Most recent entries from all

EUVD-2026-163449

fkie_cve-2021-35531

Improper Input Validation vulnerability in a particular configuration setting field of Hitachi Energy TXpert Hub CoreTec 4 product, allows an attacker with access to an authorized user with ADMIN or ENGINEER role rights to inject an OS command that is executed by the system. This issue affects: Hitachi Energy TXpert Hub CoreTec 4 version 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.2.0; 2.2.1.

GHSA-6fw8-3wxj-mg3j

gsd-2021-35531

ICSA-22-249-04 — Hitachi Energy TXpert Hub CoreTec 4

A vulnerability in the application authentication and authorization mechanism in the affected product depends on a token validation of the session identifier. The vulnerability allows an unauthorized modified message to be executed in the server, enabling an attacker to change an existing user 's password, and gain authorized access into the system.CVE-2021-35530 has been assigned to this vulnerability. A CVSS v3 base score of 6.0 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L). An Improper Input Validation vulnerability in a particular configuration setting field of the affected product allows an attacker, who has access to an authorized user with ADMIN or ENGINEER role rights, to inject an operating system (OS) command; this command will then be executed by the system.CVE-2021-35531 has been assigned to this vulnerability. A CVSS v3 base score of 6.0 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L). A vulnerability exists in the file upload validation component of the affected product. The vulnerability allows an attacker to gain access to the system and obtain an account with sufficient privilege to then upload a malicious firmware to the product.CVE-2021-35532 has been assigned to this vulnerability. A CVSS v3 base score of 6.0 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L).