deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-39063
Published: 2021-12-13
Description: IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information due to a misconfiguration in access control headers. IBM X-Force ID: 214956.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-346
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/214956; https://www.ibm.com/support/pages/node/6525346; https://exchange.xforce.ibmcloud.com/vulnerabilities/214956
CVE: CVE-2021-43801
Published: 2021-12-13
Description: Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https://github.com/mercurius-js/mercurius/pull/678 and shipped as v8.11.2. As a workaround users may use a custom error handler.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://github.com/mercurius-js/mercurius/issues/677; https://github.com/mercurius-js/mercurius/pull/678/commits/732b2f895312da8deadd7b173dcd2d141d54b223; https://github.com/mercurius-js/mercurius/security/advisories/GHSA-273r-rm8g-7f3x
CVE: CVE-2021-43814
Published: 2021-12-13
Description: Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions. No workaround are known and users are advised to upgrade.
CVSS Score: 7.7 (HIGH)
CWE: CWE-787
References: https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406; https://github.com/rizinorg/rizin/issues/2083; https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r
CVE: CVE-2021-43817
Published: 2021-12-13
Description: Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe, and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser, as well as the session's authentication token which was also passed in at iframe creation time. Users should upgrade to Collabora Online 6.4.16 or higher or Collabora Online 4.2.20 or higher. Collabora Online Development Edition 21.11 is not affected.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/CollaboraOnline/online/security/advisories/GHSA-7f6h-v9mx-58q9; https://github.com/CollaboraOnline/online/security/advisories/GHSA-7f6h-v9mx-58q9
CVE: CVE-2021-43822
Published: 2021-12-13
Description: Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://github.com/jackalope/jackalope-doctrine-dbal/commit/9d179a36d320330ddb303ea3a7c98d3a33d231db; https://github.com/jackalope/jackalope-doctrine-dbal/security/advisories/GHSA-ph98-v78f-jqrm; https://github.com/jackalope/jackalope-doctrine-dbal/commit/9d179a36d320330ddb303ea3a7c98d3a33d231db
CVE: CVE-2021-43823
Published: 2021-12-13
Description: Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects the Saved Searches and Code Monitoring features. A successful attack would require an authenticated bad actor to create many Saved Searches or Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in version 3.33.2 and any future versions of Sourcegraph. We strongly encourage upgrading to secure versions. If you are unable to, you may disable Saved Searches and Code Monitors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-203
References: https://github.com/sourcegraph/sourcegraph/commit/a88d90a8302c492282186d39718cd8fb093c14fa; https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-cpq7-hmvv-29w9; https://github.com/sourcegraph/sourcegraph/commit/a88d90a8302c492282186d39718cd8fb093c14fa
CVE: CVE-2020-19042
Published: 2021-12-13
Description: Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zzb1999/CVE/blob/master/zzcms/XSS.md; https://github.com/zzb1999/CVE/blob/master/zzcms/XSS.md
CVE: CVE-2021-24045
Published: 2021-12-13
Description: A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843, CWE-843
References: https://github.com/facebook/hermes/commit/55e1b2343f4deb1a1b5726cfe1e23b2068217ff2; https://www.facebook.com/security/advisories/cve-2021-24045; https://github.com/facebook/hermes/commit/55e1b2343f4deb1a1b5726cfe1e23b2068217ff2
CVE: CVE-2021-41272
Published: 2021-12-13
Description: Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed integers. Smart contracts that ask for shifts between approximately 2 billion and 4 billion bits (nonsensical but valid values for the operation) will fail to execute and hence fail to validate. In networks where vulnerable versions are mining with other clients or non-vulnerable versions this will result in a fork and the relevant transactions will not be included in the fork. In networks where vulnerable versions are not mining (such as Rinkeby) no fork will result and the validator nodes will stop accepting blocks. In networks where only vulnerable versions are mining the relevant transaction will not be included in any blocks. When the network adds a non-vulnerable version the network will act as in the first case. Besu 21.10.2 contains a patch for this issue. Besu 21.7.4 is not vulnerable and clients can roll back to that version. There is a workaround available: Once a transaction with the relevant shift operations is included in the canonical chain, the only remediation is to make sure all nodes are on non-vulnerable versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-681
References: https://github.com/hyperledger/besu/commit/4170524ac3b45185704fcfbdeeb71b0b05dfa0a1; https://github.com/hyperledger/besu/pull/3039; https://github.com/hyperledger/besu/security/advisories/GHSA-7pg2-p5vj-xp5h
CVE: CVE-2021-3831
Published: 2021-12-14
Description: gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gnuboard/gnuboard5/commit/2e81619ea87bc9c0b4a073d8df3c7693a6fdbf0d; https://huntr.dev/bounties/25775287-88cd-4f00-b978-692d627dff04; https://github.com/gnuboard/gnuboard5/commit/2e81619ea87bc9c0b4a073d8df3c7693a6fdbf0d
CVE: CVE-2021-41547
Published: 2021-12-14
Description: A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.11), Teamcenter Active Workspace V5.0 (All versions < V5.0.10), Teamcenter Active Workspace V5.1 (All versions < V5.1.6), Teamcenter Active Workspace V5.2 (All versions < V5.2.3). The application contains an unsafe unzipping pattern that could lead to a zip path traversal attack. This could allow and attacker to execute a remote shell with admin rights.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-133772.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-133772.pdf
CVE: CVE-2021-42022
Published: 2021-12-14
