CVE-2021-40830 Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store...

CVE-2021-40831: Improper Certificate Validation

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been “overridden”. TLS handshakes will thus succeed if the peer...

PT-2021-22964

Name of the Vulnerable Software and Affected Versions AWS IoT Device SDK v2 for Java versions prior to 1.3.3 AWS IoT Device SDK v2 for Python versions prior to 1.5.18 AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 Description...

CVE-2021-40829: Improper Certificate Validation

Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.4.2, Python versions prior to 1.6.1, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.3 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in the...

CVE-2021-40828: Improper Certificate Validation

Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.3.3, Python versions prior to 1.5.18, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.1 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in...

PT-2021-22965

Name of the Vulnerable Software and Affected Versions AWS IoT Device SDK v2 for Java versions prior to 1.4.2 AWS IoT Device SDK v2 for Python versions prior to 1.6.1 AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 AWS-C-IO version...

CVE-2021-40830: Improper Certificate Validation

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority CA to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store...

PT-2021-22966

Name of the Vulnerable Software and Affected Versions AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix AWS IoT Device SDK v2 for Node.js...

CVE-2021-35534

Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal databas...

Security feature bypass

Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal databas...

CVE-2021-35534

CVE-2021-35534 affects Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, and PWC600. The root cause is insufficient security controls in the internal database access mechanism (ODBC-based), allowing an attacker with valid credentials to bypass protections and potentially modify data/fi...

CVE-2021-35535

Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process...

Design/Logic Flaw

Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process...

CVE-2021-35534: Improper Handling of Insufficient Privileges

Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal databas...

Hitachi Energy Relion 系列安全漏洞

Hitachi Energy Relion is a Swiss Hitachi Energy company used to protect, control, measure and monitor for power systems. A security vulnerability exists in the Hitachi Energy Relion Relion 670/650/SAM600-IO Series that allows an attacker to gain access to the front-end network port and cause a...

CVE-2021-35535: Initialization of a Resource with an Insecure Default

Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process...

PT-2021-20958 · Hitachi Energy · Relion 670/650/Sam600-Io +2

Name of the Vulnerable Software and Affected Versions: Hitachi Energy Relion 670 Series versions 2.2.2 through 2.2.3.2 Hitachi Energy Relion 670/650 Series versions 2.2.0 through 2.2.4 Hitachi Energy Relion 670/650/SAM600-IO version 2.2.1 Description: The issue is related to an Insecure Boot Imag...

CVE-2021-33118

Improper access control in the software installer for the IntelR Serial IO driver for IntelR NUC 11 Gen before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33118

Improper access control in the software installer for the IntelR Serial IO driver for IntelR NUC 11 Gen before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33093

Insecure inherited permissions in the installer for the IntelR NUC M15 Laptop Kit Serial IO driver pack before version 30.100.2104.1 may allow an authenticated user to potentially enable escalation of privilege via local access...