CVE-2021-38448

Trane Symbio Improper Control of Generation of Code

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Trane

Products

Ascend Air-cooled Chiller Acr Intellipak 1 Intellipak 2 and 3 more

CVE-2021-38442

FATEK Automation WinProladder

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a heap-corruption condition. An attacker could leverage this vulnerability to execute code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fatek

Products

Winproladder

CVE-2021-38440

FATEK Automation WinProladder

FATEK Automation WinProladder versions 3.30 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to read unauthorized information.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Fatek

Products

Winproladder

CVE-2021-38438

FATEK Automation WinProladder

A use after free vulnerability in FATEK Automation WinProladder versions 3.30 and prior may be exploited when a valid user opens a malformed project file, which may allow arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed

Vendors

Fatek

Products

Winproladder

CVE-2021-38436

FATEK Automation WinProladder

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in a memory-corruption condition. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fatek

Products

Winproladder

CVE-2021-38434

FATEK Automation WinProladder

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an unexpected sign extension. An attacker could leverage this vulnerability to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fatek

Products

Winproladder

CVE-2021-38432

FATEK Automation Communication Server

FATEK Automation Communication Server Versions 1.13 and prior lacks proper validation of user-supplied data, which could result in a stack-based buffer overflow condition and allow an attacker to remotely execute code.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Fatek

Products

Communication Server Communication Server Firmware

CVE-2021-38431

Advantech WebAccess SCADA

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Webaccess Scada

CVE-2021-38430

FATEK Automation WinProladder

FATEK Automation WinProladder versions 3.30 and prior proper validation of user-supplied data when parsing project files, which could result in a stack-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed

Vendors

Fatek

Products

Winproladder

CVE-2021-38428

Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code.

CVSS 3.1 · 5.5 Medium EPSS 11.4% KEV · Not listed

Vendors

Deltaww

Products

Dialink

CVE-2021-38426

FATEK Automation WinProladder

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fatek

Products

Winproladder

CVE-2021-38424

Delta Electronics DIALink

The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Deltaww

Products

Dialink

CVE-2021-38422

Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory and escalate privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Deltaww

Products

Dialink

CVE-2021-38421

Fuji Electric Tellus Lite V-Simulator out of bounds read

Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds read, which may allow an attacker to read sensitive information from other memory locations or cause a crash.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fujielectric

Products

V-server V-simulator

CVE-2021-38420

Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacker to modify the installation directory and upload malicious files.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Deltaww

Products

Dialink

CVE-2021-38419

Fuji Electric Tellus Lite V-Simulator out of bounds write

Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds write, which can result in data corruption, a system crash, or code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fujielectric

Products

V-server V-simulator

CVE-2021-38418

Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Deltaww

Products

Dialink

CVE-2021-38416

Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Deltaww

Products

Dialink

CVE-2021-38415

Fuji Electric Tellus Lite V-Simulator heap based buffer overflow

Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable a heap-based buffer overflow when parsing a specially crafted project file, which may allow an attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed

Vendors

Fujielectric

Products

V-server V-simulator

CVE-2021-38413

Fuji Electric Tellus Lite V-Simulator stack based buffer overflow

Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to a stack-based buffer overflow, which may allow an attacker to achieve code execution.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed

Vendors

Fujielectric

Products

V-server V-simulator