deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-46531
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x8d28e. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/211; https://github.com/cesanta/mjs/issues/211
CVE: CVE-2021-46532
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via exec_expr at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/203; https://github.com/cesanta/mjs/issues/203
CVE: CVE-2021-46534
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via getprop_builtin_foreign at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/204; https://github.com/cesanta/mjs/issues/204
CVE: CVE-2021-46535
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0xe533e. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/209; https://github.com/cesanta/mjs/issues/209
CVE: CVE-2021-46537
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x9a30e. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/212; https://github.com/cesanta/mjs/issues/212
CVE: CVE-2021-46538
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_compact_strings at src/mjs_gc.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/216; https://github.com/cesanta/mjs/issues/216
CVE: CVE-2021-46539
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x45a1f. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/217; https://github.com/cesanta/mjs/issues/217
CVE: CVE-2021-46540
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_get_mjs at src/mjs_builtin.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/214; https://github.com/cesanta/mjs/issues/214
CVE: CVE-2021-46541
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x2c6ae. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/222; https://github.com/cesanta/mjs/issues/222
CVE: CVE-2021-46542
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_print at src/mjs_builtin.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/215; https://github.com/cesanta/mjs/issues/215
CVE: CVE-2021-46543
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x18e810. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/219; https://github.com/cesanta/mjs/issues/219
CVE: CVE-2021-46544
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x59e19. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/220; https://github.com/cesanta/mjs/issues/220
CVE: CVE-2021-46545
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x4b44b. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/218; https://github.com/cesanta/mjs/issues/218
CVE: CVE-2021-46546
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_next at src/mjs_object.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/213; https://github.com/cesanta/mjs/issues/213
CVE: CVE-2021-46547
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x2c17e. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/221; https://github.com/cesanta/mjs/issues/221
CVE: CVE-2021-46548
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via add_lineno_map_item at src/mjs_bcode.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/228; https://github.com/cesanta/mjs/issues/228
CVE: CVE-2021-46549
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via parse_cval_type at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/224; https://github.com/cesanta/mjs/issues/224
CVE: CVE-2021-46550
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via free_json_frame at src/mjs_json.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/230; https://github.com/cesanta/mjs/issues/230
CVE: CVE-2021-46553
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_set_internal at src/mjs_object.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/226; https://github.com/cesanta/mjs/issues/226
CVE: CVE-2021-46554
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_json_stringify at src/mjs_json.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/229; https://github.com/cesanta/mjs/issues/229
CVE: CVE-2021-46556
Published: 2022-01-27
Description: Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_bcode_insert_offset at src/mjs_bcode.c. This vulnerability can lead to a Denial of Service (DoS).
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/cesanta/mjs/issues/227; https://github.com/cesanta/mjs/issues/227
CVE: CVE-2022-21719
Published: 2022-01-28
Description: GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/glpi-project/glpi/commit/e9b16bc8e9b61ebb2d35b96b9c71cd25c5af9e48; https://github.com/glpi-project/glpi/releases/tag/9.5.7; https://github.com/glpi-project/glpi/security/advisories/GHSA-6cj4-g839-gj5j
CVE: CVE-2022-0394
Published: 2022-01-28
Description: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/livehelperchat/livehelperchat/commit/d7b85466c217b3750eaccc8703ce54ba8785c4d3; https://huntr.dev/bounties/e13823d0-271c-448b-a0c5-8549ea7ea272; https://github.com/livehelperchat/livehelperchat/commit/d7b85466c217b3750eaccc8703ce54ba8785c4d3
CVE: CVE-2022-21720
Published: 2022-01-28
Description: GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/glpi-project/glpi/commit/5c3eee696b503fdf502f506b00d15cf5b324b326; https://github.com/glpi-project/glpi/releases/tag/9.5.7; https://github.com/glpi-project/glpi/security/advisories/GHSA-5hg4-r64r-rf83
CVE: CVE-2022-24071
Published: 2022-01-28
Description: A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal APIs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-648
References: https://cve.naver.com/detail/cve-2022-24071; https://cve.naver.com/detail/cve-2022-24071
CVE: CVE-2020-28884
Published: 2022-01-28
Description: Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groovy scripts and therefore not a design flaw.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://learn.liferay.com/dxp/latest/en/system-administration/using-the-script-engine/running-scripts-from-the-script-console.html; https://medium.com/%40tranpdanh/some-way-to-execute-os-command-in-liferay-portal-84498bde18d3; https://learn.liferay.com/dxp/latest/en/system-administration/using-the-script-engine/running-scripts-from-the-script-console.html
CVE: CVE-2020-28885
Published: 2022-01-28
Description: Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to access and execute commands in Gogo Shell and therefore not a design fla
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://medium.com/%40tranpdanh/some-way-to-execute-os-command-in-liferay-portal-84498bde18d3; https://medium.com/%40tranpdanh/some-way-to-execute-os-command-in-liferay-portal-84498bde18d3
CVE: CVE-2021-42791
Published: 2022-01-28
Description: An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified. If a user who receives the notification accepts it, then the user who triggered the notification can obtain the accepting user's login certificate.
