rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-27434 
Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework versions only) are vulnerable to an uncontrolled recursion, which may allow an attacker to trigger a stack overflow.
Problem types: cwe_id: CWE-200
description: EXPOSURE OF SENSITIVE INFORMATION TO AN UNAUTHORIZED ACTOR CWE-200
Affected products: vendor: n/a
product: OPC UA Products Built with the .NET Framework 4.5, 4.0, and 3.5
Published: 2021-05-20T13:42:54.000Z
CVE-2021-27435 ARM mbed Integer Overflow or Wraparound
ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: ARM
product: mbed
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.
Published: 2022-05-03T20:22:45.000Z
CVE-2021-27436 
WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser actions.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: Advantech WebAccess/SCADA
Published: 2021-03-18T21:24:57.000Z
CVE-2021-27437 
The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM (versions prior to 9.0.1).
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: n/a
product: WISE-PaaS/RMM
Published: 2021-05-07T14:36:54.000Z
CVE-2021-27438 
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (all firmware versions prior to 02A04.1).
Problem types: cwe_id: CWE-94
description: CODE INJECTION CWE-94
Affected products: vendor: n/a
product: Reason DR60
Published: 2021-03-25T19:26:04.000Z
CVE-2021-27439 TencentOS-tiny Integer Overflow or Wraparound
TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: TencentOS-tiny
product: TencentOS-tiny
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: David Atch, Omri Ben Bassat, and Tamir Ariel from Microsoft Section 52, and the Azure Defender for IoT research group reported these vulnerabilities to CISA.
Published: 2022-05-03T20:26:05.000Z
CVE-2021-27440 
The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60 (all firmware versions prior to 02A04.1).
Problem types: cwe_id: CWE-259
description: USE OF HARD-CODED PASSWORD CWE-259
Affected products: vendor: n/a
product: Reason DR60
Published: 2021-03-25T19:28:32.000Z
CVE-2021-27442 Weintek EasyWeb cMT Cross-site Scripting
The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to inject malicious JavaScript code.
Problem types: cwe_id: CWE-79
description: CWE-79: Cross-site Scripting
Affected products: vendor: Weintek
product: cMT-SVR-1xx/2xx
vendor: Weintek
product: cMT-G01/G02
vendor: Weintek
product: cMT-G03/G04
vendor: Weintek
product: cMT3071/cMT3072/cMT3090/cMT3103/cMT3151
vendor: Weintek
product: cMT-HDM
vendor: Weintek
product: cMT-FHD
vendor: Weintek
product: cMT-CTRL01
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Marcin Dudek from CERT.PL reported these vulnerabilities to CISA.
Published: 2022-05-16T17:13:17.743Z
CVE-2021-27444 Weintek EasyWeb cMT Improper Access Control
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely access and download sensitive information and perform administrative actions on behalf of a legitimate administrator.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: Weintek
product: cMT-SVR-1xx/2xx
vendor: Weintek
product: cMT-G01/G02
vendor: Weintek
product: cMT-G03/G04
vendor: Weintek
product: cMT3071/cMT3072/cMT3090/cMT3103/cMT3151
vendor: Weintek
product: cMT-HDM
vendor: Weintek
product: cMT-FHD
vendor: Weintek
product: cMT-CTRL01
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Marcin Dudek from CERT.PL reported these vulnerabilities to CISA.
Published: 2022-05-16T17:15:15.597Z
CVE-2021-27445 Mesa Labs AmegaView Improper Privilege Management
Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Mesa Labs
product: AmegaView
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Stephen Yackey of Securifera reported these vulnerabilities to CISA.
Published: 2021-12-21T17:54:59.843Z
CVE-2021-27446 Weintek EasyWeb cMT Code Injection
The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with root privileges on the operation system.
Problem types: cwe_id: CWE-94
description: CWE-94: Code Injection
Affected products: vendor: Weintek
product: cMT-SVR-1xx/2xx
vendor: Weintek
product: cMT-G01/G02
vendor: Weintek
product: cMT-G03/G04
vendor: Weintek
product: cMT3071/cMT3072/cMT3090/cMT3103/cMT3151
vendor: Weintek
product: cMT-HDM
vendor: Weintek
product: cMT-FHD
vendor: Weintek
product: cMT-CTRL01
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Marcin Dudek from CERT.PL reported these vulnerabilities to CISA.
Published: 2022-05-16T17:15:44.847Z
CVE-2021-27447 Mesa Labs AmegaView command injection
Mesa Labs AmegaView version 3.0 is vulnerable to a command injection, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-77
description: CWE-77 Command Injection
Affected products: vendor: Mesa Labs
product: AmegaView
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Stephen Yackey of Securifera reported these vulnerabilities to CISA.
