deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-24169
Published: 2022-02-04
Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindAdd. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IPMacBindRule parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_41/41.md; https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_41/41.md
CVE: CVE-2022-24170
Published: 2022-02-04
Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerability allows attackers to execute arbitrary commands via the IPsecLocalNet and IPsecRemoteNet parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_36/36.md; https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_36/36.md
CVE: CVE-2022-24171
Published: 2022-02-04
Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_35/35.md; https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_35/35.md
CVE: CVE-2022-24172
Published: 2022-02-04
Description: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDhcpBindRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the addDhcpRules parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_43/43.md; https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_43/43.md
CVE: CVE-2021-44899
Published: 2022-02-04
Description: Micro-Star International (MSI) Center <= 1.0.31.0 is vulnerable to multiple Privilege Escalation vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests.
CVSS Score: 7.8 (HIGH)
References: https://voidsec.com; https://voidsec.com/advisories/cve-2021-44899/; https://voidsec.com
CVE: CVE-2021-44900
Published: 2022-02-04
Description: Micro-Star International (MSI) App Player <= 4.280.1.6309 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the NTIOLib_X64.sys and BstkDrv_msi2.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests.
CVSS Score: 7.8 (HIGH)
References: https://voidsec.com; https://voidsec.com/advisories/cve-2021-44900/; https://voidsec.com
CVE: CVE-2021-44901
Published: 2022-02-04
Description: Micro-Star International (MSI) Dragon Center <= 2.0.116.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests.
CVSS Score: 7.8 (HIGH)
References: https://voidsec.com; https://voidsec.com/advisories/cve-2021-44901/; https://voidsec.com
CVE: CVE-2021-44903
Published: 2022-02-04
Description: Micro-Star International (MSI) Center Pro <= 2.0.16.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests.
CVSS Score: 7.8 (HIGH)
References: https://voidsec.com; https://voidsec.com/advisories/cve-2021-44903/; https://voidsec.com
CVE: CVE-2021-46320
Published: 2022-02-04
Description: In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-665
References: https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9c22-pwxw-p6hx; https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9c22-pwxw-p6hx
CVE: CVE-2022-23316
Published: 2022-02-04
Description: An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-552
References: https://github.com/taogogo/taocms/issues/15; https://github.com/taogogo/taocms/issues/15
CVE: CVE-2021-44983
Published: 2022-02-04
Description: In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-552
References: https://github.com/taogogo/taocms/issues/10; https://github.com/taogogo/taocms/issues/10
CVE: CVE-2021-43145
Published: 2022-02-04
Description: With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts.
CVSS Score: 8.1 (HIGH)
References: https://zammad.com/de/advisories/zaa-2021-20; https://zammad.com/de/advisories/zaa-2021-20
CVE: CVE-2021-44886
Published: 2022-02-04
Description: In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to.
CVSS Score: 5.3 (MEDIUM)
References: https://zammad.com/en/advisories/zaa-2021-21; https://zammad.com/en/advisories/zaa-2021-21
CVE: CVE-2021-44977
Published: 2022-02-04
Description: In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%960day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/; https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%960day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
CVE: CVE-2021-44978
Published: 2022-02-04
Description: iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5%E5%AF%BC%E8%87%B4%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C0day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/; https://www.icmsdev.com/; https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5%E5%AF%BC%E8%87%B4%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C0day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
CVE: CVE-2021-46398
Published: 2022-02-04
Description: A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.html; https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html; https://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser/
CVE: CVE-2022-24259
Published: 2022-02-04
Description: An incorrect check in the component cdr.php of Voipmonitor GUI before v24.96 allows unauthenticated attackers to escalate privileges via a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://kerbit.io/research/read/blog/3; https://www.voipmonitor.org/changelog-gui?major=5; https://kerbit.io/research/read/blog/3
CVE: CVE-2022-24260
Published: 2022-02-04
Description: A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://kerbit.io/research/read/blog/3; https://www.voipmonitor.org/changelog-gui?major=5; https://kerbit.io/research/read/blog/3
CVE: CVE-2022-24262
Published: 2022-02-04