CVSS Score: 7.3 (HIGH)
CWE: CWE-444
References: https://www.compass-security.com/en/research/advisories; https://www.compass-security.com/fileadmin/Research/Advisories/2022_03_CSNC-2021-017_VeridiumId_Broken_Access_Control.txt; https://www.veridiumid.com/press/veridium-eliminates-passwords-with-veridiumad-for-enterprises-using-microsoft-active-directory/
CVE: CVE-2021-44249
Published: 2022-01-28
Description: Online Motorcycle (Bike) Rental System 1.0 is vulnerable to a Blind Time-Based SQL Injection attack within the login portal. This can lead attackers to remotely dump MySQL database credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://doctorzorka.github.io/Exploits/exploit-1.html; https://www.exploit-db.com/exploits/50429; https://doctorzorka.github.io/Exploits/exploit-1.html
CVE: CVE-2021-45435
Published: 2022-01-28
Description: An SQL Injection vulnerability exists in Sourcecodester Simple Cold Storage Management System using PHP/OOP 1.0 via the username field in login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://kuiilsec.github.io/blog/cve-2021-45436/; https://kuiilsec.github.io/blog/cve-2021-45436/
CVE: CVE-2020-25905
Published: 2022-01-28
Description: An SQL Injection vulnerabilty exists in Sourcecodester Mobile Shop System in PHP MySQL 1.0 via the email parameter in (1) login.php or (2) LoginAsAdmin.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/159132/Mobile-Shop-System-1.0-SQL-Injection.html; https://www.exploit-db.com/exploits/48916; https://packetstormsecurity.com/files/159132/Mobile-Shop-System-1.0-SQL-Injection.html
CVE: CVE-2022-23096
Published: 2022-01-28
Description: An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Header Data, leading to an out-of-bounds read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/pub/scm/network/connman/connman.git/log/; https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html; https://security.gentoo.org/glsa/202310-21
CVE: CVE-2022-23097
Published: 2022-01-28
Description: An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds read.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://git.kernel.org/pub/scm/network/connman/connman.git/log/; https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html; https://security.gentoo.org/glsa/202310-21
CVE: CVE-2022-23098
Published: 2022-01-28
Description: An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://git.kernel.org/pub/scm/network/connman/connman.git/log/; https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html; https://security.gentoo.org/glsa/202310-21
CVE: CVE-2022-23863
Published: 2022-01-28
Description: Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.
CVSS Score: 6.5 (MEDIUM)
References: https://www.manageengine.com/products/desktop-central/privilege-escalation-vulnerability.html; https://www.manageengine.com/products/desktop-central/privilege-escalation-vulnerability.html
CVE: CVE-2021-34073
Published: 2022-01-28
Description: A Cross Site Scripting (XSS) vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.0 via the Category parameter in an add function in category/index.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49904; https://www.exploit-db.com/exploits/49904
CVE: CVE-2021-45897
Published: 2022-01-28
Description: SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.
CVSS Score: 8.8 (HIGH)
References: https://docs.suitecrm.com/8.x/admin/releases/8.0/; https://docs.suitecrm.com/admin/releases/7.12.x/; https://github.com/manuelz120/CVE-2021-45897
CVE: CVE-2021-45898
Published: 2022-01-28
Description: SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion.
