CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-38419 – Fuji Electric Tellus Lite V-Simulator out of bounds write
https://notcve.org/view.php?id=CVE-2021-38419
Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds write, which can result in data corruption, a system crash, or code execution. Fuji Electric V-Server Lite y Tellus Lite V-Simulator versiones anteriores a 4.0.12.0, son vulnerables a una escritura fuera de límites, que puede resultar en una corrupción de datos, a un bloqueo del sistema o a una ejecución de código This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V9 files in the V-Simulator module. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-38421 – Fuji Electric Tellus Lite V-Simulator out of bounds read
https://notcve.org/view.php?id=CVE-2021-38421
Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds read, which may allow an attacker to read sensitive information from other memory locations or cause a crash. Fuji Electric V-Server Lite y Tellus Lite V-Simulator versiones anteriores a 4.0.12.0, son vulnerables a una lectura fuera de límites, lo que puede permitir a un atacante leer información confidencial de otras ubicaciones de memoria o causar un bloqueo This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of V8 files within the V-Simulator module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.cisa.gov/uscert/ics/advisories/icsa-21-299-01 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22637 – Fuji Electric V-Server Lite VPR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-22637
Multiple stack-based buffer overflow issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0). Se han identificado múltiples problemas de desbordamiento del búfer en la región stack de la memoria en la manera en que la aplicación procesa archivos de proyecto, permitiendo a un atacante diseñar un archivo de proyecto especial que puede permitir una ejecución de código arbitraria en el Tellus Lite V-Simulator y V-Server Lite (versiones anteriores a 4.0.10.0) This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric V-Server Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VPR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://us-cert.cisa.gov/ics/advisories/icsa-21-026-01 https://www.zerodayinitiative.com/advisories/ZDI-21-097 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22655
https://notcve.org/view.php?id=CVE-2021-22655
Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0). Se han identificado múltiples problemas de lectura fuera de límites en la manera en que la aplicación procesa archivos de proyecto, permitiendo a un atacante diseñar un archivo de proyecto especial que puede permitir una ejecución de código arbitraria en el Tellus Lite V-Simulator y V-Server Lite (versiones anteriores a 4.0.10.0) • https://us-cert.cisa.gov/ics/advisories/icsa-21-026-01 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22639 – Fuji Electric V-Server Lite VPR File Parsing Uninitialized Pointer Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-22639
An uninitialized pointer issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0). Se ha identificado un problema de puntero no inicializado en la manera en que la aplicación procesa archivos de proyecto, permitiendo a un atacante diseñar un archivo de proyecto especial que puede permitir una ejecución de código arbitraria en el Tellus Lite V-Simulator y V-Server Lite (versiones anteriores a 4.0.10.0) This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric V-Server Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VPR files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://us-cert.cisa.gov/ics/advisories/icsa-21-026-01 https://www.zerodayinitiative.com/advisories/ZDI-21-098 • CWE-824: Access of Uninitialized Pointer •