rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-32980 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Automation Direct
product: CLICK PLC CPU Modules: C0-1x CPUs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Irfan Ahmed and Adeen Ayub of Virginia Commonwealth University and Hyunguk Yoo of the University of New Orleans reported these vulnerabilities to Automation Direct.
Published: 2022-04-04T19:45:52.000Z
CVE-2021-32981 AVEVA System Platform Path Traversal
AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Problem types: cwe_id: CWE-22
description: CWE-22: Path Traversal
Affected products: vendor: AVEVA
product: AVEVA System Platform
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA.
Published: 2022-04-04T19:45:50.000Z
CVE-2021-32982 Automation Direct CLICK PLC CPU Modules Cleartext Transmission of Sensitive Information
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Automation Direct
product: CLICK PLC CPU Modules: C0-1x CPUs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Irfan Ahmed and Adeen Ayub of Virginia Commonwealth University and Hyunguk Yoo of the University of New Orleans reported these vulnerabilities to Automation Direct.
Published: 2022-04-04T19:45:57.000Z
CVE-2021-32983 
A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter keyword before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.
Problem types: cwe_id: CWE-89
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89
Affected products: vendor: n/a
product: Delta Electronics DIAEnergie
Published: 2021-08-30T17:33:25.000Z
CVE-2021-32984 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can connect to the PLC and read the project without authorization.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Automation Direct
product: CLICK PLC CPU Modules: C0-1x CPUs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Irfan Ahmed and Adeen Ayub of Virginia Commonwealth University and Hyunguk Yoo of the University of New Orleans reported these vulnerabilities to Automation Direct.
Published: 2022-04-04T19:45:55.000Z
CVE-2021-32985 AVEVA System Platform Origin Validation Error
AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid.
Problem types: cwe_id: CWE-346
description: CWE-346: Origin Validation Error
Affected products: vendor: AVEVA
product: AVEVA System Platform
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA.
Published: 2022-04-04T19:45:49.000Z
CVE-2021-32986 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is interrupted, the PLC remains unlocked. All subsequent programming connections are allowed without authorization. The PLC is only relocked by a power cycle, or when the programming software disconnects correctly.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Automation Direct
product: CLICK PLC CPU Modules: C0-1x CPUs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Irfan Ahmed and Adeen Ayub of Virginia Commonwealth University and Hyunguk Yoo of the University of New Orleans reported these vulnerabilities to Automation Direct.
Published: 2022-04-04T19:45:56.000Z
CVE-2021-32987 AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing command 0x0b
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: AVEVA Software, LLC
product: AVEVA System Platform 2020
vendor: AVEVA Software, LLC
product: AVEVA InTouch 2020
vendor: AVEVA Software, LLC
product: AVEVA Historian 2020
vendor: AVEVA Software, LLC
product: AVEVA Communication Drivers Pack 2020
vendor: AVEVA Software, LLC
product: AVEVA Batch Management 2020
vendor: AVEVA Software, LLC
product: AVEVA MES 2014
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA
Published: 2021-09-23T13:33:22.051Z
CVE-2021-32988 
FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-787
description: Out-of-bounds write CWE-787
Affected products: vendor: n/a
product: FATEK Automation WinProladder
Published: 2021-06-29T14:50:51.000Z
CVE-2021-32989 LCDS LAquis SCADA - Cross-site Scripting
When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected cross-site scripting.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: LCDS—Leão Consultoria e Desenvolvimento de Sistemas Ltda ME
product: LAquis SCADA
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
version: 3.1
Credits: lang: en
value: Michael Heinzl reported this vulnerability to CISA.
Published: 2022-05-25T13:31:36.000Z
CVE-2021-32990 
FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-125
description: Out-of-Bounds Read CWE-125
Affected products: vendor: n/a
product: FATEK Automation WinProladder
Published: 2021-06-29T14:50:23.000Z
CVE-2021-32991 
Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a user to carry out an action unintentionally.
