stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-34429 (severity: MEDIUM, weakness: CWE-200)
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
CVE-2021-3443 (severity: MEDIUM, weakness: CWE-476)
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
CVE-2021-34430 (severity: HIGH, weakness: CWE-338)
Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic.
CVE-2021-34431 (severity: MEDIUM, weakness: CWE-401)
In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur, which could be used to provide a DoS attack against the broker.
CVE-2021-34432 (severity: HIGH, weakness: CWE-20)
In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.
CVE-2021-34433 (severity: HIGH, weakness: CWE-322)
In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally succeeds without verifying the server side's signature on the client side, if that signature is not included in the server's ServerKeyExchange.
CVE-2021-34434 (severity: MEDIUM, weakness: CWE-285)
In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked when a durable client is offline, then existing subscriptions for that client are not revoked.
CVE-2021-34435 (severity: HIGH, weakness: CWE-942)
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file..
CVE-2021-34436 (severity: CRITICAL, weakness: CWE-22)
In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.
CVE-2021-34438 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Font Driver Host Remote Code Execution Vulnerability
CVE-2021-34439 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2021-3444 (severity: HIGH, weakness: CWE-681)
The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101.
CVE-2021-34440 (severity: MEDIUM, weakness: NVD-CWE-Other)
GDI+ Information Disclosure Vulnerability
CVE-2021-34441 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2021-34442 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2021-34444 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows DNS Server Denial of Service Vulnerability
CVE-2021-34445 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2021-34446 (severity: HIGH, weakness: NVD-CWE-Other)
Windows HTML Platforms Security Feature Bypass Vulnerability
CVE-2021-34447 (severity: HIGH, weakness: NVD-CWE-Other)
Windows MSHTML Platform Remote Code Execution Vulnerability
CVE-2021-34448 (severity: HIGH, weakness: CWE-787)
Scripting Engine Memory Corruption Vulnerability
CVE-2021-34449 (severity: HIGH, weakness: NVD-CWE-Other)
Win32k Elevation of Privilege Vulnerability
CVE-2021-3445 (severity: HIGH, weakness: CWE-347)
A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability.
CVE-2021-34450 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2021-34451 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Office Online Server Spoofing Vulnerability
CVE-2021-34452 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Word Remote Code Execution Vulnerability
CVE-2021-34453 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Exchange Server Denial of Service Vulnerability
CVE-2021-34454 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2021-34455 (severity: HIGH, weakness: CWE-269)
Windows File History Service Elevation of Privilege Vulnerability
CVE-2021-34456 (severity: HIGH, weakness: CWE-269)
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2021-34457 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2021-34458 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Kernel Remote Code Execution Vulnerability
CVE-2021-34459 (severity: HIGH, weakness: CWE-269)
Windows AppContainer Elevation Of Privilege Vulnerability
CVE-2021-3446 (severity: MEDIUM, weakness: CWE-327)
A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality.
CVE-2021-34460 (severity: HIGH, weakness: CWE-269)
Storage Spaces Controller Elevation of Privilege Vulnerability
CVE-2021-34461 (severity: HIGH, weakness: CWE-269)
Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability
CVE-2021-34462 (severity: HIGH, weakness: CWE-362)
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
CVE-2021-34464 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Defender Remote Code Execution Vulnerability
CVE-2021-34466 (severity: MEDIUM, weakness: CWE-290)
Windows Hello Security Feature Bypass Vulnerability
CVE-2021-34467 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2021-34468 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2021-34469 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Security Feature Bypass Vulnerability
CVE-2021-3447 (severity: MEDIUM, weakness: CWE-532)
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided when they have access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.
CVE-2021-34470 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2021-34471 (severity: HIGH, weakness: CWE-269)
Microsoft Windows Defender Elevation of Privilege Vulnerability
CVE-2021-34473 (severity: CRITICAL, weakness: CWE-918)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-34474 (severity: HIGH, weakness: NVD-CWE-Other)
Dynamics Business Central Remote Code Execution Vulnerability
CVE-2021-34475 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2021-34476 (severity: HIGH, weakness: NVD-CWE-Other)
Bowser.sys Denial of Service Vulnerability
CVE-2021-34477 (severity: HIGH, weakness: CWE-269)
Visual Studio Code .NET Runtime Elevation of Privilege Vulnerability
CVE-2021-34478 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Remote Code Execution Vulnerability
CVE-2021-34479 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Visual Studio Spoofing Vulnerability
CVE-2021-3448 (severity: MEDIUM, weakness: CWE-358)
A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest threat from this vulnerability is to data integrity.
