Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-34549 State: PUBLISHED Published: 2021-06-29T11:08:22 Last Updated: 2024-08-04T00:12:50.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.torproject.org/tpo/core/tor/-/issues/40391 - https://blog.torproject.org/node/2041 - https://security.gentoo.org/glsa/202107-25
CVE ID: CVE-2021-34550 State: PUBLISHED Published: 2021-06-29T11:11:45 Last Updated: 2024-08-04T00:12:50.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.torproject.org/tpo/core/tor/-/issues/40392 - https://blog.torproject.org/node/2041 - https://security.gentoo.org/glsa/202107-25
CVE ID: CVE-2021-34551 State: PUBLISHED Published: 2021-06-16T17:23:18 Last Updated: 2024-08-04T00:12:50.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FJYSOFCUBS67J3TKR74SD3C454N7VTYM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YRMWGA4VTMXFB22KICMB7YMFZNFV3EJ/
CVE ID: CVE-2021-34552 State: PUBLISHED Published: 2021-07-13T00:00:00 Last Updated: 2024-08-04T00:12:50.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/index.html - https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow - https://lists.debian.org/debian-lts-announce/2021/07/msg00018.html - https://lists.fedoraproject.org/archives/list/package
tps://lists.debian.org/debian-lts-announce/2021/07/msg00018.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7V6LCG525ARIX6LX5QRYNAWVDD2MD2SV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUGBBT63VL7G4JNOEIPDJIOC34ZFBKNJ/ - https://security.gentoo.org/glsa/202211-10
CVE ID: CVE-2021-34553 State: PUBLISHED Published: 2021-06-17T23:41:27 Last Updated: 2024-08-04T00:12:50.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access. Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com/hc/en-us/articles/4402433828371
CVE ID: CVE-2021-34555 State: PUBLISHED Published: 2021-06-10T14:56:34 Last Updated: 2024-08-04T00:12:50.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a multi-value From header field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/trusteddomainproject/OpenDMARC/issues/179 - https://github.com/trusteddomainproject/OpenDMARC/pull/178 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZHZD4WZDYRBB2XVW2EQ4DQ2KYMAGPUO/ - https://lists.fedoraproject.org/archives/l
nnounce%40lists.fedoraproject.org/message/VZHZD4WZDYRBB2XVW2EQ4DQ2KYMAGPUO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MAT4ZSWPQ5SUTMYCXRXI5SMTWL4AG7E/
CVE ID: CVE-2021-34556 State: PUBLISHED Published: 2021-08-02T04:02:40 Last Updated: 2024-08-04T00:12:50.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=f5e81d1117501546b7be050c5fbafa6efd2c722c - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/pa
tch/?id=f5e81d1117501546b7be050c5fbafa6efd2c722c - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=2039f26f3aca5b0e419b98f65dd36481337b86ee - http://www.openwall.com/lists/oss-security/2021/08/01/3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6JKK6XNRZX5BT5QVYOKGVJ2BHFZAP5EX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/565ZS55ZFEN62WVRRORT7R63RXW5F4T4/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
CVE ID: CVE-2021-34557 State: PUBLISHED Published: 2021-06-10T15:54:35 Last Updated: 2024-08-04T00:12:50.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/QubesOS/qubes-issues/issues/6595 - https://www.openwall.com/lists/oss-security/2021/06/05/1 - https://github.com/QubesOS/qubes-secpack/blob/m
issues/6595 - https://www.openwall.com/lists/oss-security/2021/06/05/1 - https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-068-2021.txt - https://github.com/QubesOS/qubes-xscreensaver/blob/master/0001-Fix-updating-outputs-info.patch - http://www.openwall.com/lists/oss-security/2021/06/11/1 - http://www.openwall.com/lists/oss-security/2021/07/06/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TC4QB7TRS4GS7LDXQQ4PC6J3LVFJYISV/
CVE ID: CVE-2021-34558 State: PUBLISHED Published: 2021-07-15T13:47:36 Last Updated: 2024-08-04T00:12:50.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/golang-announce - https://golang.org/doc/devel/release#go1.16.minor - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D7FRFM7WWR2JCT6NORQ7AO6
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D7FRFM7WWR2JCT6NORQ7AO6B453OMI3I/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BA7MFVXRBEKRTLSLYDICTYCGEMK2HZ7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYIUSR4YP52PWG7YE7AA3DZ5OSURNFJB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXJ2MVMAHOIGRH37ZSFYC4EVWLJFL2EQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBMLUQMN6XRKPVOI5XFFBP4XSR7RNTYR/ - https://lists.fedoraproject.org/arc
ckage-announce%40lists.fedoraproject.org/message/LBMLUQMN6XRKPVOI5XFFBP4XSR7RNTYR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XBQUFVI5TMV4KMKI7GKA223LHGPQISE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BTC3JQUASFN5U2XA4UZIGAPZQBD5JSS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITRXPCHUCJGXCX2CUEPKZRRTB27GG4ZB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLOGBB7XBBRB3J5FDPW5KWHSH7IRF64W/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://groups.google.com/