Description: The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://kerbit.io/research/read/blog/3; https://www.voipmonitor.org/changelog-gui?major=5; https://kerbit.io/research/read/blog/3
CVE: CVE-2021-43635
Published: 2022-02-04
Description: A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jcv8000/Codex; https://github.com/jcv8000/Codex/issues/8; https://github.com/jcv8000/Codex/releases/tag/v1.4.1
CVE: CVE-2021-29393
Published: 2022-02-04
Description: Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inject and execute arbitrary system commands via the unsanitized user-controlled "command" and "commandvalues" parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://ardent-security.com; https://ardent-security.com/en/advisory/asa-2021-01/; https://ardent-security.com
CVE: CVE-2021-29394
Published: 2022-02-04
Description: Account Hijacking in /northstar/Admin/changePassword.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote authenticated users to change the password of any targeted user accounts via lack of proper authorization in the user-controlled "userID" parameter of the HTTP POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://ardent-security.com; https://ardent-security.com/en/advisory/asa-2021-02/; https://ardent-security.com
CVE: CVE-2021-29395
Published: 2022-02-04
Description: Directory travesal in /northstar/filemanager/download.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to download arbitrary files, including JSP source code, across the filesystem of the host of the web application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://Ardent-Security.com; https://ardent-security.com/en/advisory/asa-2021-03/; https://Ardent-Security.com
CVE: CVE-2021-29396
Published: 2022-02-04
Description: Systemic Insecure Permissions in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to use various functionalities without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://Ardent-Security.com; https://ardent-security.com/en/advisory/asa-2021-04/; https://Ardent-Security.com
CVE: CVE-2021-29397
Published: 2022-02-04
Description: Cleartext Transmission of Sensitive Information in /northstar/Admin/login.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote local user to intercept users credentials transmitted in cleartext over HTTP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://Ardent-Security.com; https://ardent-security.com/en/advisory/asa-2021-05/; https://Ardent-Security.com
CVE: CVE-2021-29398
Published: 2022-02-04
Description: Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to browse and list the directories across the entire filesystem of the host of the web application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://Ardent-Security.com; https://ardent-security.com/en/advisory/asa-2021-06/; https://Ardent-Security.com
CVE: CVE-2021-45429
Published: 2022-02-04
Description: A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yr_set_configuration in yara/libyara/libyara.c, which could cause a Denial of Service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/VirusTotal/yara/issues/1616; https://github.com/VirusTotal/yara/issues/1616
CVE: CVE-2022-24249
Published: 2022-02-04
Description: A Null Pointer Dereference vulnerability exists in GPAC 1.1.0 via the xtra_box_write function in /box_code_base.c, which causes a Denial of Service. This vulnerability was fixed in commit 71f9871.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/gpac/gpac/issues/2081; https://github.com/gpac/gpac/issues/2081
CVE: CVE-2021-23470
Published: 2022-02-04
Description: This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077
CVSS Score: 8.2 (HIGH)
CWE: CWE-1321
References: https://github.com/panates/putil-merge/commit/476d00078dfb2827d7c9ee0f2392c81b864f7bc5; https://snyk.io/vuln/SNYK-JS-PUTILMERGE-2391487; https://github.com/panates/putil-merge/commit/476d00078dfb2827d7c9ee0f2392c81b864f7bc5
CVE: CVE-2021-23497
Published: 2022-02-04
Description: This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://github.com/strikeentco/set/commit/b2f942c; https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation/; https://snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-2385945
CVE: CVE-2021-23507
Published: 2022-02-04
Description: The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://github.com/skratchdot/object-path-set/blob/577f5299fed15bb9edd11c940ff3cf0b9f4748d5/index.js%23L8; https://github.com/skratchdot/object-path-set/commit/2d67a714159c4099589b6661fa84e6d2adc31761; https://snyk.io/blog/remediate-javascript-type-confusion-bypassed-input-validation/
CVE: CVE-2021-45408
Published: 2022-02-04
Description: Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://sunil-singh.notion.site/SeedDMS-6-0-15-Open-Redirect-85be8b681b2947a2a75e7416cb56670c; https://sunil-singh.notion.site/SeedDMS-6-0-15-Open-Redirect-85be8b681b2947a2a75e7416cb56670c
CVE: CVE-2022-24129
Published: 2022-02-04
Description: The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allows attackers to interact with arbitrary third-party HTTP services.
CVSS Score: 8.2 (HIGH)
CWE: CWE-918
References: http://shibboleth.net/community/advisories/; http://shibboleth.net/community/advisories/secadv_20220131.txt; https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220127-01_Shibboleth_IdP_OIDC_OP_Plugin_SSRF
CVE: CVE-2022-24448
Published: 2022-02-04
Description: An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.
