rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-10571 
Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter to interface/main/finder/finder_navigation.php; (2) key parameter to interface/billing/get_claim_file.php; (3) formid or (4) formseq parameter to interface/orders/types.php; (5) eraname, (6) paydate, (7) post_to_date, (8) deposit_date, (9) debug, or (10) InsId parameter to interface/billing/sl_eob_process.php; (11) form_source, (12) form_paydate, (13) form_deposit_date, (14) form_amount, (15) form_name, (16) form_pid, (17) form_encounter, (18) form_date, or (19) form_to_date parameter to interface/billing/sl_eob_search.php; (20) codetype or (21) search_term parameter to interface/de_identification_forms/find_code_popup.php; (22) search_term parameter to interface/de_identification_forms/find_drug_popup.php; (23) search_term parameter to interface/de_identification_forms/find_immunization_popup.php; (24) id parameter to interface/forms/CAMOS/view.php; (25) id parameter to interface/forms/reviewofs/view.php; or (26) list_id parameter to library/custom_template/personalize.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-30T17:00:00.000Z
CVE-2018-10572 
interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and form_body parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-30T17:00:00.000Z
CVE-2018-10573 
interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-30T17:00:00.000Z
CVE-2018-10574 
site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-30T20:00:00.000Z
CVE-2018-10575 
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Hardcoded credentials exist for an unprivileged SSH account with a shell of /bin/false.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-30T22:00:00.000Z
CVE-2018-10576 
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Point web UI allows authentication using a local system account (instead of the dedicated web-only user).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-30T22:00:00.000Z
CVE-2018-10577 
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. File upload functionality allows any users authenticated on the web interface to upload files containing code to the web root, allowing these files to be executed as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T21:00:00.000Z
CVE-2018-10578 
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Incorrect validation of the "old password" field in the change password form allows an attacker to bypass validation of this field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T21:00:00.000Z
CVE-2018-10580 
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts without sanitizing the tsubject (aka thread subject) field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T14:00:00.000Z
CVE-2018-10581 
In Octopus Deploy 3.4.x before 2018.4.7, an authenticated user is able to view/update/save variable values within the Tenant Variables area for Environments that do not exist within their associated Team scoping. This occurs in situations where this authenticated user also belongs to multiple teams, where one of the Teams has the VariableEdit permission or VariableView permissions for the Environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-01T13:00:00.000Z
CVE-2018-10583 
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-01T16:00:00.000Z
CVE-2018-10585 
Pexip Infinity before 18 allows remote Denial of Service (XML parsing).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-25T03:25:02.000Z
CVE-2018-10586 
NetGain Enterprise Manager (EM) is affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities in versions before 10.1.12.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-01T17:00:00.000Z
CVE-2018-10587 
NetGain Enterprise Manager (EM) is affected by OS Command Injection vulnerabilities in versions before 10.0.57. These vulnerabilities could allow remote authenticated attackers to inject arbitrary code, resulting in remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-01T17:00:00.000Z
CVE-2018-10589 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, a path transversal vulnerability has been identified, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-22
description: PATH TRAVERSAL CWE-22
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z
CVE-2018-10590 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an information exposure vulnerability through directory listing has been identified, which may allow an attacker to find important files that are not normally visible.
Problem types: cwe_id: CWE-548
description: INFORMATION EXPOSURE THROUGH DIRECTORY LISTING CWE-548
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z
CVE-2018-10591 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an origin validation error vulnerability has been identified, which may allow an attacker can create a malicious web site, steal session cookies, and access data of authenticated users.
Problem types: cwe_id: CWE-346
description: ORIGIN VALIDATION ERROR CWE-346
Affected products: vendor: Advantech
product: WebAccess
Published: 2018-05-15T22:00:00.000Z
CVE-2018-10592 
Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: Yokogawa
product: STARDOM FCJ Controllers
vendor: Yokogawa
product: STARDOM FCN-100 Controllers
vendor: Yokogawa
product: STARDOM FCN-RTU Controllers
vendor: Yokogawa
product: STARDOM FCN-500 Controllers
Published: 2018-07-31T17:00:00.000Z
CVE-2018-10593 
A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in data corruption.
Problem types: cwe_id: CWE-356
description: Product UI does not warn user of unsafe actions CWE-356
Affected products: vendor: Becton, Dickinson and Company
product: Kiestra and InoqulA systems
Published: 2018-05-24T16:00:00.000Z
CVE-2018-10594 
Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1) utilize a fixed-length stack buffer where an unverified length value can be read from the network packets via a specific network port, causing the buffer to be overwritten. This may allow remote code execution, cause the application to crash, or result in a denial-of-service condition in the application server.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: ICS-CERT
product: Delta Industrial Automation COMMGR and accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1)
Published: 2018-06-26T20:00:00.000Z
CVE-2018-10595 
A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in loss or corruption of data.
