alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2021-27358 (published 2021-03-18)
The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: grafana, netapp
Affected products: e-series_performance_analyzer, grafana
CVE-2021-27362 (published 2021-02-17)
The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a Read Access Violation on Control Flow starting at WPG!ReadWPG_W+0x0000000000000133, which might allow remote attackers to execute arbitrary code.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: irfanview
Affected products: irfanview, wpg
CVE-2021-27363 (published 2021-03-07)
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read, the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Affected vendors: debian, linux, netapp
Affected products: cloud_backup, debian_linux, linux_kernel, solidfire_baseboard_management_controller_firmware
CVE-2021-27364 (published 2021-03-07)
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: canonical, debian, linux, netapp, oracle
Affected products: cloud_backup, debian_linux, linux_kernel, solidfire_baseboard_management_controller, solidfire_baseboard_management_controller_firmware, tekelec_platform_distribution, ubuntu_linux
CVE-2021-27365 (published 2021-03-07)
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a Netlink message.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: debian, linux, netapp, oracle
Affected products: cloud_backup, debian_linux, linux_kernel, solidfire_baseboard_management_controller, solidfire_baseboard_management_controller_firmware, tekelec_platform_distribution
CVE-2021-27367 (published 2021-02-17)
Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: boltcms
Affected products: bolt
CVE-2021-27368 (published 2021-02-22)
The Contact page in Monica 2.19.1 allows stored XSS via the First Name field.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: monicahq
Affected products: monica
CVE-2021-27369 (published 2021-02-22)
The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: monicahq
Affected products: monica
CVE-2021-27370 (published 2021-02-22)
The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: monicahq
Affected products: monica
CVE-2021-27371 (published 2021-02-22)
The Contact page in Monica 2.19.1 allows stored XSS via the Description field.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: monicahq
Affected products: monica
CVE-2021-27372 (published 2021-03-25)
Realtek xPON RTL9601D SDK 1.9 stores passwords in plaintext which may allow attackers to possibly gain access to the device with root permissions via the build-in network monitoring tool and execute arbitrary commands.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: realtek
Affected products: xpon_rtl9601d, xpon_rtl9601d_software_development_kit
CVE-2021-27374 (published 2021-02-17)
VertiGIS WebOffice 10.7 SP1 before patch20210202 and 10.8 SP1 before patch20210207 allows attackers to achieve "Zugriff auf Inhalte der WebOffice Applikation."
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: vertigis
Affected products: weboffice
CVE-2021-27375 (published 2021-02-18)
Traefik before 2.4.5 allows the loading of IFRAME elements from other domains.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-1021
Affected vendors: containous
Affected products: traefik
CVE-2021-27376 (published 2021-02-18)
An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: nb-connect_project
Affected products: nb-connect
CVE-2021-27377 (published 2021-02-18)
An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: yottadb
Affected products: yottadb
CVE-2021-27378 (published 2021-02-18)
An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random number generator may be seeded with too little data.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-131
Affected vendors: rand_core_project
Affected products: rand_core
CVE-2021-27379 (published 2021-02-18)
An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial of service (host OS crash) or gain privileges. This occurs because a backport missed a flush, and thus IOMMU updates were not always correct. NOTE: this issue exists because of an incomplete fix for CVE-2020-15565.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: debian, xen
Affected products: debian_linux, xen
CVE-2021-27380 (published 2021-03-15)
A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12532)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: siemens
Affected products: solid_edge
CVE-2021-27381 (published 2021-03-15)
