rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-32950 
An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. This can result in a read past the end of an allocated buffer and allows attackers to cause a denial-of-service condition or read sensitive information from memory locations.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Drawings SDK
Published: 2021-06-17T12:41:51.000Z
CVE-2021-32951 Advantech WebAccess/NMS Improper Authentication
WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as well as IP addresses and names of all the devices managed via WebAccess/NMS.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Advantech
product: WebAccess/NMS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Selim Enes Karaduman (@Enesdex), working with Trend Micro’s Zero Day Initiative, reported this vulnerability to CISA.
Published: 2021-10-27T00:54:22.837Z
CVE-2021-32952 
An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) resulting from the lack of proper validation of user-supplied data. This can result in a write past the end of an allocated buffer and allow attackers to cause a denial-of-service condition or execute code in the context of the current process.
Problem types: cwe_id: CWE-787
description: OUT-OF-BOUNDS WRITE CWE-787
Affected products: vendor: n/a
product: Drawings SDK
Published: 2021-06-17T12:05:05.000Z
CVE-2021-32953 MDT AutoSave SQL Injection
An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login.
Problem types: cwe_id: CWE-89
description: CWE-89: SQL Injection
Affected products: vendor: MDT Software
product: MDT AutoSave
vendor: MDT Software
product: MDT AutoSave
vendor: MDT Software
product: AutoSave for System Platform (A4SP)
vendor: MDT Software
product: A4SP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.
Published: 2022-04-01T22:17:05.000Z
CVE-2021-32954 
Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbitrary files on the file system.
Problem types: cwe_id: CWE-23
description: RELATIVE PATH TRAVERSAL CWE-23
Affected products: vendor: n/a
product: Advantech WebAccess/SCADA
Published: 2021-06-18T13:53:01.000Z
CVE-2021-32955 
Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code.
Problem types: cwe_id: CWE-434
description: UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434
Affected products: vendor: n/a
product: Delta Electronics DIAEnergie
Published: 2021-08-30T17:11:16.000Z
CVE-2021-32956 
Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted URL that could result in redirecting a user to a malicious webpage.
Problem types: cwe_id: CWE-601
description: URL REDIRECTION TO UNTRUSTED SITE ('OPEN REDIRECT') CWE-601
Affected products: vendor: n/a
product: Advantech WebAccess/SCADA
Published: 2021-06-18T13:52:51.000Z
CVE-2021-32957 MDT AutoSave Uncontrolled Search Path Element
A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is therefore vulnerable to binary hijacking.
Problem types: cwe_id: CWE-89
description: CWE-89: SQL Injection
Affected products: vendor: MDT Software
product: MDT AutoSave
vendor: MDT Software
product: MDT AutoSave
vendor: MDT Software
product: AutoSave for System Platform (A4SP)
vendor: MDT Software
product: A4SP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.
Published: 2022-04-01T22:17:08.000Z
CVE-2021-32958 Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel
Successful exploitation of this vulnerability on Claroty Secure Remote Access (SRA) Site versions 3.0 through 3.2 allows an attacker with local command line interface access to gain the secret key, subsequently allowing them to generate valid session tokens for the web user interface (UI). With access to the web UI an attacker can access assets managed by the SRA installation and could compromise the installation.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Claroty
product: Secure Remote Access (SRA) Site
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Alphastrike Labs reported this vulnerability to Claroty.