Published: 2021-12-21T17:55:03.000Z
CVE-2021-27448 
A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versions prior to v04A00.1).
Problem types: cwe_id: CWE-250
description: EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250
Affected products: vendor: n/a
product: MU320E
Published: 2021-03-25T19:35:18.000Z
CVE-2021-27449 Mesa Labs AmegaView Command Injection
Mesa Labs AmegaView Versions 3.0 and prior has a command injection vulnerability that can be exploited to execute commands in the web server.
Problem types: cwe_id: CWE-77
description: CWE-77: Command Injection
Affected products: vendor: Mesa Labs
product: AmegaView
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Stephen Yackey of Securifera reported these vulnerabilities to CISA.
Published: 2021-12-21T17:55:00.751Z
CVE-2021-27450 
SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protocol strength, which could lead to additional misconfiguration or be leveraged as part of a larger attack on the MU320E (all firmware versions prior to v04A00.1).
Problem types: cwe_id: CWE-326
description: INADEQUATE ENCRYPTION STRENGTH CWE-326
Affected products: vendor: n/a
product: MU320E
Published: 2021-03-25T19:30:27.000Z
CVE-2021-27451 Mesa Labs AmegaView improper authentication
Mesa Labs AmegaView Versions 3.0 and prior’s passcode is generated by an easily reversible algorithm, which may allow an attacker to gain access to the device.
Problem types: cwe_id: CWE-287
description: CWE-287: IMPROPER AUTHENTICATION
Affected products: vendor: Mesa Labs
product: AmegaView
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Stephen Yackey of Securifera reported these vulnerabilities to CISA.
Published: 2021-12-21T17:55:05.307Z
CVE-2021-27452 
The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentials on the MU320E (all firmware versions prior to v04A00.1).
Problem types: cwe_id: CWE-259
description: USE OF HARD-CODED PASSWORD CWE-259
Affected products: vendor: n/a
product: MU320E
Published: 2021-03-25T19:23:55.000Z
CVE-2021-27453 Mesa Labs AmegaView authentication bypass
Mesa Labs AmegaView Versions 3.0 uses default cookies that could be set to bypass authentication to the web application, which may allow an attacker to gain access.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Mesa Labs
product: AmegaView
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Stephen Yackey of Securifera reported these vulnerabilities to CISA.
Published: 2021-12-21T17:55:02.729Z
CVE-2021-27454 
The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses on the Reason DR60 (all firmware versions prior to 02A04.1).
Problem types: cwe_id: CWE-250
description: EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250
Affected products: vendor: n/a
product: Reason DR60
Published: 2021-03-25T19:33:20.000Z
CVE-2021-27455 
Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to disclose information.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Delta Electronics DOPSoft
Published: 2021-07-02T10:51:57.000Z
CVE-2021-27456 Philips Gemini PET/CT Storage of Sensitive Data in a Mechanism Without Access Control
Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control.
Problem types: cwe_id: CWE-921
description: CWE-921 Storage of Sensitive Data in a Mechanism without Access Control
Affected products: vendor: Philips
product: Gemini 16 Slice
vendor: Philips
product: Gemini Dual
vendor: Philips
product: Gemini GXL 10 Slice
vendor: Philips
product: Gemini GXL 6 Slice
vendor: Philips
product: Gemini GXL 16 Slice
vendor: Philips
product: GEMINI LXL
vendor: Philips
product: Gemini TF Ready
vendor: Philips
product: Gemini TF 16 w/ TOF Performance
vendor: Philips
product: Gemini TF 64 w/ TOF Performance
vendor: Philips
product: Gemini TF Big Bore
vendor: Philips
product: TruFlight Select PET/CT
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 2.4
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Jean GEORGE – CHU UCL Namur – Nuclear medicine department reported this vulnerability to Philips.
Published: 2022-03-23T19:46:21.000Z
CVE-2021-27457 
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected products utilize a weak encryption algorithm for storage of sensitive data, which may allow an attacker to more easily obtain credentials used for access.
