deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-21905
Published: 2021-12-22
Description: Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locations. The Garrett iC Module exposes an authenticated CLI over TCP port 6877. This interface is used by a secondary GUI client, called “CMA Connect”, to interact with the iC Module on behalf of the user. After a client successfully authenticates, they can send plaintext commands to manipulate the device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1357; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1357
CVE: CVE-2021-21906
Published: 2021-12-22
Description: Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is used at various locations. The Garrett iC Module exposes an authenticated CLI over TCP port 6877. This interface is used by a secondary GUI client, called “CMA Connect”, to interact with the iC Module on behalf of the user. Every time a user submits a password to the CLI password prompt, the buffer containing their input is passed as the password parameter to the checkPassword function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1357; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1357
CVE: CVE-2021-21907
Published: 2021-12-22
Description: A directory traversal vulnerability exists in the CMA CLI getenv command functionality of Garrett Metal Detectors’ iC Module CMA Version 5.0. A specially-crafted command line argument can lead to local file inclusion. An attacker can provide malicious input to trigger this vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1358; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1358
CVE: CVE-2021-21908
Published: 2021-12-22
Description: Specially-crafted command line arguments can lead to arbitrary file deletion. The handle_delete function does not attempt to sanitize or otherwise validate the contents of the [file] parameter (passed to the function as argv[1]), allowing an authenticated attacker to supply directory traversal primitives and delete semi-arbitrary files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1359; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1359
CVE: CVE-2021-21909
Published: 2021-12-22
Description: Specially-crafted command line arguments can lead to arbitrary file deletion in the del .cnt|.log file delete command. An attacker can provide malicious inputs to trigger this vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1359; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1359
CVE: CVE-2021-21910
Published: 2021-12-22
Description: A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1360; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1360
CVE: CVE-2021-21911
Published: 2021-12-22
Description: A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-269
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1360; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1360
CVE: CVE-2021-21912
Published: 2021-12-22
Description: A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1360; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1360
CVE: CVE-2021-21915
Published: 2021-12-22
Description: An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at ‘company_filter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1363; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1363
CVE: CVE-2021-21916
Published: 2021-12-22
Description: An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at 'description_filter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1363; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1363
CVE: CVE-2021-21917
Published: 2021-12-22
Description: An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at '‘ord’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1363; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1363
CVE: CVE-2021-21918
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘name_filter’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery attack.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1364; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1364
CVE: CVE-2021-21919
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ord’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery attack.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1364; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1364
CVE: CVE-2021-21920
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘surname_filter’ parameter with the administrative account or through cross-site request forgery.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1365; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1365
CVE: CVE-2021-21921
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘name_filter’ parameter with the administrative account or through cross-site request forgery.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1365; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1365
CVE: CVE-2021-21922
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘username_filter’ parameter with the administrative account or through cross-site request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1365; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1365
CVE: CVE-2021-21923
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘company_filter’ parameter with the administrative account or through cross-site request forgery.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1365; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1365
CVE: CVE-2021-21924
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘desc_filter’ parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21925
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘firm_filter’ parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21926
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘health_filter’ parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21927
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘loc_filter’ parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21928
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘mac_filter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21929
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘prod_filter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21930
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘sn_filter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21931
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at‘ stat_filter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21932
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘name_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21933
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘esn_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21934
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘imei_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21935
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘host_alt_filter2’ parameter. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21936
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘health_alt_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21937
Published: 2021-12-22
Description: A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘host_alt_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1366
CVE: CVE-2021-21952
Published: 2021-12-22
Description: An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to increased privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1379; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1379
CVE: CVE-2021-21953
Published: 2021-12-22
Description: An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted man-in-the-middle attack can lead to increased privileges.
CVSS Score: 8.1 (HIGH)
CWE: CWE-300
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1380; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1380
CVE: CVE-2021-23228
Published: 2021-12-22
Description: DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET Request.QueryString”.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03; https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03
CVE: CVE-2021-31558
Published: 2021-12-22
Description: DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr” of the script “DIAE_hierarchyHandler.ashx”.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03; https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03
CVE: CVE-2021-36885
Published: 2021-12-22
Description: Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/contact-form-cfdb7/wordpress-contact-form-7-database-addon-cfdb7-plugin-1-2-6-1-unauthenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/contact-form-cfdb7/#developers; https://patchstack.com/database/vulnerability/contact-form-cfdb7/wordpress-contact-form-7-database-addon-cfdb7-plugin-1-2-6-1-unauthenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2021-36886
Published: 2021-12-22
Description: Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/contact-form-cfdb7/wordpress-contact-form-7-database-addon-cfdb7-plugin-1-2-5-9-cross-site-request-forgery-csrf-vulnerability; https://wordpress.org/plugins/contact-form-cfdb7/#developers; https://patchstack.com/database/vulnerability/contact-form-cfdb7/wordpress-contact-form-7-database-addon-cfdb7-plugin-1-2-5-9-cross-site-request-forgery-csrf-vulnerability
CVE: CVE-2021-39306
Published: 2021-12-22
Description: A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an attacker sends a big size Authentication challenge text in WEP security.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.amebaiot.com/en/security_bulletin/cve-2021-39306/; https://www.realtek.com; https://www.amebaiot.com/en/security_bulletin/cve-2021-39306/
CVE: CVE-2021-40393
Published: 2021-12-22
Description: An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forked version of Gerbv (commit 71493260). A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-787
References: https://lists.debian.org/debian-lts-announce/2023/09/msg00040.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37OSNNO5N5FJZP6ZBYRJMML5HYMJQIX7/; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1404
CVE: CVE-2021-40394
Published: 2021-12-22
Description: An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forked version of Gerbv (commit 71493260). A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://lists.debian.org/debian-lts-announce/2023/09/msg00040.html; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1404; https://www.debian.org/security/2022/dsa-5306
CVE: CVE-2021-40417
Published: 2021-12-22
Description: When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that were submitted with the job along with fields that were parsed for the submitted video by the R3D SDK to calculate the size of a heap buffer. Due to an integer overflow with regards to this calculation, this can result in an undersized heap buffer being allocated. When this heap buffer is written to, a heap-based buffer overflow will occur. This can result in code execution under the context of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-680, CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1426; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1426
CVE: CVE-2021-40418
Published: 2021-12-22
Description: When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUID that was parsed from a frame within the video container. Upon destruction of the object that owns it, the uninitialized member will be dereferenced and then destroyed using the object’s virtual destructor. Due to the object property being uninitialized, this can result in dereferencing an arbitrary pointer for the object’s virtual method table, which can result in code execution under the context of the application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-457, CWE-908
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1427; https://talosintelligence.com/vulnerability_reports/TALOS-2021-1427
CVE: CVE-2021-44471
Published: 2021-12-22
Description: DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “name” of the script “DIAE_HandlerAlarmGroup.ashx”.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03; https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03
CVE: CVE-2021-44544
Published: 2021-12-22
Description: DIAEnergie Version 1.7.5 and prior is vulnerable to multiple cross-site scripting vulnerabilities when arbitrary code is injected into the parameter “name” of the script “HandlerEnergyType.ashx”.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03; https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03