11:32:07 Last Updated: 2024-08-04T02:44:09.177Z Vendors: Siemens Products: Climatix POL909 (AWB module), Climatix POL909 (AWM module) Problem Types: CWE-311 Description: A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data, such as administrator credentials, or modify data in transit. Additional Analyst Notes: - CVE Program Container: References: - https://cert
or credentials, or modify data in transit. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdf
CVE ID: CVE-2021-40367 State: PUBLISHED Published: 2024-01-04T11:20:42.887Z Last Updated: 2025-06-17T20:29:09.030Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Siemens Products: syngo fastView Problem Types: CWE-787 Description: A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied data when parsing DICOM files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15097) Additional Analyst Notes: - CVE Program Container: - C
ecute code in the context of the current process. (ZDI-CAN-15097) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-688797
CVE ID: CVE-2021-40368 State: PUBLISHED Published: 2022-04-12T09:07:23.000Z Last Updated: 2025-04-21T13:54:27.056Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC S7-400 CPU 412-1 DP V7, SIMATIC S7-400 CPU 412-2 DP V7, SIMATIC S7-400 CPU 412-2 PN/DP V7, SIMATIC S7-400 CPU 414-2 DP V7, SIMATIC S7-400 CPU 414-3 DP V7, SIMATIC S7-400 CPU 414-3 PN/DP V7, SIMATIC S7-400 CPU 414F-3 PN/DP V7, SIMATIC S7-400 CPU 416-2 DP V7, SIMATIC S7-400 CPU 416-3 DP V7, SIMATIC S7-400 CPU 416-3 PN/DP V7, SIMATIC S7-400 CPU 416F-2 DP V7, SIMATIC S7-400 CPU 416F-3 PN/DP V7, SIMATIC S7-400 CPU 417-4 DP V7, SIMATIC S7-400 H V6 CPU family (incl. S
16F-2 DP V7, SIMATIC S7-400 CPU 416F-3 PN/DP V7, SIMATIC S7-400 CPU 417-4 DP V7, SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants), SIPLUS S7-400 CPU 414-3 PN/DP V7, SIPLUS S7-400 CPU 416-3 PN/DP V7, SIPLUS S7-400 CPU 416-3 V7, SIPLUS S7-400 CPU 417-4 V7 Problem Types: CWE-119 Description: A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414-2 DP V7 (All versions), SIMATIC S7-400 CPU 414-3 DP V7 (All versions), SIMATIC S
sions < V7.0.3), SIMATIC S7-400 CPU 414-2 DP V7 (All versions), SIMATIC S7-400 CPU 414-3 DP V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 416-2 DP V7 (All versions), SIMATIC S7-400 CPU 416-3 DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 416F-2 DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 417-4 DP V7 (All versions), SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (All versions < V6.0.10), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) (All versions < V10.1), SIM
US variants) (All versions < V6.0.10), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) (All versions < V10.1), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions < V8.2.3), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 V7 (All versions), SIPLUS S7-400 CPU 417-4 V7 (All versions). Affected devices improperly handle specially crafted packets sent to port 102/tcp. This could allow an attacker to create a Denial-of-Service condition. A restart is needed to restore normal operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ce
normal operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-557541.pdf
CVE ID: CVE-2021-40369 State: PUBLISHED Published: 2021-11-24T11:15:13 Last Updated: 2024-08-04T02:44:09.644Z Vendors: Apache Software Foundation Products: Apache JSPWiki Problem Types: CVE-2021-40369 Description: A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later. Additional Analyst Notes: - CVE Program Container: References: - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-40369 - https://lists.apache.org/thread/r2j00nrnpjg
References: - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-40369 - https://lists.apache.org/thread/r2j00nrnpjgcmoxvlv3pgfoq9kzrcsfh - http://www.openwall.com/lists/oss-security/2022/08/03/3
CVE ID: CVE-2021-40371 State: PUBLISHED Published: 2021-10-25T06:33:27 Last Updated: 2024-08-04T02:44:09.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by ..\\ in a scriptName JSON value to ServiceManagerTenant/GetVisibilityMap. Additional Analyst Notes: - CVE Program Container: References: - https://www.gridprosoftware.com/products/requestmanagement/ - http://seclists.org/fulldisclosure/2021/Oct/33 - http://packetstormsecurity.com/files/164621/GridPro-Request-Management-For-Windows-Azure-Pack-2.0.7905-Directory-Traversal.html
CVE ID: CVE-2021-40373 State: PUBLISHED Published: 2021-09-10T13:33:55 Last Updated: 2024-08-04T02:44:09.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via the index.php?app=main&inc=core_welcome URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/maikroservice/CVE-2021-40373 - https://playsms.org/2021/09/04/playsms-1-4-5-released/
CVE ID: CVE-2021-40374 State: PUBLISHED Published: 2022-04-06T01:25:54 Last Updated: 2024-08-04T02:44:10.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded, which could be used in a XSS attack. Additional Analyst Notes: - CVE Program Container: References: - https://openeyes.apperta.org/ - https://github.com/DCKento/CVE-2021-40374