A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP13), Solid Edge SE2021 (All Versions < SE2021MP3). Affected applications lack proper validation of user-supplied data when parsing PAR files. This could result in an out of bounds read past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12534)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: siemens
Affected products: solid_edge
CVE-2021-27382 (published 2021-04-22)
A vulnerability has been identified in Solid Edge SE2020 (All versions < SE2020MP13), Solid Edge SE2020 (All versions < SE2020MP14), Solid Edge SE2021 (All Versions < SE2021MP4). Affected applications lack proper validation of user-supplied data when parsing of PAR files. This could result in a stack based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13040)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: siemens
Affected products: solid_edge_se2020, solid_edge_se2021
CVE-2021-27383 (published 2021-05-12)
A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). SmartVNC has a heap allocation leak vulnerability in the server Tight encoder, which could result in a Denial-of-Service condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: siemens
Affected products: simatic_hmi_comfort_outdoor_panels_15\", simatic_hmi_comfort_outdoor_panels_15\"_firmware, simatic_hmi_comfort_outdoor_panels_7\", simatic_hmi_comfort_outdoor_panels_7\"_firmware, simatic_hmi_comfort_panels_22\", simatic_hmi_comfort_panels_22\"_firmware, simatic_hmi_comfort_panels_4\", simatic_hmi_comfort_panels_4\"_firmware, simatic_hmi_ktp_mobile_panels_ktp400f, simatic_hmi_ktp_mobile_panels_ktp400f_firmware, simatic_hmi_ktp_mobile_panels_ktp700, simatic_hmi_ktp_mobile_panels_ktp700_firmware, simatic_hmi_ktp_mobile_panels_ktp700f, simatic_hmi_ktp_mobile_panels_ktp700f_firmware, simatic_hmi_ktp_mobile_panels_ktp900, simatic_hmi_ktp_mobile_panels_ktp900_firmware, simatic_hmi_ktp_mobile_panels_ktp900f, simatic_hmi_ktp_mobile_panels_ktp900f_firmware, simatic_wincc_runtime_advanced, sinamics_gh150, sinamics_gh150_firmware, sinamics_gl150, sinamics_gl150_firmware, sinamics_gm150, sinamics_gm150_firmware
CVE-2021-27384 (published 2021-05-12)
A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). SmartVNC has an out-of-bounds memory access vulnerability in the device layout handler, represented by a binary data stream on client side, which can potentially result in code execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-788
Affected vendors: siemens
Affected products: simatic_hmi_comfort_outdoor_panels_15\", simatic_hmi_comfort_outdoor_panels_15\"_firmware, simatic_hmi_comfort_outdoor_panels_7\", simatic_hmi_comfort_outdoor_panels_7\"_firmware, simatic_hmi_comfort_panels_22\", simatic_hmi_comfort_panels_22\"_firmware, simatic_hmi_comfort_panels_4\", simatic_hmi_comfort_panels_4\"_firmware, simatic_hmi_ktp_mobile_panels_ktp400f, simatic_hmi_ktp_mobile_panels_ktp400f_firmware, simatic_hmi_ktp_mobile_panels_ktp700, simatic_hmi_ktp_mobile_panels_ktp700_firmware, simatic_hmi_ktp_mobile_panels_ktp700f, simatic_hmi_ktp_mobile_panels_ktp700f_firmware, simatic_hmi_ktp_mobile_panels_ktp900, simatic_hmi_ktp_mobile_panels_ktp900_firmware, simatic_hmi_ktp_mobile_panels_ktp900f, simatic_hmi_ktp_mobile_panels_ktp900f_firmware, simatic_wincc_runtime_advanced, sinamics_gh150, sinamics_gh150_firmware, sinamics_gl150, sinamics_gl150_firmware, sinamics_gm150, sinamics_gm150_firmware
CVE-2021-27385 (published 2021-05-12)
A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). A remote attacker could send specially crafted packets to SmartVNC device layout handler on client side, which could influence the amount of resources consumed and result in a Denial-of-Service (infinite loop) condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: siemens
Affected products: simatic_hmi_comfort_outdoor_panels_15\", simatic_hmi_comfort_outdoor_panels_15\"_firmware, simatic_hmi_comfort_outdoor_panels_7\", simatic_hmi_comfort_outdoor_panels_7\"_firmware, simatic_hmi_comfort_panels_22\", simatic_hmi_comfort_panels_22\"_firmware, simatic_hmi_comfort_panels_4\", simatic_hmi_comfort_panels_4\"_firmware, simatic_hmi_ktp_mobile_panels_ktp400f, simatic_hmi_ktp_mobile_panels_ktp400f_firmware, simatic_hmi_ktp_mobile_panels_ktp700, simatic_hmi_ktp_mobile_panels_ktp700_firmware, simatic_hmi_ktp_mobile_panels_ktp700f, simatic_hmi_ktp_mobile_panels_ktp700f_firmware, simatic_hmi_ktp_mobile_panels_ktp900, simatic_hmi_ktp_mobile_panels_ktp900_firmware, simatic_hmi_ktp_mobile_panels_ktp900f, simatic_hmi_ktp_mobile_panels_ktp900f_firmware, simatic_wincc_runtime_advanced, sinamics_gh150, sinamics_gh150_firmware, sinamics_gl150, sinamics_gl150_firmware, sinamics_gm150, sinamics_gm150_firmware