/NLOGBB7XBBRB3J5FDPW5KWHSH7IRF64W/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ - https://security.netapp.com/advisory/ntap-20210813-0005/ - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.gentoo.org/glsa/202208-02
CVE ID: CVE-2021-34559 State: PUBLISHED Published: 2021-08-31T10:32:54.004163Z Last Updated: 2024-09-16T17:33:00.268Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Phoenix Contact Products: WHA-GW-F2D2-0-AS- Z2-ETH, WHA-GW-F2D2-0-AS- Z2-ETH.EIP Problem Types: CWE-444 Description: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2021-027
CVE ID: CVE-2021-34560 State: PUBLISHED Published: 2021-08-31T10:32:55.386572Z Last Updated: 2024-09-16T23:00:54.389Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Phoenix Contact Products: WHA-GW-F2D2-0-AS- Z2-ETH, WHA-GW-F2D2-0-AS- Z2-ETH.EIP Problem Types: CWE-522 Description: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2021-027
CVE ID: CVE-2021-34561 State: PUBLISHED Published: 2021-08-31T10:32:56.470840Z Last Updated: 2024-09-17T01:56:32.573Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Phoenix Contact Products: WHA-GW-F2D2-0-AS- Z2-ETH, WHA-GW-F2D2-0-AS- Z2-ETH.EIP Problem Types: CWE-350 Description: In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's browser. Additional Analyst Notes: - CVE Program Container: References: - https://cert
y proxying through their target's browser. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2021-027
CVE ID: CVE-2021-34562 State: PUBLISHED Published: 2021-08-31T10:32:57.523335Z Last Updated: 2024-09-17T00:56:48.045Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Phoenix Contact Products: WHA-GW-F2D2-0-AS- Z2-ETH, WHA-GW-F2D2-0-AS- Z2-ETH.EIP Problem Types: CWE-79 Description: In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2021-027
CVE ID: CVE-2021-34563 State: PUBLISHED Published: 2021-08-31T10:32:58.577856Z Last Updated: 2024-09-17T04:14:32.706Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Phoenix Contact Products: WHA-GW-F2D2-0-AS- Z2-ETH, WHA-GW-F2D2-0-AS- Z2-ETH.EIP Problem Types: CWE-1004 Description: In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2021-027
CVE ID: CVE-2021-34564 State: PUBLISHED Published: 2021-08-31T10:32:59.626857Z Last Updated: 2024-09-17T02:27:43.392Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Phoenix Contact Products: WHA-GW-F2D2-0-AS- Z2-ETH, WHA-GW-F2D2-0-AS- Z2-ETH.EIP Problem Types: CWE-315 Description: Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2021-027
CVE ID: CVE-2021-34565 State: PUBLISHED Published: 2021-08-31T10:33:00.698044Z Last Updated: 2024-09-17T03:22:29.106Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Phoenix Contact Products: WHA-GW-F2D2-0-AS- Z2-ETH, WHA-GW-F2D2-0-AS- Z2-ETH.EIP Problem Types: CWE-798 Description: In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2021-027
CVE ID: CVE-2021-34566 State: PUBLISHED Published: 2022-11-09T15:17:14.172Z Last Updated: 2025-05-01T14:21:10.643Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: WAGO Products: 750-81xx/xxx-xxxFW, 750-82xx/xxx-xxx, 752-8303/8000-0002, 762-4xxx, 762-5xxx, 762-6xxx Problem Types: CWE-120 Description: In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the iocheck process and write memory resulting in loss of integrity and DoS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2020-03
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2020-036/
CVE ID: CVE-2021-34567 State: PUBLISHED Published: 2022-11-09T15:17:23.429Z Last Updated: 2025-05-01T14:20:39.270Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: WAGO Products: 750-81xx/xxx-xxxFW, 750-82xx/xxx-xxx, 752-8303/8000-0002, 762-4xxx, 762-5xxx, 762-6xxx Problem Types: CWE-125 Description: In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service and an limited out-of-bounds read. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2020-036/
CVE ID: CVE-2021-34568 State: PUBLISHED Published: 2022-11-09T15:17:29.795Z Last Updated: 2025-05-01T14:20:17.218Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: WAGO Products: 750-81xx/xxx-xxxFW, 750-82xx/xxx-xxx, 752-8303/8000-0002, 762-4xxx, 762-5xxx, 762-6xxx Problem Types: CWE-770 Description: In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2020-036/
CVE ID: CVE-2021-34569 State: PUBLISHED Published: 2022-11-09T15:17:36.366Z Last Updated: 2025-05-01T19:17:39.712Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WAGO Products: 750-81xx/xxx-xxxFW, 750-82xx/xxx-xxx, 752-8303/8000-0002, 762-4xxx, 762-5xxx, 762-6xxx Problem Types: CWE-787 Description: In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2020-036/
CVE ID: CVE-2021-34570 State: PUBLISHED Published: 2021-09-27T08:25:09.502074Z Last Updated: 2024-09-16T22:09:31.616Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Phoenix Contact Products: AXC F, RFC, PLCnext Problem Types: CWE-20 Description: Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2021-029/
CVE ID: CVE-2021-34571 State: PUBLISHED Published: 2021-09-16T12:20:15.225232Z Last Updated: 2024-09-16T16:13:55.210Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Enbra Products: AT-WMBUS-16-2, ER-AM DN 15, EWM 1.7.29 Problem Types: CWE-798 Description: Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn all information that is available in Enbra EWM. Additional Analyst Notes: - CVE Program Container: References: - https://www.fit.vutbr.cz/~polcak/CVE-2021-34571.en