Published: 2022-05-23T19:34:55.000Z
CVE-2021-32959 AVEVA SuiteLink Server Buffer Overflow
Heap-based buffer overflow in SuiteLink server while processing commands 0x05/0x06
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: AVEVA Software, LLC
product: AVEVA System Platform 2020
vendor: AVEVA Software, LLC
product: AVEVA InTouch 2020
vendor: AVEVA Software, LLC
product: AVEVA Historian 2020
vendor: AVEVA Software, LLC
product: AVEVA Communication Drivers Pack 2020
vendor: AVEVA Software, LLC
product: AVEVA Batch Management 2020
vendor: AVEVA Software, LLC
product: AVEVA MES 2014
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA
Published: 2021-09-23T13:32:45.000Z
CVE-2021-32960 Rockwell Automation FactoryTalk Services Platform Protection Mechanism Failure
Rockwell Automation FactoryTalk Services Platform v6.11 and earlier, if FactoryTalk Security is enabled and deployed contains a vulnerability that may allow a remote, authenticated attacker to bypass FactoryTalk Security policies based on the computer name. If successfully exploited, this may allow an attacker to have the same privileges as if they were logged on to the client machine.
Problem types: description: CVE-693 Protection Mechanism Failure
Affected products: vendor: Rockwell Automation
product: FactoryTalk Services Platform
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Rockwell Automation reported this vulnerability to CISA.
Published: 2022-04-01T22:17:11.000Z
CVE-2021-32961 MDT AutoSave Unrestricted Upload of File with Dangerous Type
A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: MDT Software
product: MDT AutoSave
vendor: MDT Software
product: MDT AutoSave
vendor: MDT Software
product: AutoSave for System Platform (A4SP)
vendor: MDT Software
product: A4SP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: Amir Preminger of Claroty Research reported these vulnerabilities to MDT Software.
Published: 2022-04-01T22:17:04.000Z
CVE-2021-32962 Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel
The AGG Software Web Server version 4.0.40.1014 and prior is vulnerable to cross-site scripting, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: AGG Software
product: Web Server (webserver.dll)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
version: 3.1
Credits: lang: en
value: Michael Heinzl reported this vulnerability to CISA.
Published: 2022-05-24T17:48:43.000Z
CVE-2021-32963 AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing commands 0x03/0x10
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: AVEVA Software, LLC
product: AVEVA System Platform 2020
vendor: AVEVA Software, LLC
product: AVEVA InTouch 2020
vendor: AVEVA Software, LLC
product: AVEVA Historian 2020
vendor: AVEVA Software, LLC
product: AVEVA Communication Drivers Pack 2020
vendor: AVEVA Software, LLC
product: AVEVA Batch Management 2020
vendor: AVEVA Software, LLC
product: AVEVA MES 2014
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA
Published: 2021-09-23T13:32:36.770Z
CVE-2021-32964 Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel
The AGG Software Web Server version 4.0.40.1014 and prior is vulnerable to a path traversal attack, which may allow an attacker to read arbitrary files from the file system.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: AGG Software
product: Web Server (webserver.dll)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Michael Heinzl reported this vulnerability to CISA.
Published: 2022-05-24T17:46:14.000Z
CVE-2021-32965 Delta Electronics DIAScreen - Type Confusion, Out-of-bounds Write
Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to type confusion, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-843
description: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Affected products: vendor: Delta Electronics
product: DIAScreen
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kimiya, working with Trend Micro’s Zero Day Initiative, reported this vulnerability to CISA.
Published: 2022-05-24T17:56:01.000Z
CVE-2021-32966 Philips Interoperability Solution XDS - Clear Text Transmission of Sensitive Information
Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information when configured to use LDAP via TLS and where the domain controller returns LDAP referrals, which may allow an attacker to remotely read LDAP system credentials.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Philips
product: Interoperability Solution XDS
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Philips reported this vulnerability to CISA.
Published: 2022-05-25T13:29:03.000Z
CVE-2021-32967 
Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which may allow the attacker to log in and use the device with administrative privileges.
Problem types: cwe_id: CWE-288
description: AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288
Affected products: vendor: n/a
product: Delta Electronics DIAEnergie
Published: 2021-08-30T17:11:08.000Z
CVE-2021-32968 Moxa NPort IAW5000A-I/O Series Serial Device Server Classic Buffer Overflow
Two buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O Series firmware version 2.2 or earlier may allow a remote attacker to cause a denial-of-service condition.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: Moxa
product: NPort IAW5000A-I/O Series firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Konstantin Kondratev, Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar reported these vulnerabilities to Moxa.
