返回 CVE 瀏覽器

CVE-2021-36206

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1230%

EPSS Percentile30.07th

Published2022年10月28日

Last Modified2024年11月21日

Vulnerability Description

All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.

Affected Platforms (CPE)

📦

Johnsoncontrols

Cevas

< 1.01.46

References & Advisories

🔗 https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-05

🔗 https://www.johnsoncontrols.com/cyber-solutions/security-advisories

🔗 https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-05

🔗 https://www.johnsoncontrols.com/cyber-solutions/security-advisories

相關漏洞威脅

CVE-2021-2124310.0

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deser...

CVE-2021-021110.0

An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protocol Daemon ...

CVE-2021-3467910.0

Thycotic Password Reset Server before 5.3.0 allows credential disclosure.

CVE-2021-2124410.0

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server sid...