Problem types: cwe_id: CWE-352
description: CROSS-SITE REQUEST FORGERY (CSRF) CWE-352
Affected products: vendor: n/a
product: Delta Electronics DIAEnergie
Published: 2021-08-30T17:12:38.000Z
CVE-2021-32992 
FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-119
description: Improper Restrictions of Operations within the bounds of a memory buffer CWE-119
Affected products: vendor: n/a
product: FATEK Automation WinProladder
Published: 2021-06-29T14:50:38.000Z
CVE-2021-32993 Philips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded Credentials
IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Philips
product: IntelliBridge EC 40 Hub
vendor: Philips
product: IntelliBridge EC 80 Hub
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Younes Dragoni, Andrea Palanca and Ivan Speziale of Nozomi Networks
Published: 2021-12-27T18:48:20.675Z
CVE-2021-32994 Softing OPC-UA C++ SDK Improper Restriction of Operations within the Bounds of a Memory Buffer
Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly validate received extension objects, which may allow an attacker to crash the software by sending a variety of specially crafted packets to access several unexpected memory locations.
Problem types: cwe_id: CWE-119
description: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Softing
product: OPC UA C++ SDK (Software Development Kit)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Eran Jacob of OTORIO reported this vulnerability to CISA.
Published: 2022-04-04T19:45:58.000Z
CVE-2021-32995 
Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Cscape
Published: 2021-08-25T18:10:50.000Z
CVE-2021-32996 
The FANUC R-30iA and R-30iB series controllers are vulnerable to integer coercion errors, which cause the device to crash. A restart is required.
Problem types: cwe_id: CWE-192
description: CWE-192 INTEGER COERCION ERROR
Affected products: vendor: FANUC
product: R-30iA, R-30iA Mate
vendor: FANUC
product: R-30iB, R-30iB Mate, R-30iB Compact
vendor: FANUC
product: R-30iB Plus, R-30iB Mate Plus, R-30iB Compact Plus, R-30iB Mini Plus
Published: 2022-01-07T22:39:08.821Z
CVE-2021-32997 Baker Hughes Bently Nevada 3500 - Use of Password Hash with Insufficient Computational Effort
The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 System 1, Part No. 3071/xx & 3072/xx versions 21.1 HF1 and prior, 3500 Rack Configuration, Part No. 129133-01 versions 6.4 and prior, and 3500/22M Firmware, Part No. 288055-01 versions 5.05 and prior) utilize a weak encryption algorithm for storage and transmission of sensitive data, which may allow an attacker to more easily obtain credentials used for access.
Problem types: cwe_id: CWE-916
description: CWE-916 Use of Password Hash With Insufficient Computational Effort
Affected products: vendor: Bentley Nevada, a Baker Hughes subsidiary
product: 3500 System 1 6.x, Part No. 3060/00
vendor: Bentley Nevada, a Baker Hughes subsidiary
product: 3500 System 1, Part No. 3071/xx & 3072/xx
vendor: Bentley Nevada, a Baker Hughes subsidiary
product: 3500 Rack Configuration, Part No. 129133-01
vendor: Bentley Nevada, a Baker Hughes subsidiary
product: 3500/22M Firmware, Part No. 288055-01
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Ron Brash and Nicolas Harsey from Verve Industrial reported this vulnerability to CISA.
