rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-27236 
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic
Published: 2021-04-13T14:07:27.000Z
CVE-2020-27237 
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the The nomenclature parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic
Published: 2021-04-15T13:37:58.000Z
CVE-2020-27238 
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic
Published: 2021-04-15T13:38:25.000Z
CVE-2020-27239 
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The assetStatus parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic
Published: 2021-04-15T13:38:43.000Z
CVE-2020-27240 
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The componentStatus parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic
Published: 2021-04-19T20:33:33.000Z
CVE-2020-27241 
An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The serialnumber parameter in the getAssets.jsp page is vulnerable to unauthenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic
Published: 2021-04-19T20:33:41.000Z
CVE-2020-27242 
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoLocation parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic GA
Published: 2021-05-11T10:35:58.000Z
CVE-2020-27243 
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoService parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic GA
Published: 2021-05-11T10:36:04.000Z
CVE-2020-27244 
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoCode parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic GA
Published: 2021-05-11T10:36:11.000Z
CVE-2020-27245 
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoBuyer parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic GA
Published: 2021-05-11T10:48:19.000Z
CVE-2020-27246 
An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoComment parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: n/a
product: OpenClinic GA
Published: 2021-05-11T10:48:24.000Z
CVE-2020-27247 
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0002, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: Softmaker
Published: 2021-02-04T06:13:30.000Z
CVE-2020-27248 
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0003 and 0x0014, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: Softmaker
Published: 2021-02-04T06:13:54.000Z
CVE-2020-27249 
A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow. In version/Instance 0x0004 and 0x0015, an attacker can entice the victim to open a document to trigger this vulnerability. This affects SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014).
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: Softmaker
Published: 2021-02-04T06:14:15.000Z
CVE-2020-27250 
In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an object that is smaller than the size used for the copy, which will cause a heap-based buffer overflow at Version/Instance 0x0005 and 0x0016. An attacker can entice the victim to open a document to trigger this vulnerability.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: n/a
product: SoftMaker
Published: 2021-02-10T21:39:35.000Z
CVE-2020-27251 
A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send malicious port ranges, which could result in remote code execution.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: n/a
product: FactoryTalk Linx
Published: 2020-11-26T01:40:42.000Z
CVE-2020-27252 Medtronic MyCareLink Smart Time-of-check Time-of-use Race Condition
Medtronic MyCareLink Smart 25000 is 

vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited, an attacker could remotely execute code on the MCL Smart Patient Reader device, leading to control of the device.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Medtronic
product: Smart Model 25000 Patient Reader
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sternum, based in Tel Aviv, Israel, discovered and initially reported these vulnerabilities to Medtronic.
Published: 2020-12-14T19:19:00.000Z
CVE-2020-27253 
A flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to specifically craft a malicious packet resulting in a denial-of-service condition on the device.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: FactoryTalk Linx
Published: 2020-11-26T01:36:27.000Z
CVE-2020-27254 
Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to improper authentication for accessing log and backup data, which could allow an attacker with a specially crafted URL to obtain access to sensitive information.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287
Affected products: vendor: n/a
product: Emerson Rosemount X-STREAM Gas Analyzer
Published: 2020-12-21T17:04:24.000Z
CVE-2020-27255 
A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send malicious set attribute requests, which could result in the leaking of sensitive information. This information disclosure could lead to the bypass of address space layout randomization (ASLR).
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: n/a
product: FactoryTalk Linx
Published: 2020-11-26T01:38:44.000Z
CVE-2020-27256 
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump allows attackers with physical access to change insulin therapy settings.
Problem types: cwe_id: CWE-798
description: USE OF HARD CODED CREDENTIALS CWE-798
Affected products: vendor: n/a
product: SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
Published: 2021-01-19T20:46:30.000Z
CVE-2020-27257 Omron CX-One
This vulnerability allows local attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type-confusion condition in the Omron CX-One Version 4.60 and prior devices.