CVE ID: CVE-2021-40375 State: PUBLISHED Published: 2022-04-06T01:25:57 Last Updated: 2024-08-04T02:44:09.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This response can be read in an intercepting proxy or by viewing the page source. Sensitive information returned in responses includes patient PII and medication records or history. Additional Analyst Notes: - CVE Program Container: References: -
includes patient PII and medication records or history. Additional Analyst Notes: - CVE Program Container: References: - https://openeyes.apperta.org/ - https://github.com/DCKento/CVE-2021-40375
CVE ID: CVE-2021-40376 State: PUBLISHED Published: 2022-03-07T03:41:46 Last Updated: 2024-08-04T02:44:09.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attack may be possible as well, by leveraging WsHTTPBinding for HTTP traffic on TCP port 9000. Additional Analyst Notes: - CVE Program Container: References: - https://www.otris.com - https://www.tuv.com/landingpage/en/vulnerability-disclosure/ - https://www.tuv.com/content-media-files/master-content/global-landingpages/images/vulnerability-disclosure/tuv-rheinland-security-
w.tuv.com/content-media-files/master-content/global-landingpages/images/vulnerability-disclosure/tuv-rheinland-security-advisory-local-privilege-escalation-vulnerability-in-otris-update-manager.pdf
CVE ID: CVE-2021-40377 State: PUBLISHED Published: 2021-09-08T10:57:35 Last Updated: 2024-08-04T02:44:09.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.smartertools.com/smartermail/release-notes/current
CVE ID: CVE-2021-40378 State: PUBLISHED Published: 2021-09-01T17:15:30 Last Updated: 2024-08-04T02:44:10.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killps.cgi deletes all data from the device. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md - http://packetstormsecurity.com/files/164024/Compro-Technology-IP-Camera-Denial-Of-Service.html
CVE ID: CVE-2021-40379 State: PUBLISHED Published: 2021-09-01T17:16:18 Last Updated: 2024-08-04T02:44:09.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 does not require authorization. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md - http://packetstormsecurity.com/files/164026/Compro-Technology-IP-Camera-RTSP-Stream-Disclosure.html
CVE ID: CVE-2021-40380 State: PUBLISHED Published: 2021-09-01T17:16:04 Last Updated: 2024-08-04T02:44:09.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and setcamera.cgi disclose credentials. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md - http://packetstormsecurity.com/files/164027/Compro-Technology-IP-Camera-Credential-Disclosure.html
CVE ID: CVE-2021-40381 State: PUBLISHED Published: 2021-09-01T17:15:51 Last Updated: 2024-08-04T02:44:09.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows video access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md - http://packetstormsecurity.com/files/164031/Compro-Technology-IP-Camera-Stream-Disclosure.html
CVE ID: CVE-2021-40382 State: PUBLISHED Published: 2021-09-01T17:15:40 Last Updated: 2024-08-04T02:44:09.096Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi allows video screenshot access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md - http://packetstormsecurity.com/files/164032/Compro-Technology-IP-Camera-Screenshot-Disclosure.html
CVE ID: CVE-2021-40385 State: PUBLISHED Published: 2021-09-01T20:55:59 Last Updated: 2024-08-04T02:44:09.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is a privilege escalation from read-only user to admin. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/csirt-divd-nl/cases/DIVD-2021-00014/
CVE ID: CVE-2021-40386 State: PUBLISHED Published: 2022-04-15T04:36:20 Last Updated: 2024-08-04T02:44:09.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/cves/CVE-2021-40386/
CVE ID: CVE-2021-40387 State: PUBLISHED Published: 2021-09-01T20:55:15 Last Updated: 2024-08-04T02:44:09.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is authenticated remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://csirt.divd.nl/csirt-divd-nl/cases/DIVD-2021-00014/
CVE ID: CVE-2021-40388 State: PUBLISHED Published: 2022-01-28T19:09:26.000Z Last Updated: 2025-04-15T19:22:41.775Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: CWE-276 Description: A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1399
CVE ID: CVE-2021-40389 State: PUBLISHED Published: 2022-01-28T19:09:27.000Z Last Updated: 2025-04-15T19:22:33.931Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: n/a Problem Types: CWE-276 Description: A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1400
CVE ID: CVE-2021-40390 State: PUBLISHED Published: 2022-04-14T19:56:08.227Z Last Updated: 2025-04-15T19:08:07.716Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Moxa Products: MXView Series Problem Types: CWE-798 Description: An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP request can lead to unauthorized access. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1401