CVE-2021-27386 (published 2021-05-12)
A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). SmartVNC has a heap allocation leak vulnerability in the device layout handler on client side, which could result in a Denial-of-Service condition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: siemens
Affected products: simatic_hmi_comfort_outdoor_panels_15\", simatic_hmi_comfort_outdoor_panels_15\"_firmware, simatic_hmi_comfort_outdoor_panels_7\", simatic_hmi_comfort_outdoor_panels_7\"_firmware, simatic_hmi_comfort_panels_22\", simatic_hmi_comfort_panels_22\"_firmware, simatic_hmi_comfort_panels_4\", simatic_hmi_comfort_panels_4\"_firmware, simatic_hmi_ktp_mobile_panels_ktp400f, simatic_hmi_ktp_mobile_panels_ktp400f_firmware, simatic_hmi_ktp_mobile_panels_ktp700, simatic_hmi_ktp_mobile_panels_ktp700_firmware, simatic_hmi_ktp_mobile_panels_ktp700f, simatic_hmi_ktp_mobile_panels_ktp700f_firmware, simatic_hmi_ktp_mobile_panels_ktp900, simatic_hmi_ktp_mobile_panels_ktp900_firmware, simatic_hmi_ktp_mobile_panels_ktp900f, simatic_hmi_ktp_mobile_panels_ktp900f_firmware, simatic_wincc_runtime_advanced, sinamics_gh150, sinamics_gh150_firmware, sinamics_gl150, sinamics_gl150_firmware, sinamics_gm150, sinamics_gm150_firmware
CVE-2021-27387 (published 2021-06-08)
A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27399. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12819)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: siemens
Affected products: simcenter_femap
CVE-2021-27388 (published 2021-06-15)
SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated attacker to cause a denial-of-service condition, and/or execution of limited configuration modifications and/or execution of limited control commands on the SINAMICS Medium Voltage Products, Remote Access (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: siemens
Affected products: sinamics_sl150, sinamics_sl150_firmware, sinamics_sm150, sinamics_sm150_firmware, sinamics_sm150i, sinamics_sm150i_firmware
CVE-2021-27389 (published 2021-04-22)
A vulnerability has been identified in Opcenter Quality (All versions < V12.2), QMS Automotive (All versions < V12.30). A private sign key is shipped with the product without adequate protection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-321
Affected vendors: siemens
Affected products: opcenter_quality, qms_automotive
CVE-2021-27390 (published 2021-06-08)
A vulnerability has been identified in JT2Go (All versions < V13.1.0.3), Teamcenter Visualization (All versions < V13.1.0.3). The TIFF_loader.dll library in affected applications lacks proper validation of user-supplied data when parsing TIFF files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13131)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: siemens
Affected products: jt2go, teamcenter_visualization
CVE-2021-27391 (published 2021-09-14)
A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All versions >= V2.8), APOGEE PXC Modular (BACnet) (All versions < V3.5.3), APOGEE PXC Modular (P2 Ethernet) (All versions >= V2.8), TALON TC Compact (BACnet) (All versions < V3.5.3), TALON TC Modular (BACnet) (All versions < V3.5.3). The web server of affected devices lacks proper bounds checking when parsing the Host parameter in HTTP requests, which could lead to a buffer overflow. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the device with root privileges.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: siemens
Affected products: apogee_mbc_\(ppc\)_\(p2_ethernet\), apogee_mbc_\(ppc\)_\(p2_ethernet\)_firmware, apogee_mec_\(ppc\)_\(p2_ethernet\), apogee_mec_\(ppc\)_\(p2_ethernet\)_firmware, apogee_pxc_bacnet_automation_controller, apogee_pxc_bacnet_automation_controller_firmware, apogee_pxc_compact_\(p2_ethernet\), apogee_pxc_compact_\(p2_ethernet\)_firmware, apogee_pxc_modular_\(bacnet\), apogee_pxc_modular_\(bacnet\)_firmware, apogee_pxc_modular_\(p2_ethernet\), apogee_pxc_modular_\(p2_ethernet\)_firmware, talon_tc_compact_\(bacnet\), talon_tc_compact_\(bacnet\)_firmware, talon_tc_modular_\(bacnet\), talon_tc_modular_\(bacnet\)_firmware
CVE-2021-27392 (published 2021-04-22)
A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-321
Affected vendors: siemens
Affected products: siveillance_video_open_network_bridge
CVE-2021-27393 (published 2021-04-22)
A vulnerability has been identified in Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2013.08), Nucleus Source Code (Versions including affected DNS modules). The DNS client does not properly randomize UDP port numbers of DNS requests. That could allow an attacker to poison the DNS cache or spoof DNS resolving.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-330