Problem types: cwe_id: CWE-356
description: Product UI does not warn user of unsafe actions CWE-356
Affected products: vendor: Becton, Dickinson and Company
product: Kiestra and InoqulA systems
Published: 2018-05-24T16:00:00.000Z
CVE-2018-10596 Medtronic 2090 Carelink Programmer Improper Restriction of Communication Channel to Intended Endpoints
Medtronic 2090 CareLink Programmer 

uses a virtual private network connection to securely download updates. It does not verify it is still connected to this virtual private network before downloading updates. The affected products initially establish an encapsulated IP-based VPN connection to a Medtronic-hosted update network. Once the VPN is established, it makes a request to a HTTP (non-TLS) server across the VPN for updates, which responds and provides any available updates. The programmer-side (client) service responsible for this HTTP request does not check to ensure it is still connected to the VPN before making the HTTP request. Thus, an attacker could cause the VPN connection to terminate (through various methods and attack points) and intercept the HTTP request, responding with malicious updates via a man-in-the-middle attack. The affected products do not verify the origin or integrity of these updates, as it insufficiently relied on the security of the VPN. An attacker with remote network access to the programmer could influence these communications.
Problem types: cwe_id: CWE-923
description: CWE-923
Affected products: vendor: Medtronic
product: 2090 CareLink Programmer
default_status: unaffected
vendor: Medtronic
product: 29901 Encore Programmer
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Billy Rios and Jonathan Butts of Whitescope LLC identified these vulnerabilities and reported them to CISA.
Published: 2018-07-02T18:00:00.000Z
CVE-2018-10597 
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that allows an unauthenticated attacker to access memory ("write-what-where") from an attacker-chosen device address within the same subnet.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287
Affected products: vendor: ICS-CERT
product: IntelliVue Patient Monitors, Avalon Fetal/Maternal Monitors
Published: 2018-06-05T20:00:00.000Z
CVE-2018-10598 
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities could cause the software to crash due to lacking user input validation for processing project files. Which may allow an attacker to gain remote code execution with administrator privileges if exploited.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: ICS-CERT
product: CNCSoft with ScreenEditor
Published: 2018-08-13T22:00:00.000Z
CVE-2018-10599 
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that allows an unauthenticated attacker to read memory from an attacker-chosen device address within the same subnet.
Problem types: cwe_id: CWE-200
description: INFORMATION EXPOSURE CWE-200
Affected products: vendor: ICS-CERT
product: IntelliVue Patient Monitors, Avalon Fetal/Maternal Monitors
Published: 2018-06-05T20:00:00.000Z
CVE-2018-10600 
SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution (in certain situations on specific platforms), and denial of service attacks.
Problem types: cwe_id: CWE-611
description: IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE ('XXE') CWE-611
Affected products: vendor: Schweitzer Engineering Laboratories, Inc.
product: AcSELerator Architect
Published: 2018-07-24T13:00:00.000Z
CVE-2018-10601 
IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that exposes an "echo" service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary checks, hence resulting in stack overflow.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: ICS-CERT
product: IntelliVue Patient Monitors, Avalon Fetal/Maternal Monitors
Published: 2018-06-05T20:00:00.000Z
CVE-2018-10602 
WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple stack-based buffer overflow vulnerabilities that can be exploited when the application processes specially crafted project files.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: WECON Technology Co., Ltd.
product: LeviStudioU
Published: 2018-09-26T18:00:00.000Z
CVE-2018-10603 
Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior do not perform authentication of IEC-104 control commands, which may allow a rogue node a remote control of the industrial process.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: Martem
product: TELEM GW6
vendor: Martem
product: TELEM GWM
Published: 2018-07-31T17:00:00.000Z
CVE-2018-10604 
SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution.
Problem types: cwe_id: CWE-276
description: INCORRECT DEFAULT PERMISSIONS CWE-276
Affected products: vendor: Schweitzer Engineering Laboratories, Inc.
product: Compass
Published: 2018-07-24T13:00:00.000Z
CVE-2018-10605 
Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take the full control over the RTU using default credentials to connect to the RTU.