CVSS Score: 3.3 (LOW)
CWE: CWE-755, CWE-908
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.5; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ac795161c93699d600db16c1a8cc23a65a1eceaf; https://github.com/torvalds/linux/commit/ab0fc21bc7105b54bafd85bd8b82742f9e68898a
CVE: CVE-2021-46671
Published: 2022-02-04
Description: options.c in atftp before 0.7.5 reads past the end of an array, and consequently discloses server-side /etc/group data to a remote client.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://bugs.debian.org/1004974; https://lists.debian.org/debian-lts-announce/2022/05/msg00040.html; https://sourceforge.net/p/atftp/code/ci/9cf799c[PII_REDACTED][PII_REDACTED]79e9f0ef62e5
CVE: CVE-2022-24348
Published: 2022-02-04
Description: Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/; https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7; https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/
CVE: CVE-2022-23329
Published: 2022-02-04
Description: A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gitee.com/jspxcms/Jspxcms/issues/I4QAZN; https://gitee.com/jspxcms/Jspxcms/issues/I4QAZN
CVE: CVE-2022-23330
Published: 2022-02-04
Description: A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR package.
CVSS Score: 8.8 (HIGH)
References: https://gitee.com/JPressProjects/jpress/issues/I4QZZ8; https://gitee.com/JPressProjects/jpress/issues/I4QZZ8
CVE: CVE-2013-20003
Published: 2022-02-04
Description: Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker within radio range to spoof Z-Wave traffic.
CVSS Score: 8.3 (HIGH)
CWE: CWE-327, CWE-338
References: https://orangecyberdefense.com/global/blog/sensepost/blackhat-conference-z-wave-security/; https://sensepost.com/cms/resources/conferences/2013/bh_zwave/Security%20Evaluation%20of%20Z-Wave_WP.pdf; https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/
CVE: CVE-2018-25029
Published: 2022-02-04
Description: The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairing to downgrade and then exploit a different vulnerability (CVE-2013-20003) to intercept and spoof traffic.
CVSS Score: 8.1 (HIGH)
CWE: CWE-757
References: https://community.silabs.com/s/share/a5U1M000000knqNUAQ/updated-your-zwave-smart-locks-are-safe-and-secure; https://www.pentestpartners.com/security-blog/z-shave-exploiting-z-wave-downgrade-attacks/; https://community.silabs.com/s/share/a5U1M000000knqNUAQ/updated-your-zwave-smart-locks-are-safe-and-secure
CVE: CVE-2020-12891
Published: 2022-02-04
Description: AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged user may be able to drop its malicious DLL file in any location which is in path environment variable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1000; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1000
CVE: CVE-2020-12965
Published: 2022-02-04
Description: When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits potentially resulting in data leakage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: http://www.openwall.com/lists/oss-security/2023/12/05/3; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1010; http://www.openwall.com/lists/oss-security/2023/12/05/3
CVE: CVE-2020-12966
Published: 2022-02-04
Description: AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encrypted State (SEV-ES) and Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP). A local authenticated attacker could potentially exploit this vulnerability leading to leaking guest data by the malicious hypervisor.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2022/08/08/6; https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1013; http://www.openwall.com/lists/oss-security/2022/08/08/6
CVE: CVE-2020-7534
Published: 2022-02-04
Description: A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 (All Versions), Modicon Quantum CPUs with integrated Ethernet (Copro): 140CPU65 (All Versions), Modicon Premium CPUs with integrated Ethernet (Copro): TSXP57 (All Versions), Modicon M340 ethernet modules: (BMXNOC0401, BMXNOE01, BMXNOR0200H) (All Versions), Modicon Quantum and Premium factory cast communication modules: (140NOE77111, 140NOC78*00, TSXETY5103, TSXETY4103) (All Versions)
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-01
CVE: CVE-2021-21959
Published: 2022-02-04
Description: A misconfiguration exists in the MQTTS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack, which directly leads to control of device functionality.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1388; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1388
CVE: CVE-2021-21960
Published: 2022-02-04
Description: A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted network packet can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-121, CWE-1284
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1389; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1389
CVE: CVE-2021-21961
Published: 2022-02-04
Description: A stack-based buffer overflow vulnerability exists in the NBNS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted network packet can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1389; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1389