CVE ID: CVE-2021-34572 State: PUBLISHED Published: 2021-09-16T12:20:16.725908Z Last Updated: 2024-09-16T17:23:17.590Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Enbra Products: EWM 1.7.29 Problem Types: CWE-345 Description: Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the sensor are replaced by the time of the readout even if the data is a replay of earlier data. Additional Analyst Notes: - CVE Program Container: References: - https://www.fit.vutbr.cz/~polcak/CVE-2021-34572.en
CVE ID: CVE-2021-34573 State: PUBLISHED Published: 2021-09-16T12:20:18.226237Z Last Updated: 2024-09-17T02:21:48.549Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Enbra Products: AT-WMBUS-16-2, ER-AM DN 15, EWM 1.7.29 Problem Types: CWE-682 Description: In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or misinterpreted. This may lead to wrong values and missing events. Additional Analyst Notes: - CVE Program Container: References: - https://www.fit.vutbr.cz/~polcak/CVE-2021-34573.en
CVE ID: CVE-2021-34574 State: PUBLISHED Published: 2021-08-02T10:24:31.932350Z Last Updated: 2024-09-16T18:14:15.495Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: MB connect line, Helmholz Products: mymbCONNECT24, mbCONNECT24, myREX24, myREX24.virtual Problem Types: CWE-669 Description: In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server. Additional Analyst Notes: - CVE Program Container: References: - ht
nd modifying the request that is send to the server. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2022-039 - https://cert.vde.com/en/advisories/VDE-2021-030
CVE ID: CVE-2021-34575 State: PUBLISHED Published: 2021-08-02T10:24:32.820190Z Last Updated: 2024-09-16T22:46:43.672Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: MB connect line Products: mymbCONNECT24, mbCONNECT24 Problem Types: CWE-203 Description: In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind of response the server sends. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/de-de/advisories/vde-2021-030
CVE ID: CVE-2021-34576 State: PUBLISHED Published: 2021-09-16T12:20:19.792795Z Last Updated: 2024-09-17T02:31:17.646Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Kaden Products: PICOFLUX AiR Problem Types: CWE-203 Description: In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists. This may give sensitive information (water consumption without distinct values) to third parties. Additional Analyst Notes: - CVE Program Container: References: - https://www.fit.vutbr.cz/~polcak/CVE-2021-34576.en
CVE ID: CVE-2021-34577 State: PUBLISHED Published: 2022-11-09T16:11:03.018Z Last Updated: 2025-05-01T19:16:45.077Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Kaden Products: PICOFLUX AiR Problem Types: CWE-798 Description: In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.fit.vutbr.cz/~polcak/CVE-2021-34577
CVE ID: CVE-2021-34578 State: PUBLISHED Published: 2021-08-31T10:33:01.868564Z Last Updated: 2024-09-16T18:33:25.112Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WAGO Products: PLC Problem Types: CWE-287 Description: This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically constructed requests without authentication on multiple WAGO PLCs in firmware versions up to FW07. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2020-044
CVE ID: CVE-2021-34579 State: PUBLISHED Published: 2022-11-09T16:28:32.817Z Last Updated: 2025-04-29T15:02:14.286Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PHOENIX CONTACT Products: FL MGUARD DM (2981974) Problem Types: CWE-269 Description: In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Microsoft Windows does not require login credentials even if configured during installation.Attackers with network access to the Apache web server can download and therefore read mGuard configuration profiles (“ATV profiles”). Such configuration profiles may contain sensitive infor
d therefore read mGuard configuration profiles (“ATV profiles”). Such configuration profiles may contain sensitive information, e.g. private keys associated with IPsec VPN connections. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2021-035/
CVE ID: CVE-2021-34580 State: PUBLISHED Published: 2021-10-27T10:25:09.307226Z Last Updated: 2024-09-17T01:41:24.149Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: MB connect line Products: mymbCONNECT24, mbCONNECT24 Problem Types: CWE-204 Description: In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2021-037/
CVE ID: CVE-2021-34581 State: PUBLISHED Published: 2021-08-31T10:33:02.999010Z Last Updated: 2024-09-17T00:42:35.318Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: WAGO Products: 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 Problem Types: CWE-772 Description: Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 750-880/xxx-xxx, 750-881, 750-889 in versions FW4 up to FW15 allows an unauthenticated attacker to cause DoS on the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en-us/advisories/vde-2021-038