Published: 2022-04-01T22:17:12.000Z
CVE-2021-32969 Delta Electronics DIAScreen - Type Confusion, Out-of-bounds Write
Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to an out-of-bounds write condition, which may result in a system crash or allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Delta Electronics
product: DIAScreen
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Kimiya, working with Trend Micro’s Zero Day Initiative, reported this vulnerability to CISA.
Published: 2022-05-24T17:58:57.000Z
CVE-2021-32970 Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Input Validation
Data can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which may allow a remote attacker to cause denial-of-service conditions.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Moxa
product: NPort IAW5000A-I/O series firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Konstantin Kondratev, Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar reported these vulnerabilities to Moxa.
Published: 2022-04-01T22:17:13.000Z
CVE-2021-32971 AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing command 0x07
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: AVEVA Software, LLC
product: AVEVA System Platform 2020
vendor: AVEVA Software, LLC
product: AVEVA InTouch 2020
vendor: AVEVA Software, LLC
product: AVEVA Historian 2020
vendor: AVEVA Software, LLC
product: AVEVA Communication Drivers Pack 2020
vendor: AVEVA Software, LLC
product: AVEVA Batch Management 2020
vendor: AVEVA Software, LLC
product: AVEVA MES 2014
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA
Published: 2021-09-23T13:32:53.186Z
CVE-2021-32972 
Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing software.
Problem types: cwe_id: CWE-611
description: IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
Affected products: vendor: n/a
product: Panasonic FPWIN Pro
Published: 2021-07-09T10:13:09.000Z
CVE-2021-32974 Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Input Validation
Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Moxa
product: NPort IAW5000A-I/O series firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Konstantin Kondratev, Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar reported these vulnerabilities to Moxa.
Published: 2022-04-01T22:17:13.000Z
CVE-2021-32975 
Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Cscape
Published: 2021-08-25T18:12:21.000Z
CVE-2021-32976 Moxa NPort IAW5000A-I/O Series Serial Device Server Stack-based Buffer Overflow
Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Moxa
product: NPort IAW5000A-I/O series firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Konstantin Kondratev, Evgeniy Druzhinin and Ilya Karpov of Rostelecom-Solar reported these vulnerabilities to Moxa.
Published: 2022-04-01T22:17:14.000Z
CVE-2021-32977 AVEVA System Platform Improper Verification of Cryptographic Signature
AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.
Problem types: cwe_id: CWE-347
description: CWE-347: Improper Verification of Cryptographic Signature
Affected products: vendor: AVEVA
product: AVEVA System Platform
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA.
Published: 2022-04-04T19:45:47.000Z
CVE-2021-32978 Automation Direct CLICK PLC CPU Modules Plaintext Storage of a Password
The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00.
Problem types: cwe_id: CWE-256
description: CWE-256: Plaintext Storage of a Password
Affected products: vendor: Automation Direct
product: CLICK PLC CPU Modules: C0-1x CPUs
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Irfan Ahmed and Adeen Ayub of Virginia Commonwealth University and Hyunguk Yoo of the University of New Orleans reported these vulnerabilities to Automation Direct.
Published: 2022-04-04T19:45:53.000Z
CVE-2021-32979 AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: AVEVA Software, LLC
product: AVEVA System Platform 2020
vendor: AVEVA Software, LLC
product: AVEVA InTouch 2020
vendor: AVEVA Software, LLC
product: AVEVA Historian 2020
vendor: AVEVA Software, LLC
product: AVEVA Communication Drivers Pack 2020
vendor: AVEVA Software, LLC
product: AVEVA Batch Management 2020
vendor: AVEVA Software, LLC
product: AVEVA MES 2014
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported these vulnerabilities to AVEVA
Published: 2021-09-23T13:32:59.908Z