Affected vendors: siemens
Affected products: nucleus_net, nucleus_readystart_v3, nucleus_source_code
CVE-2021-27394 (published 2021-04-16)
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.19), Mendix Applications using Mendix 8 (All versions < V8.17.0), Mendix Applications using Mendix 8 (V8.12) (All versions < V8.12.5), Mendix Applications using Mendix 8 (V8.6) (All versions < V8.6.9), Mendix Applications using Mendix 9 (All versions < V9.0.5). Authenticated, non-administrative users could modify their privileges by manipulating the user role under certain circumstances, allowing them to gain administrative privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: mendix
Affected products: mendix
CVE-2021-27395 (published 2021-10-12)
A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-306
Affected vendors: siemens
Affected products: simatic_process_historian_2013, simatic_process_historian_2014, simatic_process_historian_2019, simatic_process_historian_2020
CVE-2021-27396 (published 2021-05-12)
A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a stack based buffer overflow, a different vulnerability than CVE-2021-27398. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13279)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: siemens
Affected products: tecnomatix_plant_simulation
CVE-2021-27397 (published 2021-05-12)
A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a memory corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13287)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: siemens
Affected products: tecnomatix_plant_simulation
CVE-2021-27398 (published 2021-05-12)
A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V16.0.5). The PlantSimCore.dll library lacks proper validation of user-supplied data when parsing SPP files. This could result in a stack based buffer overflow, a different vulnerability than CVE-2021-27396. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13290)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: siemens
Affected products: tecnomatix_plant_simulation
CVE-2021-27399 (published 2021-06-08)
A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27387. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12820)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: siemens
Affected products: simcenter_femap
CVE-2021-27400 (published 2021-04-22)
HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-295
Affected vendors: hashicorp
Affected products: vault
CVE-2021-27401 (published 2021-08-13)
The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due to insufficient input validation, aka Cross-Site Scripting (XSS).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mitel
Affected products: micollab
CVE-2021-27402 (published 2021-08-13)
The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-22
Affected vendors: mitel
Affected products: micollab
CVE-2021-27403 (published 2021-02-19)
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: asus
Affected products: askey_rtf8115vw, askey_rtf8115vw_firmware
CVE-2021-27404 (published 2021-02-19)
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: asus
Affected products: askey_rtf8115vw, askey_rtf8115vw_firmware
CVE-2021-27405 (published 2021-02-19)
A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: scrapbox-parser_project
Affected products: scrapbox-parser
CVE-2021-27406 (published 2022-10-14)
An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host machine to force the back-end server into initializing a new open-VPN instance with arbitrary open-VPN configuration. This could result in the attacker achieving execution with privileges of a SYSTEM user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-15
Affected vendors: perfact
Affected products: openvpn-client
CVE-2021-27408 (published 2021-06-11)
The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: hillrom
Affected products: connex_central_station, connex_device_integration_suite_network_connectivity_engine, connex_integrated_wall_system, connex_spot_monitor, connex_vital_signs_monitor, service_monitor, service_tool, software_development_kit, spot_vital_signs_4400
CVE-2021-27410 (published 2021-06-11)
The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: hillrom
Affected products: connex_central_station, connex_device_integration_suite_network_connectivity_engine, connex_integrated_wall_system, connex_spot_monitor, connex_vital_signs_monitor, service_monitor, service_tool, software_development_kit, spot_vital_signs_4400