Problem types: cwe_id: CWE-276
description: INCORRECT DEFAULT PERMISSIONS CWE-276
Affected products: vendor: Martem
product: TELEM-GW6/GWM
Published: 2018-10-01T16:00:00.000Z
CVE-2018-10606 
WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple heap-based buffer overflow vulnerabilities that can be exploited when the application processes specially crafted project files.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: WECON Technology Co., Ltd.
product: LeviStudioU
Published: 2018-09-26T18:00:00.000Z
CVE-2018-10607 
Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow the creation of new connections to one or more IOAs, without closing them properly, which may cause a denial of service within the industrial process control channel.
Problem types: cwe_id: CWE-400
description: UNCONTROLLED RESOURCE CONSUMPTION ('RESOURCE EXHAUSTION') CWE-400
Affected products: vendor: Martem
product: TELEM GW6
vendor: Martem
product: TELEM GWM
Published: 2018-07-31T17:00:00.000Z
CVE-2018-10608 
SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may cause denial of service via 100% CPU utilization. Restart of the application is required.
Problem types: cwe_id: CWE-400
description: UNCONTROLLED RESOURCE CONSUMPTION ('RESOURCE EXHAUSTION') CWE-400
Affected products: vendor: Schweitzer Engineering Laboratories, Inc.
product: AcSELerator Architect
Published: 2018-07-24T13:00:00.000Z
CVE-2018-10609 
Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow improper sanitization of data over a Websocket which may allow cross-site scripting and client-side code execution with target user privileges.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: Martem
product: TELEM-GW6/GWM
Published: 2018-07-31T17:00:00.000Z
CVE-2018-10610 
An out-of-bounds vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project files.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: WECON Technology Co., Ltd
product: LeviStudioU
Published: 2018-10-09T21:00:00.000Z
CVE-2018-10611 
Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services.
Problem types: cwe_id: CWE-287
description: Improper Authentication CWE-287
Affected products: vendor: GE
product: MDS PulseNET and MDS PulseNET Enterprise
Published: 2018-06-04T14:00:00.000Z
CVE-2018-10612 
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROL CWE-284
Affected products: vendor: 3S-Smart
product: 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0
Published: 2019-01-29T16:00:00.000Z
CVE-2018-10613 
Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior.
Problem types: cwe_id: CWE-611
description: XXE CWE-611
Affected products: vendor: GE
product: MDS PulseNET and MDS PulseNET Enterprise
Published: 2018-06-04T14:00:00.000Z
CVE-2018-10614 
An XXE vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project XML files.
Problem types: cwe_id: CWE-611
description: IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE ('XXE') CWE-611
Affected products: vendor: WECON Technology Co., Ltd
product: LeviStudioU
Published: 2018-10-09T21:00:00.000Z
CVE-2018-10615 
Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host platform.
Problem types: cwe_id: CWE-23
description: Relative path traversal CWE-23
Affected products: vendor: GE
product: MDS PulseNET and MDS PulseNET Enterprise
Published: 2018-06-04T14:00:00.000Z
CVE-2018-10616 
ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: ABB
product: ABB Panel Builder 800
Published: 2018-07-18T15:00:00.000Z
CVE-2018-10617 
Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length heap buffer where a value larger than the buffer can be read from a .dpa file into the buffer, causing the buffer to be overwritten. This may allow remote code execution or cause the application to crash.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Delta Electronics
product: Delta Industrial Automation DOPSoft
Published: 2018-06-18T19:00:00.000Z
CVE-2018-10618 
Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the device.
Problem types: cwe_id: CWE-916
description: USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916
Affected products: vendor: Davolink
product: DVW-3200N
Published: 2018-08-01T18:00:00.000Z
CVE-2018-10619 
An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.90.00 and prior may allow an authorized, but non-privileged local user to execute arbitrary code and allow a threat actor to escalate user privileges on the affected workstation.
Problem types: cwe_id: CWE-428
description: UNQUOTED SEARCH PATH OR ELEMENT CWE-428
Affected products: vendor: ICS-CERT
product: Rockwell Automation RSLinx Classic and FactoryTalk Linx Gateway
Published: 2018-06-07T20:00:00.000Z
CVE-2018-10620 
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: AVEVA Software, LLC
product: InduSoft Web Studio
vendor: AVEVA Software, LLC
product: InTouch Machine Edition
Published: 2018-07-19T19:00:00.000Z
CVE-2018-10621 
Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length stack buffer where a value larger than the buffer can be read from a .dpa file into the buffer, causing the buffer to be overwritten. This may allow remote code execution or cause the application to crash.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Delta Electronics
product: Delta Industrial Automation DOPSoft
Published: 2018-06-18T19:00:00.000Z