deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-25392
Published: 2021-06-11
Description: Improper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1 allows local attackers to get sensitive information via changing the path.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200, CWE-326
References: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/
CVE: CVE-2021-25393
Published: 2021-06-11
Description: Improper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows local attackers to get permissions to access system uid data.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94, CWE-732
References: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/
CVE: CVE-2021-25394
Published: 2021-06-11
Description: A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-416, CWE-362, CWE-416
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25394
CVE: CVE-2021-25395
Published: 2021-06-11
Description: A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25395
CVE: CVE-2021-25396
Published: 2021-06-11
Description: An improper input validation vulnerability in NPU firmware prior to SMR MAY-2021 Release 1 allows arbitrary memory write and code execution.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5
CVE: CVE-2021-25397
Published: 2021-06-11
Description: An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of telephony process via untrusted applications.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-926
References: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/
CVE: CVE-2021-25398
Published: 2021-06-11
Description: Intent redirection vulnerability in Bixby Voice prior to version 3.1.12 allows attacker to access contacts.
CVSS Score: 3.3 (LOW)
CWE: CWE-561
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5
CVE: CVE-2021-25399
Published: 2021-06-11
Description: Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege.
CVSS Score: 7.1 (HIGH)
CWE: CWE-285
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5
CVE: CVE-2021-25400
Published: 2021-06-11
Description: Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action.
CVSS Score: 7.8 (HIGH)
CWE: CWE-926
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5
CVE: CVE-2021-25401
Published: 2021-06-11
Description: Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5
CVE: CVE-2021-25402
Published: 2021-06-11
Description: Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information.
CVSS Score: 3.3 (LOW)
CWE: CWE-922, CWE-922
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5
CVE: CVE-2021-25403
Published: 2021-06-11
Description: Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) and above allows attacker to access contacts and file provider using SettingWebView component.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5
CVE: CVE-2021-25404
Published: 2021-06-11
Description: Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log.
CVSS Score: 3.3 (LOW)
CWE: CWE-922, CWE-922
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5
CVE: CVE-2021-25405
Published: 2021-06-11
Description: An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to access local files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5
CVE: CVE-2021-25406
Published: 2021-06-11
Description: Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-922, CWE-863
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=5
CVE: CVE-2021-25407
Published: 2021-06-11
Description: A possible out of bounds write vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://packetstormsecurity.com/files/163198/Samsung-NPU-npu_session_format-Out-Of-Bounds-Write.html; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; http://packetstormsecurity.com/files/163198/Samsung-NPU-npu_session_format-Out-Of-Bounds-Write.html
CVE: CVE-2021-25408
Published: 2021-06-11
Description: A possible buffer overflow vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write and code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6
CVE: CVE-2021-25409
Published: 2021-06-11
Description: Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification via physically configuring device.
CVSS Score: 2.4 (LOW)
CWE: CWE-703, CWE-862
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6
CVE: CVE-2021-25410
Published: 2021-06-11
Description: Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated privilege.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-863
References: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/
CVE: CVE-2021-25411
Published: 2021-06-11
Description: Improper address validation vulnerability in RKP api prior to SMR JUN-2021 Release 1 allows root privileged local attackers to write read-only kernel memory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6
CVE: CVE-2021-25412
Published: 2021-06-11
Description: An improper access control vulnerability in genericssoservice prior to SMR JUN-2021 Release 1 allows local attackers to execute protected activity with system privilege via untrusted applications.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6
CVE: CVE-2021-25413
Published: 2021-06-11
Description: Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to get permissions to access arbitrary data with Samsung Contacts privilege.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/
CVE: CVE-2021-25414
Published: 2021-06-11
Description: Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to copy or overwrite arbitrary files with Samsung Contacts privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/
CVE: CVE-2021-25415
Published: 2021-06-11
Description: Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memory as writable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-94, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6
CVE: CVE-2021-25416
Published: 2021-06-11
Description: Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executable kernel page outside code area.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94, CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6
CVE: CVE-2021-25417
Published: 2021-06-11
Description: Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6; https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=6
CVE: CVE-2021-25418
Published: 2021-06-11
Description: Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in specific condition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-863