CVE-2021-27411 (published 2022-05-03)
Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as very small blocks of memory being allocated instead of very large ones.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Weakness: CWE-190
Affected vendors: silabs
Affected products: micrium_os
CVE-2021-27412 (published 2021-07-02)
Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: deltaww
Affected products: dopsoft
CVE-2021-27413 (published 2021-05-13)
Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: omron
Affected products: cx-one, cx-server
CVE-2021-27414 (published 2022-03-11)
An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 into visiting a malicious website posing as a login page for the Ellipse application and gather authentication credentials.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-451
Affected vendors: hitachienergy
Affected products: ellipse_enterprise_asset_management
CVE-2021-27416 (published 2022-03-11)
An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to and including 9.0.25 by tricking a user to click on a link containing malicious code that would then be run by the web browser. This can result in the compromise of confidential information, or even the takeover of the user’s session.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hitachienergy
Affected products: ellipse_enterprise_asset_management
CVE-2021-27417 (published 2022-05-03)
eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: ecoscentric
Affected products: ecospro
CVE-2021-27418 (published 2022-03-23)
GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-20
Affected vendors: ge
Affected products: multilin_b30, multilin_b30_firmware, multilin_b90, multilin_b90_firmware, multilin_c30, multilin_c30_firmware, multilin_c60, multilin_c60_firmware, multilin_c70, multilin_c70_firmware, multilin_c95, multilin_c95_firmware, multilin_d30, multilin_d30_firmware, multilin_d60, multilin_d60_firmware, multilin_f35, multilin_f35_firmware, multilin_f60, multilin_f60_firmware, multilin_g30, multilin_g30_firmware, multilin_g60, multilin_g60_firmware, multilin_l30
CVE-2021-27419 (published 2022-05-03)
uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: uclibc-ng_project
Affected products: uclibc-ng
CVE-2021-27420 (published 2022-03-23)
GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By itself, this is not particularly significant as the relay remains effective in all other functionality and communication channels.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-20
Affected vendors: ge
Affected products: multilin_b30, multilin_b30_firmware, multilin_b90, multilin_b90_firmware, multilin_c30, multilin_c30_firmware, multilin_c60, multilin_c60_firmware, multilin_c70, multilin_c70_firmware, multilin_c95, multilin_c95_firmware, multilin_d30, multilin_d30_firmware, multilin_d60, multilin_d60_firmware, multilin_f35, multilin_f35_firmware, multilin_f60, multilin_f60_firmware, multilin_g30, multilin_g30_firmware, multilin_g60, multilin_g60_firmware, multilin_l30
CVE-2021-27421 (published 2022-05-03)
NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: nxp
Affected products: mcuxpresso_software_development_kit
CVE-2021-27422 (published 2022-03-23)
GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: ge
Affected products: multilin_b30, multilin_b30_firmware, multilin_b90, multilin_b90_firmware, multilin_c30, multilin_c30_firmware, multilin_c60, multilin_c60_firmware, multilin_c70, multilin_c70_firmware, multilin_c95, multilin_c95_firmware, multilin_d30, multilin_d30_firmware, multilin_d60, multilin_d60_firmware, multilin_f35, multilin_f35_firmware, multilin_f60, multilin_f60_firmware, multilin_g30, multilin_g30_firmware, multilin_g60, multilin_g60_firmware, multilin_l30
CVE-2021-27424 (published 2022-03-23)
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a “Last-key pressed” MODBUS register can be used to gain unauthorized information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: ge
Affected products: multilin_b30, multilin_b30_firmware, multilin_b90, multilin_b90_firmware, multilin_c30, multilin_c30_firmware, multilin_c60, multilin_c60_firmware, multilin_c70, multilin_c70_firmware, multilin_c95, multilin_c95_firmware, multilin_d30, multilin_d30_firmware, multilin_d60, multilin_d60_firmware, multilin_f35, multilin_f35_firmware, multilin_f60, multilin_f60_firmware, multilin_g30, multilin_g30_firmware, multilin_g60, multilin_g60_firmware, multilin_l30
CVE-2021-27425 (published 2022-05-03)
Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: cesanta
Affected products: mongoose_os
CVE-2021-27426 (published 2022-03-23)
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-453
Affected vendors: ge
Affected products: multilin_b30, multilin_b30_firmware, multilin_b90, multilin_b90_firmware, multilin_c30, multilin_c30_firmware, multilin_c60, multilin_c60_firmware, multilin_c70, multilin_c70_firmware, multilin_c95, multilin_c95_firmware, multilin_d30, multilin_d30_firmware, multilin_d60, multilin_d60_firmware, multilin_f35, multilin_f35_firmware, multilin_f60, multilin_f60_firmware, multilin_g30, multilin_g30_firmware, multilin_g60, multilin_g60_firmware, multilin_l30
CVE-2021-27427 (published 2022-05-03)
RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: riot-os
Affected products: riot
CVE-2021-27428 (published 2022-03-23)
GE UR IED firmware versions prior to version 8.1x supports upgrading firmware using UR Setup configuration tool – Enervista UR Setup. This UR Setup tool validates the authenticity and integrity of firmware file before uploading the UR IED. An illegitimate user could upgrade firmware without appropriate privileges. The weakness is assessed, and mitigation is implemented in firmware Version 8.10.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: ge
Affected products: multilin_b30, multilin_b30_firmware, multilin_b90, multilin_b90_firmware, multilin_c30, multilin_c30_firmware, multilin_c60, multilin_c60_firmware, multilin_c70, multilin_c70_firmware, multilin_c95, multilin_c95_firmware, multilin_d30, multilin_d30_firmware, multilin_d60, multilin_d60_firmware, multilin_f35, multilin_f35_firmware, multilin_f60, multilin_f60_firmware, multilin_g30, multilin_g30_firmware, multilin_g60, multilin_g60_firmware, multilin_l30
CVE-2021-27429 (published 2023-11-20)

Texas Instruments TI-RTOS returns a valid pointer to a small buffer on extremely large values. This can trigger an integer overflow vulnerability in 'HeapTrack_alloc' and result in code execution. 


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: ti
Affected products: cc3200, cc3220r, cc3220s, cc3220sf, cc3230s, cc3230sf, cc3235s, cc3235sf, real-time_operating_system, simplelink_cc13xx_software_development_kit, simplelink_cc26xx_software_development_kit, simplelink_cc32xx_software_development_kit, simplelink_msp432e401y, simplelink_msp432e411y
CVE-2021-27430 (published 2022-03-23)
GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials. Additionally, a user with physical access to the UR IED can interrupt the boot sequence by rebooting the UR.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: ge
Affected products: ur_bootloader_binary
CVE-2021-27431 (published 2022-05-03)
ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: arm
Affected products: cmsis-rtos
CVE-2021-27432 (published 2021-05-20)
OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled recursion, which may allow an attacker to trigger a stack overflow.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-674
Affected vendors: opcfoundation
Affected products: ua-.net-legacy, ua_.net_standard_stack
CVE-2021-27433 (published 2022-05-03)
ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: arm
Affected products: mbed_ualloc
CVE-2021-27434 (published 2021-05-20)
Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework versions only) are vulnerable to an uncontrolled recursion, which may allow an attacker to trigger a stack overflow.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft, unified-automation
Affected products: .net_based_opc_ua_client\/server_sdk, .net_framework
CVE-2021-27435 (published 2022-05-03)
ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: arm
Affected products: mbed
CVE-2021-27436 (published 2021-03-18)
WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser actions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: advantech
Affected products: webaccess\/scada
CVE-2021-27437 (published 2021-05-07)
The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM (versions prior to 9.0.1).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-798
Affected vendors: advantech
Affected products: wise-paas\/rmm
CVE-2021-27438 (published 2021-03-25)
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (all firmware versions prior to 02A04.1).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: ge
Affected products: reason_dr60, reason_dr60_firmware
CVE-2021-27439 (published 2022-05-03)
TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: tencent
Affected products: tencentos-tiny