rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-22649 
Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 have multiple NULL pointer dereference issues while processing project files, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-822
description: UNTRUSTED POINTER DEREFERENCE CWE-822
Affected products: vendor: n/a
product: Luxion KeyShot
vendor: n/a
product: Luxion KeyShot Viewer
vendor: n/a
product: Luxion KeyShot Network Rendering
vendor: n/a
product: Luxion KeyVR
Published: 2021-02-23T03:02:05.000Z
CVE-2021-22650 Ovarro TBox  Relative Path Traversal
An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWinSoft, which could lead to code execution.
Problem types: description: CVE-23
Affected products: vendor: Ovarro
product: TBox
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Uri Katz of Claroty reported these vulnerabilities to CISA.
Published: 2022-07-28T14:18:25.000Z
CVE-2021-22651 
When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1, and Luxion KeyVR versions prior to 10.1 are, while processing the extraction of temporary files, suffering from a directory traversal vulnerability, which allows an attacker to store arbitrary scripts into automatic startup folders.
Problem types: cwe_id: CWE-22
description: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
Affected products: vendor: n/a
product: Luxion KeyShot versions
vendor: n/a
product: Luxion KeyShot Viewer
vendor: n/a
product: Luxion KeyShot Network Rendering
vendor: n/a
product: Luxion KeyVR
Published: 2021-02-23T17:45:36.000Z
CVE-2021-22652 
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: n/a
product: Advantech iView
Published: 2021-02-11T16:06:38.000Z
CVE-2021-22653 
Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Tellus Lite V-Simulator and V-Server Lite
Published: 2021-01-27T19:01:55.000Z
CVE-2021-22654 
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information.
Problem types: cwe_id: CWE-89
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89
Affected products: vendor: n/a
product: Advantech iView
Published: 2021-02-11T16:06:18.000Z
CVE-2021-22655 
Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Tellus Lite V-Simulator and V-Server Lite
Published: 2021-01-27T19:06:42.000Z
CVE-2021-22656 
Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files.
Problem types: cwe_id: CWE-22
description: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
Affected products: vendor: n/a
product: Advantech iView
Published: 2021-02-11T16:06:31.000Z
CVE-2021-22657 mySCADA myPRO
mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitrary operating system commands through a specific parameter.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-12-23T19:48:36.843Z
CVE-2021-22658 
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'.
Problem types: cwe_id: CWE-89
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89
Affected products: vendor: n/a
product: Advantech iView
Published: 2021-02-11T16:06:25.000Z
CVE-2021-22659 
Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited, this may lead to a buffer overflow resulting in a denial-of-service condition. The FAULT LED will flash RED and communications may be lost. Recovery from denial-of-service condition requires the fault to be cleared by the user.
Problem types: cwe_id: CWE-120
description: CLASSIC BUFFER OVERFLOW CWE-120
Affected products: vendor: n/a
product: Rockwell Automation MicroLogix 1400
Published: 2021-03-25T15:59:07.000Z
CVE-2021-22660 
CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-125
description: CVE-2021-22660: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Delta Electronics CNCSoft-B
Published: 2021-04-27T12:26:37.000Z
CVE-2021-22661 
Changing the password on the module webpage does not require the user to type in the current password first. Thus, the password could be changed by a user or external process without knowledge of the current password on the ICX35-HWC-A and ICX35-HWC-E (Versions 1.9.62 and prior).
Problem types: cwe_id: CWE-264
description: PERMISSIONS, PRIVILEGES, AND ACCESS CONTROLS CWE-264
Affected products: vendor: n/a
product: ICX35-HWC-A, ICX35-HWC-E
Published: 2021-02-26T14:50:52.000Z
CVE-2021-22662 
A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Problem types: cwe_id: CWE-416
description: USE AFTER FREE CWE-416
Affected products: vendor: n/a
product: Fatek FvDesigner
Published: 2021-03-03T16:04:26.000Z
CVE-2021-22663 
Cscape (All versions prior to 9.90 SP3.5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Cscape
Published: 2021-02-09T16:19:53.000Z
CVE-2021-22664 
CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-787
description: CVE-2021-22664: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Delta Electronics CNCSoft-B
Published: 2021-04-27T12:26:44.000Z
CVE-2021-22665 
Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may be able to exploit resulting in privilege escalation and complete control of the system.