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6
CVE: CVE-2021-25419
Published: 2021-06-11
Description: Non-compliance of recommended secure coding scheme in Samsung Internet prior to version 14.0.1.62 allows attackers to display fake URL in address bar via phising URL link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-703
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6
CVE: CVE-2021-25420
Published: 2021-06-11
Description: Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-779, CWE-532
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6
CVE: CVE-2021-25421
Published: 2021-06-11
Description: Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-779, CWE-532
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6
CVE: CVE-2021-25422
Published: 2021-06-11
Description: Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-779, CWE-532
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6
CVE: CVE-2021-25423
Published: 2021-06-11
Description: Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone via log.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-779, CWE-532
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6
CVE: CVE-2021-25424
Published: 2021-06-11
Description: Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take over the user's bluetooth device without user awareness.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6
CVE: CVE-2021-25425
Published: 2021-06-11
Description: Improper check vulnerability in Samsung Health prior to version 6.17 allows attacker to read internal cache data via exported component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-703, CWE-754
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6; https://security.samsungmobile.com/serviceWeb.smsb?year=2021&month=6
CVE: CVE-2021-28687
Published: 2021-06-11
Description: HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later, an initialization function was introduced for the structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl, this will have no security-relevant effect: every VM has its own independent monitoring process, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the toolstack, losing the state of any in-progress operations (localized DoS), and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-909
References: https://security.gentoo.org/glsa/202107-30; https://xenbits.xenproject.org/xsa/advisory-368.txt; https://security.gentoo.org/glsa/202107-30
CVE: CVE-2021-28689
Published: 2021-06-11
Description: x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-212
References: https://xenbits.xenproject.org/xsa/advisory-370.txt; https://xenbits.xenproject.org/xsa/advisory-370.txt
CVE: CVE-2021-29754
Published: 2021-06-11
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inbound Trust Association Interceptor (TAI). IBM X-Force ID: 202006.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/202006; https://www.ibm.com/support/pages/node/6462627; https://exchange.xforce.ibmcloud.com/vulnerabilities/202006
CVE: CVE-2020-13663
Published: 2021-06-11
Description: Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.drupal.org/sa-core-2020-004; https://www.drupal.org/sa-core-2020-004
CVE: CVE-2021-20591
Published: 2021-06-11
Description: Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R00/01/02CPU all versions, R04/08/16/32/120(EN)CPU all versions, R08/16/32/120SFCPU all versions, R08/16/32/120PCPU all versions, R08/16/32/120PSFCPU all versions) allows a remote unauthenticated attacker to prevent legitimate clients from connecting to the MELSOFT transmission port (TCP/IP) by not closing a connection properly, which may lead to a denial of service (DoS) condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://jvn.jp/vu/JVNVU98060539/index.html; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-003_en.pdf; https://jvn.jp/vu/JVNVU98060539/index.html
CVE: CVE-2021-22175
Published: 2021-06-11
Description: When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json; https://gitlab.com/gitlab-org/gitlab/-/issues/294178; https://hackerone.com/reports/1059596
CVE: CVE-2021-22181
Published: 2021-06-11
Description: A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources.
CVSS Score: 7.7 (HIGH)
CWE: CWE-400
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22181.json; https://gitlab.com/gitlab-org/gitlab/-/issues/249100; https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22181.json
CVE: CVE-2021-22749
Published: 2021-06-11
Description: A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior that could cause information leak concerning the current RTU configuration including communication parameters dedicated to telemetry, when a specially crafted HTTP request is sent to the web server of the module.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-05
CVE: CVE-2021-22750
Published: 2021-06-11
Description: A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21041 and prior that could result in loss of data or remote code execution due to missing length checks, when a malicious CGF file is imported to IGSS Definition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01
CVE: CVE-2021-22751
Published: 2021-06-11
Description: A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or execution of arbitrary code due to lack of input validation, when a malicious CGF (Configuration Group File) file is imported to IGSS Definition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01
CVE: CVE-2021-22752
Published: 2021-06-11
Description: A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing size checks, when a malicious WSP (Workspace) file is being parsed by IGSS Definition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01
CVE: CVE-2021-22753
Published: 2021-06-11
Description: A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing length checks, when a malicious WSP file is being parsed by IGSS Definition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01
CVE: CVE-2021-22754
Published: 2021-06-11
Description: A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to lack of proper validation of user-supplied data, when a malicious CGF file is imported to IGSS Definition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01; http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-01