deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-26144
Published: 2021-05-11
Description: An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2021/05/11/12; https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf; https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
CVE: CVE-2020-26145
Published: 2021-05-11
Description: An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2021/05/11/12; https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf; https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
CVE: CVE-2020-26146
Published: 2021-05-11
Description: An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by design.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2021/05/11/12; https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf; https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
CVE: CVE-2020-26147
Published: 2021-05-11
Description: An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.
CVSS Score: 5.4 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2021/05/11/12; https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf; https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
CVE: CVE-2021-32089
Published: 2021-05-11
Description: An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices. An unauthenticated attacker can upload arbitrary files to the filesystem that can then be accessed through the web interface. This can lead to information disclosure and code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.securifera.com/advisories/cve-2021-32089/; https://www.zebra.com/us/en/support-downloads/rfid/rfid-readers/fx9500.html; https://www.securifera.com/advisories/cve-2021-32089/
CVE: CVE-2021-20309
Published: 2021-05-11
Description: A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=1946722; https://lists.debian.org/debian-lts-announce/2021/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
CVE: CVE-2021-20310
Published: 2021-05-11
Description: A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=1946728; https://bugzilla.redhat.com/show_bug.cgi?id=1946728
CVE: CVE-2021-20311
Published: 2021-05-11
Description: A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=1946739; https://bugzilla.redhat.com/show_bug.cgi?id=1946739
CVE: CVE-2021-20312
Published: 2021-05-11
Description: A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://bugzilla.redhat.com/show_bug.cgi?id=1946742; https://lists.debian.org/debian-lts-announce/2021/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
CVE: CVE-2021-20313
Published: 2021-05-11
Description: A flaw was found in ImageMagick in versions before 7.0.11. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://bugzilla.redhat.com/show_bug.cgi?id=1947019; https://lists.debian.org/debian-lts-announce/2021/06/msg00000.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
CVE: CVE-2021-32604
Published: 2021-05-11
Description: Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2-3_release_notes.htm; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/solarwinds-serv-u-1523-share-url-xss-cve-2021-32604/; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29000
CVE: CVE-2021-32605
Published: 2021-05-11
Description: zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://www.zzzcms.com/a/news/31_282_1.html; https://srcincite.io/advisories/src-2021-0015/; http://www.zzzcms.com/a/news/31_282_1.html
CVE: CVE-2021-32606
Published: 2021-05-11
Description: In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2021/05/12/1; http://www.openwall.com/lists/oss-security/2021/05/13/2; http://www.openwall.com/lists/oss-security/2021/05/14/1
CVE: CVE-2021-3504
Published: 2021-05-11
Description: A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1949687; https://lists.debian.org/debian-lts-announce/2021/05/msg00011.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5BNKNVYFL36P2GBEB5O36LHFRYU575H/
CVE: CVE-2020-36289
Published: 2021-05-12
Description: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://jira.atlassian.com/browse/JRASERVER-71559; https://jira.atlassian.com/browse/JRASERVER-71559
CVE: CVE-2021-23872
Published: 2021-05-12
Description: Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by manipulating a symbolic link in the IOCTL interface.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: http://service.mcafee.com/FAQDocument.aspx?&id=TS103146; http://service.mcafee.com/FAQDocument.aspx?&id=TS103146
CVE: CVE-2021-23891
Published: 2021-05-12
Description: Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by impersonating a client token which could lead to the bypassing of MTP self-defense.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: http://service.mcafee.com/FAQDocument.aspx?&id=TS103146; http://service.mcafee.com/FAQDocument.aspx?&id=TS103146
CVE: CVE-2021-23892
Published: 2021-05-12
Description: By exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Prevention and Firewall (ENSL TP/FW) installation process, a local user can perform a privilege escalation attack to obtain administrator privileges for the purpose of executing arbitrary code through insecure use of predictable temporary file locations.
CVSS Score: 8.2 (HIGH)
CWE: CWE-59, CWE-367
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10355; https://kc.mcafee.com/corporate/index?page=content&id=SB10355
CVE: CVE-2020-35198
Published: 2021-05-12
Description: An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-35198; https://support2.windriver.com/index.php?page=security-notices; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2020-13873
Published: 2021-05-12
Description: A SQL Injection vulnerability in get_topic_info() in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers (pre-authentication) to bypass the admin page via a leaked password-reset token of the admin. (As an admin, an attacker can upload a PHP shell and execute remote code on the operating system.)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://codologic.com/forum/; https://blog.sonarsource.com/codoforum-4.8.7-critical-code-vulnerabilities-explained; https://community.sonarsource.com/c/announce/stories/23
CVE: CVE-2019-19276
Published: 2021-05-12
Description: A vulnerability has been identified in SIMATIC HMI Comfort Panels 1st Generation (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels (All versions < V16 Update 4). Specially crafted packets sent to port 161/udp can cause the SNMP service of affected devices to crash. A manual restart of the device is required to resume operation of the service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-594364.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-594364.pdf
CVE: CVE-2020-25242
Published: 2021-05-12
Description: A vulnerability has been identified in SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Standard (incl. SIPLUS variants) (All versions). Specially crafted packets sent to TCP port 102 could cause a Denial-of-Service condition on the affected devices. A cold restart might be necessary in order to recover.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://cert-portal.siemens.com/productcert/pdf/ssa-676775.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-676775.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-07
CVE: CVE-2020-28393
Published: 2021-05-12
Description: An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device on the SCALANCE XM-400, XR-500 (All versions prior to v6.4).
CVSS Score: 7.5 (HIGH)
CWE: CWE-682
References: https://cert-portal.siemens.com/productcert/pdf/ssa-116379.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-10; https://cert-portal.siemens.com/productcert/pdf/ssa-116379.pdf
CVE: CVE-2021-20277
Published: 2021-05-12
Description: A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=1941402; https://lists.debian.org/debian-lts-announce/2021/03/msg00036.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLZ74IF2N75VQSIHBL4B3P5WKWQCXSRY/
CVE: CVE-2021-25660
Published: 2021-05-12
Description: A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4). SmartVNC has an out-of-bounds memory access vulnerability that could be triggered on the server side when sending data from the client, which could result in a Denial-of-Service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-788, CWE-119
References: https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf
CVE: CVE-2021-25661
Published: 2021-05-12
Description: A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4). SmartVNC has an out-of-bounds memory access vulnerability that could be triggered on the client side when sending data from the server, which could result in a Denial-of-Service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-788
References: https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12; https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf
CVE: CVE-2021-25662
Published: 2021-05-12
Description: A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4). SmartVNC client fails to handle an exception properly if the program execution process is modified after sending a packet from the server, which could result in a Denial-of-Service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12; https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf
CVE: CVE-2021-27383
Published: 2021-05-12
Description: A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). SmartVNC has a heap allocation leak vulnerability in the server Tight encoder, which could result in a Denial-of-Service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12
CVE: CVE-2021-27384
Published: 2021-05-12
Description: A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). SmartVNC has an out-of-bounds memory access vulnerability in the device layout handler, represented by a binary data stream on client side, which can potentially result in code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-788
References: https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11
CVE: CVE-2021-27385
Published: 2021-05-12
Description: A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). A remote attacker could send specially crafted packets to SmartVNC device layout handler on client side, which could influence the amount of resources consumed and result in a Denial-of-Service (infinite loop) condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-835
References: https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12
CVE: CVE-2021-27386
Published: 2021-05-12
Description: A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). SmartVNC has a heap allocation leak vulnerability in the device layout handler on client side, which could result in a Denial-of-Service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf