deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-0139
Published: 2022-02-08
Description: Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/radareorg/radare2/commit/37897226a1a31f982bfefdc4aeefc2e50355c73c; https://huntr.dev/bounties/3dcb6f40-45cd-403b-929f-db123fde32c0; https://github.com/radareorg/radare2/commit/37897226a1a31f982bfefdc4aeefc2e50355c73c
CVE: CVE-2022-21702
Published: 2022-02-08
Description: Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cross-site Scripting (XSS) attack. The attacker could either compromise an existing datasource for a specific Grafana instance or either set up its own public service and instruct anyone to set it up in their Grafana instance. To be impacted, all of the following must be applicable. For the data source proxy: A Grafana HTTP-based datasource configured with Server as Access Mode and a URL set, the attacker has to be in control of the HTTP server serving the URL of above datasource, and a specially crafted link pointing at the attacker controlled data source must be clicked on by an authenticated user. For the plugin proxy: A Grafana HTTP-based app plugin configured and enabled with a URL set, the attacker has to be in control of the HTTP server serving the URL of above app, and a specially crafted link pointing at the attacker controlled plugin must be clocked on by an authenticated user. For the backend plugin resource: An attacker must be able to navigate an authenticated user to a compromised plugin through a crafted link. Users are advised to update to a patched version. There are no known workarounds for this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/grafana/grafana/commit/27726868b3d7c613844b55cd209ca93645c99b85; https://github.com/grafana/grafana/security/advisories/GHSA-xc3p-28hw-q24g; https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
CVE: CVE-2022-0518
Published: 2022-02-08
Description: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-122, CWE-787
References: https://github.com/radareorg/radare2/commit/9650e3c352f675687bf6c6f65ff2c4a3d0e288fa; https://huntr.dev/bounties/10051adf-7ddc-4042-8fd0-8e9e0c5b1184; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/
CVE: CVE-2022-0519
Published: 2022-02-08
Description: Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-805, CWE-119
References: https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5; https://huntr.dev/bounties/af85b9e1-d1cf-4c0e-ba12-525b82b7c1e3; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/
CVE: CVE-2022-0520
Published: 2022-02-08
Description: Use After Free in NPM radare2.js prior to 5.6.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/radareorg/radare2/commit/8525ad0b9fd596f4b251bb3d7b114e6dc7ce1ee8; https://huntr.dev/bounties/ce13c371-e5ef-4993-97f3-3d33dcd943a6; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/
CVE: CVE-2022-0521
Published: 2022-02-08
Description: Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-788, CWE-119
References: https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5; https://huntr.dev/bounties/4d436311-bbf1-45a3-8774-bdb666d7f7ca; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/
CVE: CVE-2022-0522
Published: 2022-02-08
Description: Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-786, CWE-119
References: https://github.com/radareorg/radare2/commit/d17a7bdf166108a29a27cd89bf454f9fa6c050d6; https://huntr.dev/bounties/2d45e589-d614-4875-bba1-be0f729e7ca9; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/
CVE: CVE-2022-0523
Published: 2022-02-08
Description: Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/radareorg/radare2/commit/35482cb760db10f87a62569e2f8872dbd95e9269; https://huntr.dev/bounties/9d8d6ae0-fe00-40b9-ae1e-b0e8103bac69; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/
CVE: CVE-2022-21703
Published: 2022-02-08
Description: Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/grafana/grafana/pull/45083; https://github.com/grafana/grafana/security/advisories/GHSA-cmf4-h3xc-jw8w; https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
CVE: CVE-2022-21713
Published: 2022-02-08
Description: Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-639
References: https://github.com/grafana/grafana/pull/45083; https://github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccv; https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/
CVE: CVE-2022-0524
Published: 2022-02-08
Description: Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-840
References: https://github.com/publify/publify/commit/16fceecadbe80ab0ef846b62a12dc7bfff10b8c5; https://huntr.dev/bounties/bfffae58-b3cd-4e0e-b1f2-3db387a22c3d; https://github.com/publify/publify/commit/16fceecadbe80ab0ef846b62a12dc7bfff10b8c5
CVE: CVE-2022-23626
Published: 2022-02-08
Description: m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20, CWE-252
References: http://packetstormsecurity.com/files/167235/m1k1os-Blog-1.3-Remote-Code-Execution.html; https://github.com/m1k1o/blog/commit/6f5e59f1401c4a3cf2e518aa85b231ea14e8a2ef; https://github.com/m1k1o/blog/security/advisories/GHSA-wmqj-5v54-24x4
CVE: CVE-2021-45329
Published: 2022-02-08
Description: Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.gitea.io/2018/09/gitea-1.5.1-is-released/; https://github.com/go-gitea/gitea/pull/4710; https://blog.gitea.io/2018/09/gitea-1.5.1-is-released/
CVE: CVE-2021-45919
Published: 2022-02-08
Description: Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/from-stored-xss-to-rce-using-beef-and-elfinder-cve-2021-45919/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/from-stored-xss-to-rce-using-beef-and-elfinder-cve-2021-45919/
CVE: CVE-2022-23627
Published: 2022-02-08
Description: ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user's access against bot `A` - instead of bot `B`, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/JustArchiNET/ArchiSteamFarm/commit/7a29d9282bdc3280db2a379c24f73916d786f9b4; https://github.com/JustArchiNET/ArchiSteamFarm/commit/f807bdb660e75dee5a34994f2ea70970ca6d0492; https://github.com/JustArchiNET/ArchiSteamFarm/pull/2501
CVE: CVE-2022-24676
Published: 2022-02-09
Description: update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/hyyyp/HYBBS2/issues/33; https://github.com/hyyyp/HYBBS2/issues/33
CVE: CVE-2022-24677
Published: 2022-02-09
Description: Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/hyyyp/HYBBS2/issues/34; https://github.com/hyyyp/HYBBS2/issues/34
CVE: CVE-2022-0525
Published: 2022-02-09
Description: Out-of-bounds Read in Homebrew mruby prior to 3.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/mruby/mruby/commit/0849a2885f81cfd82134992c06df3ccd59052ac7; https://huntr.dev/bounties/e19e109f-acf0-4048-8ee8-1b10a870f1e9; https://github.com/mruby/mruby/commit/0849a2885f81cfd82134992c06df3ccd59052ac7
CVE: CVE-2022-24682
Published: 2022-02-09
Description: An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-116, CWE-116
References: https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/; https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30
CVE: CVE-2022-0526
Published: 2022-02-09
Description: Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/chatwoot/chatwoot/commit/9f37a6e2ba7a7212bb419e318b8061f472e82d9f; https://huntr.dev/bounties/d8f5ce74-2a00-4813-b220-70af771b0edd; https://github.com/chatwoot/chatwoot/commit/9f37a6e2ba7a7212bb419e318b8061f472e82d9f
CVE: CVE-2022-0527
Published: 2022-02-09
Description: Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/chatwoot/chatwoot/commit/a737f89c473e64f9abdf8ff13a3e64edefa28877; https://huntr.dev/bounties/a2f598f6-c142-449a-96f8-b4b2f7a9e228; https://github.com/chatwoot/chatwoot/commit/a737f89c473e64f9abdf8ff13a3e64edefa28877
CVE: CVE-2022-24694
Published: 2022-02-09
Description: In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-552
References: https://bugs.launchpad.net/mahara/+bug/1952808; https://mahara.org/interaction/forum/topic.php?id=8994; https://bugs.launchpad.net/mahara/+bug/1952808
CVE: CVE-2021-37852
Published: 2022-02-09
Description: ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows; https://www.zerodayinitiative.com/advisories/ZDI-22-148/; https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows
CVE: CVE-2022-0536
Published: 2022-02-09
Description: Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
CVSS Score: 2.6 (LOW)
CWE: CWE-212, CWE-212
References: https://github.com/follow-redirects/follow-redirects/commit/62e546a99c07c3ee5e4e0718c84a6ca127c5c445; https://huntr.dev/bounties/7cf2bf90-52da-4d59-8028-a73b132de0db; https://github.com/follow-redirects/follow-redirects/commit/62e546a99c07c3ee5e4e0718c84a6ca127c5c445
CVE: CVE-2021-25939
Published: 2022-02-09
Description: In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL. This feature does not enforce proper filtering of requests performed internally, which can be abused by a highly-privileged attacker to perform blind SSRF and send internal requests to localhost.
CVSS Score: 2.7 (LOW)
CWE: CWE-918, CWE-918
References: https://github.com/arangodb/arangodb/commit/d7b35a6884c6b2802d34d79fb2a79fb2c9ec2175; https://github.com/arangodb/arangodb/commit/d9b7f019d2435f107b19a59190bf9cc27d5f34dd; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25939
CVE: CVE-2021-40837
Published: 2022-02-09
Description: A vulnerability affecting F-Secure antivirus engine before Capricorn update 2022-02-01_01 was discovered whereby decompression of ACE file causes the scanner service to stop. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.
CVSS Score: 4.6 (MEDIUM)
References: https://www.f-secure.com/en/business/support-and-downloads/security-advisories; https://www.f-secure.com/en/business/support-and-downloads/security-advisories/cve-2021-40837; https://www.f-secure.com/en/business/support-and-downloads/security-advisories
CVE: CVE-2022-23378
Published: 2022-02-09
Description: A Cross-Site Scripting (XSS) vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a request made to /admin/allergens/edit/1 is vulnerable.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/TheGetch/CVE-2022-23378; https://tastyigniter.com/; https://github.com/TheGetch/CVE-2022-23378
CVE: CVE-2021-46354
Published: 2022-02-09
Description: Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: http://packetstormsecurity.com/files/166069/Thinfinity-VirtualUI-2.5.26.2-Information-Disclosure.html; http://thinfinity.com; https://github.com/cybelesoft/virtualui/issues/3
CVE: CVE-2021-46360
Published: 2022-02-09
Description: Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/171489/Composr-CMS-10.0.39-Remote-Code-Execution.html; https://github.com/sartlabs/0days/blob/main/Composr-CMS/Exploit.py; http://packetstormsecurity.com/files/171489/Composr-CMS-10.0.39-Remote-Code-Execution.html
CVE: CVE-2022-0538
Published: 2022-02-09
Description: Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2022/02/09/1; https://www.jenkins.io/security/advisory/2022-02-09/#SECURITY-2602; http://www.openwall.com/lists/oss-security/2022/02/09/1
CVE: CVE-2022-0539
Published: 2022-02-09
Description: Cross-site Scripting (XSS) - Stored in Packagist ptrofimov/beanstalk_console prior to 1.7.14.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ptrofimov/beanstalk_console/commit/5aea5f912f6e6d19dedb1fdfc25a29a2e1fc1694; https://huntr.dev/bounties/5f41b182-dda2-4c6f-9668-2a9afaed53af; https://github.com/ptrofimov/beanstalk_console/commit/5aea5f912f6e6d19dedb1fdfc25a29a2e1fc1694
CVE: CVE-2021-3813
Published: 2022-02-09
Description: Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-639
References: https://github.com/chatwoot/chatwoot/commit/9454c6b14f75e778ef98cf84bdafdf0ed8ae5705; https://huntr.dev/bounties/36f02c4f-cf1c-479e-a1ad-091a1ac7cb56; https://github.com/chatwoot/chatwoot/commit/9454c6b14f75e778ef98cf84bdafdf0ed8ae5705
CVE: CVE-2021-20002
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20003
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20004
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20005
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20006
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20007
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20008
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20009
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20010
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20011
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20012
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20013
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20014
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-20015
Published: 2022-02-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2021. Notes: none
CVE: CVE-2021-37185
Published: 2022-02-09
Description: A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V21.9 < V21.9.4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions >= V4.5.0 < V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.9.2 < V2.9.4), SIMATIC S7-1500 Software Controller (All versions >= V21.9 < V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions >= V4.0 < V4.0 SP1), SIPLUS TIM 1531 IRC (All versions < V2.3.6), TIM 1531 IRC (All versions < V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-672
References: https://cert-portal.siemens.com/productcert/pdf/ssa-838121.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-838121.pdf
CVE: CVE-2021-37194
Published: 2022-02-09
Description: A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 only if web components are used), COMOS V10.4 (All versions < V10.4.1 only if web components are used). The COMOS Web component of COMOS allows to upload and store arbitrary files at the webserver. This could allow an attacker to store malicious files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434, CWE-434
References: https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-995338.pdf