stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2021-27068 (severity: HIGH, weakness: NVD-CWE-Other)
Visual Studio Remote Code Execution Vulnerability
CVE-2021-27070 (severity: HIGH, weakness: CWE-732)
Windows 10 Update Assistant Elevation of Privilege Vulnerability
CVE-2021-27072 (severity: HIGH, weakness: NVD-CWE-Other)
Win32k Elevation of Privilege Vulnerability
CVE-2021-27074 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Sphere Unsigned Code Execution Vulnerability
CVE-2021-27075 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Virtual Machine Information Disclosure Vulnerability
CVE-2021-27076 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2021-27077 (severity: HIGH, weakness: CWE-269)
Windows Win32k Elevation of Privilege Vulnerability
CVE-2021-27078 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-27079 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Media Photo Codec Information Disclosure Vulnerability
CVE-2021-27080 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Sphere Unsigned Code Execution Vulnerability
CVE-2021-27081 (severity: HIGH, weakness: NVD-CWE-Other)
Visual Studio Code ESLint Extension Remote Code Execution Vulnerability
CVE-2021-27082 (severity: HIGH, weakness: NVD-CWE-Other)
Quantum Development Kit for Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-27083 (severity: HIGH, weakness: NVD-CWE-Other)
Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-27084 (severity: HIGH, weakness: NVD-CWE-Other)
Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
CVE-2021-27085 (severity: HIGH, weakness: NVD-CWE-Other)
Internet Explorer Remote Code Execution Vulnerability
CVE-2021-27086 (severity: HIGH, weakness: CWE-863)
Windows Services and Controller App Elevation of Privilege Vulnerability
CVE-2021-27088 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2021-27089 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Internet Messaging API Remote Code Execution Vulnerability
CVE-2021-27090 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
CVE-2021-27091 (severity: HIGH, weakness: NVD-CWE-Other)
RPC Endpoint Mapper Service Elevation of Privilege Vulnerability
CVE-2021-27092 (severity: CRITICAL, weakness: NVD-CWE-Other)
Azure AD Web Sign-in Security Feature Bypass Vulnerability
CVE-2021-27093 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Kernel Information Disclosure Vulnerability
CVE-2021-27094 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Early Launch Antimalware Driver Security Feature Bypass Vulnerability
CVE-2021-27095 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Media Video Decoder Remote Code Execution Vulnerability
CVE-2021-27096 (severity: HIGH, weakness: NVD-CWE-Other)
NTFS Elevation of Privilege Vulnerability
CVE-2021-27097 (severity: HIGH, weakness: NVD-CWE-Other)
The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.
CVE-2021-27098 (severity: HIGH, weakness: CWE-295)
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID belongs to the same trust domain, prior to being able to trigger this vulnerability. This issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1.
CVE-2021-27099 (severity: MEDIUM, weakness: CWE-863)
In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID templating feature, which may allow the issuance of an arbitrary SPIFFE ID within the same trust domain, if the attacker controls the value of an EC2 tag prior to attestation, and the attestor is configured for agent ID templating where the tag value is the last element in the path. This issue has been fixed in SPIRE versions 0.11.3 and 0.12.1
CVE-2021-27101 (severity: CRITICAL, weakness: NVD-CWE-Other)
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
CVE-2021-27102 (severity: HIGH, weakness: CWE-78)
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
CVE-2021-27103 (severity: CRITICAL, weakness: CWE-918)
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
CVE-2021-27104 (severity: CRITICAL, weakness: CWE-78)
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
CVE-2021-27112 (severity: CRITICAL, weakness: NVD-CWE-Other)
LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading of external images.
CVE-2021-27113 (severity: CRITICAL, weakness: CWE-78)
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters.
CVE-2021-27114 (severity: CRITICAL, weakness: CWE-787)
An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/addassignment route, a very long text entry for the"'s_ip" and "s_mac" fields could lead to a Stack-Based Buffer Overflow and overwrite the return address.
CVE-2021-27116 (severity: HIGH, weakness: CWE-59)
An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.
CVE-2021-27117 (severity: HIGH, weakness: CWE-59)
An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.
CVE-2021-27124 (severity: MEDIUM, weakness: CWE-89)
SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump the database credentials via a SQL injection attack.
CVE-2021-27129 (severity: MEDIUM, weakness: CWE-79)
CASAP Automated Enrollment System version 1.0 contains a cross-site scripting (XSS) vulnerability through the Students > Edit > ROUTE parameter.
CVE-2021-27130 (severity: CRITICAL, weakness: CWE-89)
Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload.
CVE-2021-27131 (severity: MEDIUM, weakness: CWE-79)
Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in /admin/settings.php. This vulnerability is leading an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer. NOTE: this is disputed by the vendor because the "Additional HTML Section" for "Header and Footer" can only be supplied by an administrator, who is intentionally allowed to enter unsanitized input (e.g., site-specific JavaScript).