Problem types: cwe_id: CWE-843
description: ACCESS OF RESOURCE USING INCOMPATIBLE TYPE ('TYPE CONFUSION') CWE-843
Affected products: vendor: Omron
product: CX-One
vendor: Omron
product: CX-Protocol
vendor: Omron
product: CX-Server
vendor: Omron
product: CX-Position
Published: 2021-02-09T14:10:19.507Z
CVE-2020-27258 
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure vulnerability in the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows unauthenticated attackers to extract the pump’s keypad lock PIN via Bluetooth Low Energy.
Problem types: cwe_id: CWE-522
description: INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522
Affected products: vendor: n/a
product: SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
Published: 2021-01-19T20:46:40.000Z
CVE-2020-27259 Omron CX-One
The Omron CX-One Version 4.60 and prior may allow an attacker to supply a pointer to arbitrary memory locations, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-822
description: UNTRUSTED POINTER DEREFERENCE CWE-822
Affected products: vendor: Omron
product: CX-One
vendor: Omron
product: CX-Protocol
vendor: Omron
product: CX-Server
vendor: Omron
product: CX-Position
Published: 2021-02-09T14:09:11.732Z
CVE-2020-27260 
Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected parameters.
Problem types: cwe_id: CWE-74
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS IN OUTPUT USED BY A DOWNSTREAM COMPONENT CWE-74
Affected products: vendor: n/a
product: BIGCOMPANYSOFT SOFTWARE PRODUCT
Published: 2021-01-08T15:17:09.000Z
CVE-2020-27261 Omron CX-One
The Omron CX-One Version 4.60 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: Omron
product: CX-One
vendor: Omron
product: CX-Protocol
vendor: Omron
product: CX-Server
vendor: Omron
product: CX-Position
Published: 2021-02-09T14:09:34.782Z
CVE-2020-27262 
Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting (XSS) vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the filename parameter to multiple update endpoints of the administrative web interface.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: Innokas Yhtymä Oy Vital Signs Monitor VC150
Published: 2021-01-08T15:16:44.000Z
CVE-2020-27263 
KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: n/a
product: PTC Kepware KEPServerEX
vendor: n/a
product: ThingWorx Kepware Server
vendor: n/a
product: ThingWorx Industrial Connectivity
vendor: n/a
product: OPC-Aggregator
vendor: n/a
product: Rockwell Automation KEPServer Enterprise
vendor: n/a
product: GE Digital Industrial Gateway Server
vendor: n/a
product: Software Toolbox TOP Server
Published: 2021-01-13T23:30:08.000Z
CVE-2020-27264 
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications use deterministic keys, which allows unauthenticated, physically proximate attackers to brute-force the keys via Bluetooth Low Energy.
Problem types: cwe_id: CWE-330
description: USE OF INSUFFICIENTLY RANDOM VALUES CWE-330
Affected products: vendor: n/a
product: SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
Published: 2021-01-19T20:46:53.000Z
CVE-2020-27265 
KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions are vulnerable to a stack-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and remotely execute code.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: PTC Kepware KEPServerEX;  ThingWorx Industrial Connectivity; OPC-Aggregator; Rockwell Automation KEPServer Enterprise; GE Digital Industrial Gateway Server; Software Toolbox TOP Server
Published: 2021-01-13T23:33:45.000Z
CVE-2020-27266 
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass user authentication checks via Bluetooth Low Energy.
Problem types: cwe_id: CWE-603
description: USE OF CLIENT-SIDE AUTHENTICATION CWE-603
Affected products: vendor: n/a
product: SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
Published: 2021-01-19T21:17:33.000Z
CVE-2020-27267 
KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.
Problem types: cwe_id: CWE-416
description: USE AFTER FREE CWE-416
Affected products: vendor: n/a
product: PTC Kepware KEPServerEX
vendor: n/a
product: ThingWorx Kepware Server
vendor: n/a
product: ThingWorx Industrial Connectivity
vendor: n/a
product: OPC-Aggregator
vendor: n/a
product: Rockwell Automation KEPServer Enterprise
vendor: n/a
product: GE Digital Industrial Gateway Server
vendor: n/a
product: Software Toolbox TOP Server
Published: 2021-01-13T23:25:07.000Z
CVE-2020-27268 
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass checks for default PINs via Bluetooth Low Energy.