Problem types: cwe_id: CWE-427
description: UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Affected products: vendor: n/a
product: Rockwell Automation DriveTools SP and Drives AOP
Published: 2021-03-18T17:03:43.000Z
CVE-2021-22666 
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to a stack-based buffer overflow while project files are being processed, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Fatek FvDesigner
Published: 2021-03-03T16:04:42.000Z
CVE-2021-22667 
BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain unauthorized access and permit the execution of arbitrary code on the BB-ESWGP506-2SFP-T (versions 1.01.01 and prior).
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: n/a
product: BB-ESWGP506-2SFP-T
Published: 2021-02-24T16:01:33.000Z
CVE-2021-22668 
Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Delta Industrial Automation CNCSoft ScreenEditor
Published: 2021-05-16T14:43:25.000Z
CVE-2021-22669 
Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allow a low-privileged user to update an administrator’s password and login as an administrator to escalate privileges on the system.
Problem types: cwe_id: CWE-732
description: INCORRECT PERMISSION ASSIGNMENT FOR CRITICAL RESOURCE CWE-732
Affected products: vendor: n/a
product: Advantech WebAccess/SCADA
Published: 2021-04-26T18:59:08.000Z
CVE-2021-22670 
An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Problem types: cwe_id: CWE-824
description: ACCESS OF UNINITIALIZED POINTER CWE-824
Affected products: vendor: n/a
product: Fatek FvDesigner
Published: 2021-03-03T16:04:33.000Z
CVE-2021-22671 
Multiple integer overflow issues exist while processing long domain names, which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK versions prior to v4.40.00, CC3200 SDK v1.5.0 and prior, CC3100 SDK v1.3.0 and prior).
Problem types: cwe_id: CWE-190
description: INTEGER OVERFLOW OR WRAPAROUND CWE-190
Affected products: vendor: n/a
product: SimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
Published: 2021-05-07T13:12:18.000Z
CVE-2021-22672 
Delta Electronics' CNCSoft ScreenEditor in versions prior to v1.01.30 could allow the corruption of data, a denial-of-service condition, or code execution. The vulnerability may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Delta Electronics CNCSoft ScreenEditor
Published: 2021-05-10T12:29:15.000Z
CVE-2021-22673 
The affected product is vulnerable to stack-based buffer overflow while processing over-the-air firmware updates from the CDN server, which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK versions prior to v4.40.00, CC3200 SDK v1.5.0 and prior, CC3100 SDK v1.3.0 and prior).
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: SimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
Published: 2021-05-07T13:21:39.000Z
CVE-2021-22674 
The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and directories on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1).
Problem types: cwe_id: CWE-23
description: RELATIVE PATH TRAVERSAL CWE-23
Affected products: vendor: n/a
product: WebAccess/SCADA
Published: 2021-08-10T14:00:51.000Z
CVE-2021-22675 
The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, which may allow an attacker to remotely execute code on SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK versions prior to v4.40.00, CC3200 SDK v1.5.0 and prior, CC3100 SDK v1.3.0 and prior).
Problem types: cwe_id: CWE-190
description: INTEGER OVERFLOW OR WRAPAROUND CWE-190
Affected products: vendor: n/a
product: SimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
Published: 2021-05-07T12:01:34.000Z
CVE-2021-22676 
UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScript code. This could result in hijacking of cookie/session tokens, redirection to a malicious webpage, and unintended browser action on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1).
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: WebAccess/SCADA
Published: 2021-08-10T14:02:10.000Z
CVE-2021-22677 
An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-service condition or code execution on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK versions prior to v4.40.00, CC3200 SDK v1.5.0 and prior, CC3100 SDK v1.3.0 and prior).