Published: 2022-05-25T13:33:43.000Z
CVE-2021-32998 
The FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. INIT START/restore from backup required.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: FANUC
product: R-30iA, R-30iA Mate
vendor: FANUC
product: R-30iB, R-30iB Mate, R-30iB Compact
vendor: FANUC
product: R-30iB Plus, R-30iB Mate Plus, R-30iB Compact Plus, R-30iB Mini Plus
Published: 2022-01-07T22:39:09.663Z
CVE-2021-32999 AVEVA SuiteLink Server Improper Handling of Exceptional Conditions
Improper handling of exceptional conditions in SuiteLink server while processing command 0x01
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: AVEVA Software, LLC
product: AVEVA System Platform 2020
vendor: AVEVA Software, LLC
product: AVEVA InTouch 2020
vendor: AVEVA Software, LLC
product: AVEVA Historian 2020
vendor: AVEVA Software, LLC
product: AVEVA Communication Drivers Pack 2020
vendor: AVEVA Software, LLC
product: AVEVA Batch Management 2020
vendor: AVEVA Software, LLC
product: AVEVA MES 2014
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA
Published: 2021-09-23T13:33:13.193Z
CVE-2021-33000 
Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code execution. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: n/a
product: WebAccess HMI Designer
Published: 2021-06-24T17:30:20.000Z
CVE-2021-33001 xArrow SCADA Cross-site Scripting
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code.
Problem types: cwe_id: CWE-79
description: CWE-79: Cross-site Scripting
Affected products: vendor: xArrow
product: xArrow SCADA
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Sharon Brizinov from Claroty, and Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-05-16T17:52:30.861Z
CVE-2021-33002 
Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. User interaction is require on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: WebAccess HMI Designer
Published: 2021-06-24T17:38:19.000Z
CVE-2021-33003 
Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm.
Problem types: cwe_id: CWE-916
description: USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916
Affected products: vendor: n/a
product: Delta Electronics DIAEnergie
Published: 2021-08-30T17:10:59.000Z
CVE-2021-33004 
The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to execute arbitrary code. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior).
Problem types: cwe_id: CWE-119
description: IMPROPER RESTRICTION OF OPERATION WITHIN THE BOUNDS OF A MEMORY BUFFER CWE-119
Affected products: vendor: n/a
product: WebAccess HMI Designer
Published: 2021-06-24T17:34:07.000Z
CVE-2021-33005 mySCADA myPRO Path Traversal
mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary directories.
Problem types: cwe_id: CWE-22
description: CWE-22: Path Traversal
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-05-13T15:18:40.002Z
CVE-2021-33007 
A heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: n/a
product: Delta Electronics TPEditor
Published: 2021-08-30T16:29:39.000Z
CVE-2021-33008 AVEVA System Platform Missing Authentication for Critical Function
AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requires a provable user identity.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: AVEVA
product: AVEVA System Platform
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA.
Published: 2022-04-04T19:45:51.000Z
CVE-2021-33009 mySCADA myPRO Unrestricted Upload of File with Dangerous Type
mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-05-13T15:19:06.387Z
CVE-2021-33010 AVEVA System Platform Uncaught Exception
An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught, which may cause a denial-of-service condition.
Problem types: cwe_id: CWE-248
description: CWE-248: Uncaught Exception
Affected products: vendor: AVEVA
product: AVEVA System Platform
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA.
Published: 2022-04-04T19:45:48.000Z
CVE-2021-33011 
All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series products may not be able to properly process an ICMP flood, which may allow an attacker to deny Ethernet communications between affected devices.
Problem types: cwe_id: CWE-770
description: ALLOCATION OF RESOURCES WITHOUT LIMITS OR THROTTLING CWE-770
Affected products: vendor: n/a
product: JTEKT Corporation TOYOPUC products
Published: 2021-09-10T11:28:07.000Z
CVE-2021-33012 
Rockwell Automation MicroLogix 1100, all versions, allows a remote, unauthenticated attacker sending specially crafted commands to cause the PLC to fault when the controller is switched to RUN mode, which results in a denial-of-service condition. If successfully exploited, this vulnerability will cause the controller to fault whenever the controller is switched to RUN mode.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: Rockwell Automation MicroLogix 1100
Published: 2021-07-09T14:03:55.000Z
CVE-2021-33013 mySCADA myPRO Improper Access Control
mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.
Problem types: cwe_id: CWE-284
description: CWE-284: Improper Access Control
Affected products: vendor: mySCADA
product: myPRO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Credits: lang: en
value: Michael Heinzl reported these vulnerabilities to CISA.
Published: 2022-05-13T15:19:35.805Z