CVE-2021-34480 (severity: HIGH, weakness: CWE-787)
Scripting Engine Memory Corruption Vulnerability
CVE-2021-34481 (severity: CRITICAL, weakness: CWE-269)
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p><strong>UPDATE</strong> August 10, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. This security update changes the Point and Print default behavior; please see <a href="https://support.microsoft.com/help/5005652">KB5005652</a>.</p>
CVE-2021-34483 (severity: HIGH, weakness: CWE-269)
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2021-34484 (severity: HIGH, weakness: NVD-CWE-Other)
Windows User Profile Service Elevation of Privilege Vulnerability
CVE-2021-34485 (severity: MEDIUM, weakness: NVD-CWE-Other)
.NET Core and Visual Studio Information Disclosure Vulnerability
CVE-2021-34486 (severity: HIGH, weakness: CWE-416)
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2021-34487 (severity: HIGH, weakness: CWE-269)
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2021-34488 (severity: HIGH, weakness: CWE-269)
Windows Console Driver Elevation of Privilege Vulnerability
CVE-2021-34489 (severity: HIGH, weakness: NVD-CWE-Other)
DirectWrite Remote Code Execution Vulnerability
CVE-2021-3449 (severity: MEDIUM, weakness: CWE-476)
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
CVE-2021-34490 (severity: HIGH, weakness: NVD-CWE-Other)
Windows TCP/IP Driver Denial of Service Vulnerability
CVE-2021-34491 (severity: MEDIUM, weakness: NVD-CWE-Other)
Win32k Information Disclosure Vulnerability
CVE-2021-34492 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Certificate Spoofing Vulnerability
CVE-2021-34493 (severity: MEDIUM, weakness: CWE-269)
Windows Partition Management Driver Elevation of Privilege Vulnerability
CVE-2021-34494 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2021-34496 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows GDI Information Disclosure Vulnerability
CVE-2021-34497 (severity: HIGH, weakness: NVD-CWE-Other)
Windows MSHTML Platform Remote Code Execution Vulnerability
CVE-2021-34498 (severity: HIGH, weakness: CWE-416)
Windows GDI Elevation of Privilege Vulnerability
CVE-2021-34499 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows DNS Server Denial of Service Vulnerability
CVE-2021-3450 (severity: HIGH, weakness: CWE-295)
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).
CVE-2021-34500 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kernel Memory Information Disclosure Vulnerability
CVE-2021-34501 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2021-34503 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2021-34504 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Address Book Remote Code Execution Vulnerability
CVE-2021-34506 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2021-34507 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Remote Assistance Information Disclosure Vulnerability
CVE-2021-34508 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kernel Remote Code Execution Vulnerability
CVE-2021-34509 (severity: MEDIUM, weakness: NVD-CWE-Other)
Storage Spaces Controller Information Disclosure Vulnerability
CVE-2021-3451 (severity: MEDIUM, weakness: CWE-276)
A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to be written to non-standard locations.