Description: A vulnerability has been identified in SIMATIC eaSie PCS 7 Skill Package (All versions < V21.00 SP3). When downloading files, the affected systems do not properly neutralize special elements within the pathname. An attacker could then cause the pathname to resolve to a location outside of the restricted directory on the server and read unexpected critical files. The affected file download function is disabled by default.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://cert-portal.siemens.com/productcert/pdf/ssa-199605.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-199605.pdf
CVE: CVE-2021-42023
Published: 2021-12-14
Description: A vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All versions). The RSA white-box implementation in affected applications insufficiently protects the built-in private keys that are required to decrypt electronic intellectual property (IP) data in accordance with the IEEE 1735 recommended practice. This could allow a sophisticated attacker to discover the keys, bypassing the protection intended by the IEEE 1735 recommended practice.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://cert-portal.siemens.com/productcert/pdf/ssa-400332.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-400332.pdf
CVE: CVE-2021-42024
Published: 2021-12-14
Description: A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < 2021.3.1). The starview+.exe application lacks proper validation of user-supplied data when parsing scene files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-161331.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-161331.pdf
CVE: CVE-2021-42027
Published: 2021-12-14
Description: A vulnerability has been identified in SINUMERIK Edge (All versions < V3.2). The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between the client and the intended server.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://cert-portal.siemens.com/productcert/pdf/ssa-523250.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-523250.pdf
CVE: CVE-2021-44001
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14974)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-004/; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44002
Published: 2021-12-14
Description: A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15058, ZDI-CAN-19076, ZDI-CAN-19077)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44003
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This could allow an attacker to cause a denial-of-service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-457, CWE-908
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44004
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44005
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44006
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted TIFF files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44007
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll contains an off-by-one error in the heap while parsing specially crafted TIFF files. This could allow an attacker to cause a denial-of-service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-193
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44008
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44009
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44010
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing TIFF files. An attacker could leverage this vulnerability to leak information in the context of the current process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44011
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll is vulnerable to an out of bounds read past the end of an allocated buffer while parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15101)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-007/; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44012
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15102)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-008/; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44013
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The DL180pdfl.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15103)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-009/; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44014
Published: 2021-12-14
Description: A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15057, ZDI-CAN-19081)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44015
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The VCRUNTIME140.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted CGM files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15109)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-010/; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44017
Published: 2021-12-14
Description: A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Image.dll is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted TIF files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-15111)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf; https://www.zerodayinitiative.com/advisories/ZDI-22-011/; https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf
CVE: CVE-2021-44165
Published: 2021-12-14
Description: A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41). The affected firmware contains a buffer overflow vulnerability in the web application that could allow a remote attacker with engineer or admin priviliges to potentially perform remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/pdf/ssa-496292.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-496292.pdf
CVE: CVE-2021-44430
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-14829)
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44431
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to an out of bounds read past the end of an allocated buffer when parsing specially crafted JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14841)
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf
CVE: CVE-2021-44432
Published: 2021-12-14
Description: A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0). JTTK library in affected products is vulnerable to stack based buffer overflow while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14845)
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-802578.pdf