CVE-2021-27132 (severity: CRITICAL, weakness: CWE-74)
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-27135 (severity: CRITICAL, weakness: NVD-CWE-Other)
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
CVE-2021-27138 (severity: HIGH, weakness: NVD-CWE-Other)
The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.
CVE-2021-27139 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to extract information from the device without authentication by disabling JavaScript and visiting /info.asp.
CVE-2021-27140 (severity: HIGH, weakness: CWE-312)
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to find passwords and authentication cookies stored in cleartext in the web.log HTTP logs.
CVE-2021-27141 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. Credentials in /fhconf/umconfig.txt are obfuscated via XOR with the hardcoded *j7a(L#yZ98sSd5HfSgGjMj8;Ss;d)(*&^#@$a2s0i3g key. (The webs binary has details on how XOR is used.)
CVE-2021-27142 (severity: HIGH, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permissions.
CVE-2021-27143 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / user1234 credentials for an ISP.
CVE-2021-27144 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded f~i!b@e#r$h%o^m*esuperadmin / s(f)u_h+g|u credentials for an ISP.
CVE-2021-27145 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / lnadmin credentials for an ISP.
CVE-2021-27146 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / CUadmin credentials for an ISP.
CVE-2021-27147 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / admin credentials for an ISP.
CVE-2021-27148 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded telecomadmin / nE7jA%5m credentials for an ISP.
CVE-2021-27149 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded adminpldt / z6dUABtl270qRxt7a2uGTiw credentials for an ISP.
CVE-2021-27150 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded gestiontelebucaramanga / t3l3buc4r4m4ng42013 credentials for an ISP.
CVE-2021-27151 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded rootmet / m3tr0r00t credentials for an ISP.
CVE-2021-27152 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded awnfibre / fibre@dm!n credentials for an ISP.
CVE-2021-27153 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded trueadmin / admintrue credentials for an ISP.
CVE-2021-27154 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / G0R2U1P2ag credentials for an ISP.
CVE-2021-27155 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 3UJUh2VemEfUtesEchEC2d2e credentials for an ISP.
CVE-2021-27156 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains credentials for an ISP that equal the last part of the MAC address of the br0 interface.
CVE-2021-27157 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 888888 credentials for an ISP.
CVE-2021-27158 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded L1vt1m4eng / 888888 credentials for an ISP.
CVE-2021-27159 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded useradmin / 888888 credentials for an ISP.
CVE-2021-27160 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / 888888 credentials for an ISP.
CVE-2021-27161 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 1234 credentials for an ISP.
CVE-2021-27162 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / tattoo@home credentials for an ISP.
CVE-2021-27163 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / tele1234 credentials for an ISP.
CVE-2021-27164 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / aisadmin credentials for an ISP.
CVE-2021-27165 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The telnet daemon on port 23/tcp can be abused with the gpon/gpon credentials.
CVE-2021-27166 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. The password for the enable command is gpon.
CVE-2021-27167 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a password of four hexadecimal characters for the admin account. These characters are generated in init_3bb_password in libci_adaptation_layer.so.
CVE-2021-27168 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a 6GFJdY4aAuUKJjdtSn7d password for the rdsadmin account.
CVE-2021-27169 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome AN5506-04-FA devices with firmware RP2631. There is a gepon password for the gepon account.
CVE-2021-27170 (severity: CRITICAL, weakness: CWE-922)
An issue was discovered on FiberHome HG6245D devices through RP2613. By default, there are no firewall rules for IPv6 connectivity, exposing the internal management interfaces to the Internet.
CVE-2021-27171 (severity: CRITICAL, weakness: CWE-787)
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to start a Linux telnetd as root on port 26/tcp by using the CLI interface commands of ddd and shell (or tshell).
CVE-2021-27172 (severity: CRITICAL, weakness: CWE-798)
An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh.
CVE-2021-27173 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered on FiberHome HG6245D devices through RP2613. There is a telnet?enable=0&key=calculated(BR0_MAC) backdoor API, without authentication, provided by the HTTP server. This will remove firewall rules and allow an attacker to reach the telnet server (used for the CLI).
CVE-2021-27174 (severity: HIGH, weakness: CWE-312)
An issue was discovered on FiberHome HG6245D devices through RP2613. wifi_custom.cfg has cleartext passwords and 0644 permissions.
CVE-2021-27175 (severity: HIGH, weakness: CWE-312)
An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_2g.cfg has cleartext passwords and 0644 permissions.
CVE-2021-27176 (severity: HIGH, weakness: CWE-312)
An issue was discovered on FiberHome HG6245D devices through RP2613. wifictl_5g.cfg has cleartext passwords and 0644 permissions.
CVE-2021-27177 (severity: CRITICAL, weakness: CWE-863)
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to bypass authentication by sending the decoded value of the GgpoZWxwCmxpc3QKd2hvCg== string to the telnet server.
CVE-2021-27178 (severity: HIGH, weakness: CWE-312)
An issue was discovered on FiberHome HG6245D devices through RP2613. Some passwords are stored in cleartext in nvram.
CVE-2021-27179 (severity: HIGH, weakness: CWE-20)
An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to crash the telnet daemon by sending a certain 0a 65 6e 61 62 6c 65 0a 02 0a 1a 0a string.
CVE-2021-27180 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user.
CVE-2021-27181 (severity: HIGH, weakness: CWE-352)
An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user.
CVE-2021-27182 (severity: HIGH, weakness: CWE-74)
An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient). It can be exploited via an email message. It allows an attacker to perform any action with the privileges of the attacked user.
CVE-2021-27183 (severity: HIGH, weakness: CWE-610)
An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem, or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution.
CVE-2021-27184 (severity: HIGH, weakness: CWE-611)
Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the ControlPointCacheShare.xml file (in a %APPDATA%\Pelco directory) when DSControlPoint.exe is executed.
CVE-2021-27185 (severity: CRITICAL, weakness: CWE-77)
The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.
CVE-2021-27186 (severity: HIGH, weakness: CWE-476)
Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_server/api/v1/metrics.c.
CVE-2021-27187 (severity: HIGH, weakness: CWE-522)
The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Save Password box is checked.
CVE-2021-27188 (severity: HIGH, weakness: CWE-307)
The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five hours) by making five invalid login attempts to a victim's account.
CVE-2021-27189 (severity: MEDIUM, weakness: CWE-295)
The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL Certificate Validation.
CVE-2021-27190 (severity: MEDIUM, weakness: CWE-79)
A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.
CVE-2021-27191 (severity: HIGH, weakness: NVD-CWE-Other)
The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion.
CVE-2021-27192 (severity: HIGH, weakness: CWE-269)
Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a local user to gain administrator privileges whilst using the clients.
CVE-2021-27193 (severity: CRITICAL, weakness: CWE-276)
Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to read and write files on the remote machine with system privileges resulting in a privilege escalation.
CVE-2021-27194 (severity: HIGH, weakness: CWE-319)
Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to gather credentials including Windows login usernames and passwords.
CVE-2021-27195 (severity: MEDIUM, weakness: CWE-863)
Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic.
CVE-2021-27196 (severity: HIGH, weakness: CWE-20)
Improper Input Validation vulnerability in Hitachi ABB Power Grids Relion 670 Series, Relion 670/650 Series, Relion 670/650/SAM600-IO, Relion 650, REB500, RTU500 Series, FOX615 (TEGO1), MSM, GMS600, PWC600 allows an attacker with access to the IEC 61850 network with knowledge of how to reproduce the attack, as well as the IP addresses of the different IEC 61850 access points (of IEDs/products), to force the device to reboot, which renders the device inoperable for approximately 60 seconds. This vulnerability affects only products with IEC 61850 interfaces. This issue affects: Hitachi ABB Power Grids Relion 670 Series 1.1; 1.2.3 versions prior to 1.2.3.20; 2.0 versions prior to 2.0.0.13; 2.1; 2.2.2 versions prior to 2.2.2.3; 2.2.3 versions prior to 2.2.3.2. Hitachi ABB Power Grids Relion 670/650 Series 2.2.0 versions prior to 2.2.0.13. Hitachi ABB Power Grids Relion 670/650/SAM600-IO 2.2.1 versions prior to 2.2.1.6. Hitachi ABB Power Grids Relion 650 1.1; 1.2; 1.3 versions prior to 1.3.0.7. Hitachi ABB Power Grids REB500 7.3; 7.4; 7.5; 7.6; 8.2; 8.3. Hitachi ABB Power Grids RTU500 Series 7.x version 7.x and prior versions; 8.x version 8.x and prior versions; 9.x version 9.x and prior versions; 10.x version 10.x and prior versions; 11.x version 11.x and prior versions; 12.x version 12.x and prior versions. Hitachi ABB Power Grids FOX615 (TEGO1) R1D02 version R1D02 and prior versions. Hitachi ABB Power Grids MSM 2.1.0 versions prior to 2.1.0. Hitachi ABB Power Grids GMS600 1.3.0 version 1.3.0 and prior versions. Hitachi ABB Power Grids PWC600 1.0 versions prior to 1.0.1.4; 1.1 versions prior to 1.1.0.1.
CVE-2021-27197 (severity: HIGH, weakness: CWE-346)
DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page (e.g., with "OBJECT classid=" and "<SCRIPT language='vbscript'>") to overwrite arbitrary files.
CVE-2021-27198 (severity: CRITICAL, weakness: CWE-434)
An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbitrary File Upload in the web service when using a myspeed/sf?filename= URI. This application is written in Java and is thus cross-platform. The Windows installation runs as SYSTEM, which means that exploitation gives one Administrator privileges on the target system.