CVE-2021-34510 (severity: HIGH, weakness: CWE-190)
Storage Spaces Controller Elevation of Privilege Vulnerability
CVE-2021-34511 (severity: HIGH, weakness: CWE-269)
Windows Installer Elevation of Privilege Vulnerability
CVE-2021-34512 (severity: HIGH, weakness: CWE-190)
Storage Spaces Controller Elevation of Privilege Vulnerability
CVE-2021-34513 (severity: HIGH, weakness: CWE-190)
Storage Spaces Controller Elevation of Privilege Vulnerability
CVE-2021-34514 (severity: HIGH, weakness: CWE-269)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2021-34516 (severity: HIGH, weakness: CWE-20)
Win32k Elevation of Privilege Vulnerability
CVE-2021-34517 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Spoofing Vulnerability
CVE-2021-34518 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2021-34519 (severity: LOW, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Information Disclosure Vulnerability
CVE-2021-3452 (severity: MEDIUM, weakness: CWE-20)
A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVE-2021-34520 (severity: HIGH, weakness: CWE-502)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2021-34521 (severity: HIGH, weakness: NVD-CWE-Other)
Raw Image Extension Remote Code Execution Vulnerability
CVE-2021-34522 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Defender Remote Code Execution Vulnerability
CVE-2021-34523 (severity: CRITICAL, weakness: NVD-CWE-Other)
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2021-34524 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2021-34525 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2021-34527 (severity: HIGH, weakness: NVD-CWE-Other)
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>UPDATE July 7, 2021: The security update for Windows Server 2012, Windows Server 2016 and Windows 10, Version 1607 have been released. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability.</p> <p>In addition to installing the updates, in order to secure your system, you must confirm that the following registry settings are set to 0 (zero) or are not defined (<strong>Note</strong>: These registry keys do not exist by default, and therefore are already at the secure setting.), also that your Group Policy setting are correct (see FAQ):</p> <ul> <li>HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint</li> <li>NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting)</li> <li>UpdatePromptSettings = 0 (DWORD) or not defined (default setting)</li> </ul> <p><strong>Having NoWarningNoElevationOnInstall set to 1 makes your system vulnerable by design.</strong></p> <p>UPDATE July 6, 2021: Microsoft has completed the investigation and has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. If you are unable to install these updates, see the FAQ and Workaround sections in this CVE for information on how to help protect your system from this vulnerability. See also <a href="https://support.microsoft.com/topic/31b91c02-05bc-4ada-a7ea-183b129578a7">KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates</a>.</p> <p>Note that the security updates released on and after July 6, 2021 contain protections for CVE-2021-1675 and the additional remote code execution exploit in the Windows Print Spooler service known as “PrintNightmare”, documented in CVE-2021-34527.</p>
CVE-2021-34528 (severity: HIGH, weakness: NVD-CWE-Other)
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-34529 (severity: HIGH, weakness: NVD-CWE-Other)
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-3453 (severity: MEDIUM, weakness: CWE-693)
Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.
CVE-2021-34530 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Graphics Component Remote Code Execution Vulnerability
CVE-2021-34532 (severity: MEDIUM, weakness: NVD-CWE-Other)
ASP.NET Core and Visual Studio Information Disclosure Vulnerability
CVE-2021-34533 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Graphics Component Font Parsing Remote Code Execution Vulnerability
CVE-2021-34534 (severity: HIGH, weakness: NVD-CWE-Other)
Windows MSHTML Platform Remote Code Execution Vulnerability
CVE-2021-34535 (severity: HIGH, weakness: NVD-CWE-Other)
Remote Desktop Client Remote Code Execution Vulnerability
CVE-2021-34536 (severity: HIGH, weakness: CWE-190)
Storage Spaces Controller Elevation of Privilege Vulnerability
CVE-2021-34537 (severity: HIGH, weakness: CWE-269)
Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVE-2021-34538 (severity: HIGH, weakness: CWE-306)
Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.
CVE-2021-34539 (severity: HIGH, weakness: CWE-668)
An issue was discovered in CubeCoders AMP before 2.1.1.8. A lack of validation of the Java Version setting means that an unintended executable path can be set. The result is that high-privileged users can trigger code execution.
CVE-2021-3454 (severity: HIGH, weakness: CWE-130)
Truncated L2CAP K-frame causes assertion failure. Zephyr versions >= 2.4.0, >= v.2.50 contain Improper Handling of Length Parameter Inconsistency (CWE-130), Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fx88-6c29-vrp3
CVE-2021-34540 (severity: MEDIUM, weakness: CWE-79)
Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.
CVE-2021-34543 (severity: HIGH, weakness: CWE-306)
The web administration server in Solar-Log 500 before 2.8.2 Build 52 does not require authentication, which allows remote attackers to gain administrative privileges by connecting to the server. As a result, the attacker can modify configuration files and change the system status. Fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
CVE-2021-34544 (severity: MEDIUM, weakness: CWE-312)
An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. In /export.html, email.html, and sms.html, cleartext passwords are stored. This may allow sensitive information to be read by someone with access to the device. Fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not existing for SL 250, 300, 1200, 2000, SL 50 Gateway, SL Base.
CVE-2021-34546 (severity: MEDIUM, weakness: CWE-287)
An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to file" feature. To accomplish this, the attacker can navigate to cmd.exe.