Problem types: cwe_id: CWE-190
description: INTEGER OVERFLOW OR WRAPAROUND CWE-190
Affected products: vendor: n/a
product: SimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
Published: 2021-05-07T15:11:44.000Z
CVE-2021-22678 
Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files. This could lead to memory corruption. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: Cscape
Published: 2021-04-23T17:27:32.000Z
CVE-2021-22679 
The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute code on the SimpleLink Wi-Fi (MSP432E4 SDK: v4.20.00.12 and prior, CC32XX SDK v4.30.00.06 and prior, CC13X0 SDK versions prior to v4.10.03, CC13X2 and CC26XX SDK versions prior to v4.40.00, CC3200 SDK v1.5.0 and prior, CC3100 SDK v1.3.0 and prior).
Problem types: cwe_id: CWE-190
description: INTEGER OVERFLOW OR WRAPAROUND CWE-190
Affected products: vendor: n/a
product: SimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
Published: 2021-05-07T12:46:57.000Z
CVE-2021-22680 NXP MQX Integer Overflow or Wraparound
NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: NXP
product: MQX
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.
Published: 2022-05-03T20:25:18.000Z
CVE-2021-22681 
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800. Rockwell Automation Studio 5000 Logix Designer Versions 21 and later and RSLogix 5000: Versions 16 through 20 are vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact GuardLogix 5370, 5380; GuardLogix 5570, 5580; SoftLogix 5800.
Problem types: cwe_id: CWE-522
description: Insufficiently Protected Credentials CWE-522
Affected products: vendor: n/a
product: Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers
Published: 2021-03-03T17:59:43.000Z
CVE-2021-22682 
Cscape (All versions prior to 9.90 SP4) is configured by default to be installed for all users, which allows full permissions, including read/write access. This may allow unprivileged users to modify the binaries and configuration files and lead to local privilege escalation.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROL CWE-284
Affected products: vendor: n/a
product: Cscape
Published: 2021-04-23T17:10:33.000Z
CVE-2021-22683 
Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a special project file that may permit arbitrary code execution.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Fatek FvDesigner
Published: 2021-03-03T16:09:21.000Z
CVE-2021-22684 
Tizen RT RTOS version 3.0.GBB is vulnerable to integer wrap-around in functions_calloc and mm_zalloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash
Problem types: cwe_id: CWE-190
description: INTEGER OVERFLOW OR WRAPAROUND CWE-190
Affected products: vendor: n/a
product: Tizen RT RTOS
Published: 2021-08-31T16:38:19.000Z
CVE-2021-22685 Cassia Networks Access Controller Path Traversal
An attacker may be able to use minify route with a relative path to view any file on the Cassia Networks Access Controller prior to 2.0.1.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Cassia Networks
product: Access Controller
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
Credits: lang: en
value: Amir Preminger and Sharon Brizinov of Claroty reported this vulnerability to CISA.
Published: 2022-10-14T00:00:00.000Z
CVE-2021-22696 OAuth 2 authorization service vulnerable to DDos attacks
CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Apache Software Foundation
product: Apache CXF
Published: 2021-04-02T10:05:14.000Z
CVE-2021-22697 
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a use-after-free condition which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: n/a
product: EcoStruxure Power Build - Rapsody software V2.1.13 and prior.
Published: 2021-01-25T17:09:26.000Z
CVE-2021-22698 
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: n/a
product: EcoStruxure Power Build - Rapsody software V2.1.13 and prior.
Published: 2021-01-25T17:10:12.000Z
CVE-2021-22699 
Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of service when specific crafted requests are sent to the controller over HTTP.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: n/a
product: Modicon M241/M251 logic controllers firmware prior to V5.1.9.1
Published: 2021-05-26T19:19:13.000Z
CVE-2021-22701 
A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause a user to perform an unintended action on the target device when using the HTTP web interface.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery
Affected products: vendor: n/a
product: PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions)
Published: 2021-02-19T15:15:16.000Z
CVE-2021-22702 
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts Telnet network traffic between a user and the device.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext transmission of sensitive information
Affected products: vendor: n/a
product: PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions)
Published: 2021-02-19T15:13:31.000Z