CVSS Score: 9.8 (CRITICAL)
References: https://docs.suitecrm.com/8.x/admin/releases/8.0/; https://docs.suitecrm.com/admin/releases/7.12.x/; https://docs.suitecrm.com/8.x/admin/releases/8.0/
CVE: CVE-2021-45899
Published: 2022-01-28
Description: SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://docs.suitecrm.com/8.x/admin/releases/8.0/; https://docs.suitecrm.com/admin/releases/7.12.x/; https://docs.suitecrm.com/8.x/admin/releases/8.0/
CVE: CVE-2022-22294
Published: 2022-01-28
Description: A SQL injection vulnerability exists in ZFAKA<=1.43 which an attacker can use to complete SQL injection in the foreground and add a background administrator account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/zfaka-plus/zfaka/pull/237; https://www.cnblogs.com/J0o1ey/p/15757096.html; https://github.com/zfaka-plus/zfaka/pull/237
CVE: CVE-2021-40395
Published: 2022-01-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-41608
Published: 2022-01-28
Description: A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve survey user submitted data by modifying the value of the ID parameter in sequential order beginning from 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://www.classapps.com/product_ssv5.aspx; https://www.optiv.com/insights/source-zero/blog/classapps-inc-selectsurveynet-v50-vulnerabilities-disclosure; https://www.classapps.com/product_ssv5.aspx
CVE: CVE-2021-41609
Published: 2022-01-28
Description: SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve data from the application's backend database via boolean-based blind and UNION injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.classapps.com/product_ssv5.aspx; https://www.optiv.com/insights/source-zero/blog/classapps-inc-selectsurveynet-v50-vulnerabilities-disclosure; https://www.classapps.com/product_ssv5.aspx
CVE: CVE-2021-44971
Published: 2022-01-28
Description: Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sensitive information, and even combine it with authenticated command injection to implement RCE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-697
References: http://ac15v10.com; http://tenda.com; https://github.com/21Gun5/my_cve/blob/main/tenda/bypass_auth.md
CVE: CVE-2022-22868
Published: 2022-01-28
Description: Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script via name parameters.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/GibbonEdu/core/issues/1594; https://github.com/truonghuuphuc/CVE; https://github.com/truonghuuphuc/CVE/blob/main/CVE-2022-22868.pdf
CVE: CVE-2016-3735
Published: 2022-01-28
Description: Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset.
CVSS Score: 8.1 (HIGH)
CWE: CWE-335, CWE-335
References: http://piwigo.org/release-2.8.1%2C; https://github.com/Piwigo/Piwigo/commit/f51ee90c66527fd7ff634f3e8d414cb670da068d; https://github.com/Piwigo/Piwigo/issues/470%2C
CVE: CVE-2021-22724
Published: 2022-01-28
Description: A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitted in POST requests sent to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02
CVE: CVE-2021-22725
Published: 2022-01-28
Description: A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitted in POST requests sent to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02
CVE: CVE-2021-22799
Published: 2022-01-28
Description: A CWE-331: Insufficient Entropy vulnerability exists that could cause unintended connection from an internal network to an external network when an attacker manages to decrypt the SESU proxy password from the registry. Affected Product: Schneider Electric Software Update, V2.3.0 through V2.5.1
CVSS Score: 3.8 (LOW)
CWE: CWE-331
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-02
CVE: CVE-2021-22807
Published: 2022-01-28
Description: A CWE-787: Out-of-bounds Write vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is loaded into the GUIcon tool. Affected Product: Eurotherm by Schneider Electric GUIcon Version 2.0 (Build 683.003) and prior
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07
CVE: CVE-2021-22808
Published: 2022-01-28
Description: A CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is loaded into the GUIcon tool. Affected Product: Eurotherm by Schneider Electric GUIcon Version 2.0 (Build 683.003) and prior
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07
CVE: CVE-2021-22809
Published: 2022-01-28
Description: A CWE-125:Out-of-Bounds Read vulnerability exists that could cause unintended data disclosure when a malicious *.gd1 configuration file is loaded into the GUIcon tool. Affected Product: Eurotherm by Schneider Electric GUIcon Version 2.0 (Build 683.003) and prior
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-07
CVE: CVE-2021-22816
Published: 2022-01-28
Description: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a Denial of Service of the RTU when receiving a specially crafted request over Modbus, and the RTU is configured as a Modbus server. Affected Products: SCADAPack 312E, 313E, 314E, 330E, 333E, 334E, 337E, 350E and 357E RTUs with firmware V8.18.1 and prior
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-01
CVE: CVE-2021-22818
Published: 2022-01-28
Description: A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the charging station web interface by performing brute force attacks. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02