Problem types: cwe_id: CWE-602
description: CLIENT-SIDE ENFORCEMENT OF SERVER-SIDE SECURITY CWE-602
Affected products: vendor: n/a
product: SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
Published: 2021-01-19T21:17:53.000Z
CVE-2020-27269 
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications lacks replay protection measures, which allows unauthenticated, physically proximate attackers to replay communication sequences via Bluetooth Low Energy.
Problem types: cwe_id: CWE-294
description: AUTHENTICATION BYPASS BY CAPTURE-REPLAY CWE-294
Affected products: vendor: n/a
product: SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A
Published: 2021-01-19T21:17:59.000Z
CVE-2020-27270 
SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doesnt use adequate measures to protect encryption keys in transit which allows unauthenticated physically proximate attacker to sniff keys via (BLE).
Problem types: description: UNPROTECTED TRANSPORT OF CREDENTIALS CWE523
Affected products: vendor: n/a
product: SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A
Published: 2021-01-19T16:17:59.000Z
CVE-2020-27272 
SOOIL Developments CoLtd DiabecareRS, AnyDana-i, AnyDana-A, The communication protocol of the insulin pump and AnyDana-i,AnyDana-A mobile apps doesn't use adequate measures to authenticate the pump before exchanging keys, which allows unauthenticated, physically proximate attackers to eavesdrop the keys and spoof the pump via BLE.
Problem types: description: KEY EXCHANGE WITHOUT ENTITY AUTHENTICATION CWE322
Affected products: vendor: n/a
product: SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A
Published: 2021-01-19T16:18:13.000Z
CVE-2020-27274 
Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to close, which may lead to a denial-of-service condition on the OPC UA Tunneller (versions prior to 6.3.0.8233).
Problem types: cwe_id: CWE-754
description: IMPROPER CHECK FOR UNUSUAL OR EXCEPTIONAL CONDITIONS CWE-754
Affected products: vendor: n/a
product: OPC UA Tunneller
Published: 2021-01-26T19:03:18.000Z
CVE-2020-27275 
Delta Electronics DOPSoft Version 4.0.8.21 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Delta Electronics
Published: 2021-01-11T15:23:02.000Z
CVE-2020-27276 
SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mobile apps doesn't use adequate measures to authenticate the communicating entities before exchanging keys, which allows unauthenticated, physically proximate attackers to eavesdrop the authentication sequence via Bluetooth Low Energy.
Problem types: cwe_id: CWE-290
description: AUTHENTICATION BYPASS BY SPOOFING CWE-290
Affected products: vendor: n/a
product: SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A
Published: 2021-01-19T16:18:20.000Z
CVE-2020-27277 
Delta Electronics DOPSoft Version 4.0.8.21 and prior has a null pointer dereference issue while processing project files, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-822
description: UNTRUSTED POINTER DEREFERENCE CWE-822
Affected products: vendor: n/a
product: Delta Electronics
Published: 2021-01-11T15:22:46.000Z
CVE-2020-27278 
In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attackers with physical access to obtain admin privileges for the device’s configuration interface.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: n/a
product: Hamilton Medical AG, T1-Ventillator
Published: 2021-03-15T21:21:38.000Z
CVE-2020-27279 
A NULL pointer deference vulnerability has been identified in the protocol converter. An attacker could send a specially crafted packet that could reboot the device running Crimson 3.1 (Build versions prior to 3119.001).
Problem types: cwe_id: CWE-476
description: NULL POINTER DEREFERENCE CWE-476
Affected products: vendor: n/a
product: Crimson 3.1
Published: 2021-01-06T15:03:47.000Z
CVE-2020-27280 
A use after free issue has been identified in the way ISPSoft(v3.12 and prior) processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution.
Problem types: cwe_id: CWE-416
description: USE AFTER FREE CWE-416
Affected products: vendor: n/a
product: ISPSoft
Published: 2021-01-26T12:51:33.000Z
CVE-2020-27281 
A stack-based buffer overflow may exist in Delta Electronics CNCSoft ScreenEditor versions 1.01.26 and prior when processing specially crafted project files, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Delta Electronics CNCSoft ScreenEditor
Published: 2021-01-11T15:57:05.000Z