Problem types: cwe_id: CWE-326
description: INADEQUATE ENCRYPTION STRENGTH CWE-326
Affected products: vendor: n/a
product: Emerson Rosemount X-STREAM Gas Analyzer
Published: 2021-05-20T11:51:36.000Z
CVE-2021-27458 
If Ethernet communication of the JTEKT Corporation TOYOPUC product series’ (TOYOPUC-PC10 Series: PC10G-CPU TCC-6353: All versions, PC10GE TCC-6464: All versions, PC10P TCC-6372: All versions, PC10P-DP TCC-6726: All versions, PC10P-DP-IO TCC-6752: All versions, PC10B-P TCC-6373: All versions, PC10B TCC-1021: All versions, PC10B-E/C TCU-6521: All versions, PC10E TCC-4737: All versions; TOYOPUC-Plus Series: Plus CPU TCC-6740: All versions, Plus EX TCU-6741: All versions, Plus EX2 TCU-6858: All versions, Plus EFR TCU-6743: All versions, Plus EFR2 TCU-6859: All versions, Plus 2P-EFR TCU-6929: All versions, Plus BUS-EX TCU-6900: All versions; TOYOPUC-PC3J/PC2J Series: FL/ET-T-V2H THU-6289: All versions, 2PORT-EFR THU-6404: All versions) are left in an open state by an attacker, Ethernet communications cannot be established with other devices, depending on the settings of the link parameters.
Problem types: cwe_id: CWE-404
description: IMPROPER RESOURCE SHUTDOWN OR RELEASE CWE-404
Affected products: vendor: n/a
product: JTEKT Corporation TOYOPUC products
Published: 2021-04-19T21:07:55.000Z
CVE-2021-27459 
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The webserver of the affected products allows unvalidated files to be uploaded, which an attacker could utilize to execute arbitrary code.
Problem types: cwe_id: CWE-434
description: UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434
Affected products: vendor: n/a
product: Emerson Rosemount X-STREAM Gas Analyzer
Published: 2021-05-20T11:51:40.000Z
CVE-2021-27460 Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data
Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier components contain .NET remoting endpoints that deserialize untrusted data without sufficiently verifying that the resulting data will be valid. This vulnerability may allow a remote, unauthenticated attacker to gain full access to the FactoryTalk AssetCentre main server and all agent machines.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Rockwell Automation
product: FactoryTalk AssetCentre
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
version: 3.1
Published: 2022-03-23T19:46:29.000Z
CVE-2021-27461 
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected webserver applications allow access to stored data that can be obtained by using specially crafted URLs.
Problem types: cwe_id: CWE-22
description: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
Affected products: vendor: n/a
product: Emerson Rosemount X-STREAM Gas Analyzer
Published: 2021-05-20T11:51:44.000Z
CVE-2021-27462 Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data
A deserialization vulnerability exists in how the AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Rockwell Automation
product: FactoryTalk AssetCentre
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
version: 3.1
Published: 2022-03-23T19:46:30.000Z
CVE-2021-27463 
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applications utilize persistent cookies where the session cookie attribute is not properly invalidated, allowing an attacker to intercept the cookies and gain access to sensitive information.
Problem types: cwe_id: CWE-539
description: USE OF PERSISTENT COOKIES CONTAINING SENSITIVE INFORMATION CWE-539
Affected products: vendor: n/a
product: Emerson Rosemount X-STREAM Gas Analyzer
Published: 2021-05-20T11:05:42.000Z
CVE-2021-27464 Rockwell Automation FactoryTalk AssetCentre SQL Injection
The ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Rockwell Automation
product: FactoryTalk AssetCentre
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
version: 3.1
Published: 2022-03-23T19:46:30.000Z
CVE-2021-27465 
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected applications do not validate webpage input, which could allow an attacker to inject arbitrary HTML code into a webpage. This would allow an attacker to modify the page and display incorrect or undesirable data.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: Emerson Rosemount X-STREAM Gas Analyzer
Published: 2021-05-20T11:05:47.000Z
CVE-2021-27466 Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data
A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Rockwell Automation
product: FactoryTalk AssetCentre
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
version: 3.1
Published: 2022-03-23T19:46:34.000Z
CVE-2021-27467 
A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The affected product’s web interface allows an attacker to route click or keystroke to another page provided by the attacker to gain unauthorized access to sensitive information.
Problem types: cwe_id: CWE-1021
description: IMPROPER RESTRICTION OF RENDERED UI LAYERS OR FRAMES CWE-1021
Affected products: vendor: n/a
product: Emerson Rosemount X-STREAM Gas Analyzer
Published: 2021-05-20T11:05:52.000Z
CVE-2021-27468 Rockwell Automation FactoryTalk AssetCentre SQL Injection
The AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Rockwell Automation
product: FactoryTalk AssetCentre
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
version: 3.1
Published: 2022-03-23T19:46:32.000Z
CVE-2021-27470 Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data
A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Rockwell Automation
product: FactoryTalk AssetCentre
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
version: 3.1
Published: 2022-03-23T19:46:35.000Z