Skip to content

Commit 052910d

Browse files
cad-safe-botcad-safe-bot
committed
Auto-Update: 2026-02-27T03:00:11.103498+00:00
1 parent 2571296 commit 052910d

39 files changed

+2902
-185
lines changed

‎CVE-2021/CVE-2021-44xx/CVE-2021-4456.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"id": "CVE-2021-4456",
3+
"sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
4+
"published": "2026-02-27T01:16:13.553",
5+
"lastModified": "2026-02-27T01:16:13.553",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.\n\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker may be able to leverage this to bypass access controls based on IP addresses.\n\nThe documentation advises validating untrusted CIDR strings with the `cidrvalidate` function. However, this mitigation is optional and not enforced by default. In practice, users may call `addr2cidr` or `cidrlookup` with untrusted input and without validation, incorrectly assuming that this is safe."
12+
}
13+
],
14+
"metrics": {},
15+
"weaknesses": [
16+
{
17+
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
18+
"type": "Secondary",
19+
"description": [
20+
{
21+
"lang": "en",
22+
"value": "CWE-704"
23+
}
24+
]
25+
}
26+
],
27+
"references": [
28+
{
29+
"url": "https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/",
30+
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
31+
},
32+
{
33+
"url": "https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10",
34+
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
35+
},
36+
{
37+
"url": "https://metacpan.org/dist/Net-CIDR/changes",
38+
"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
39+
}
40+
]
41+
}

‎CVE-2026/CVE-2026-207xx/CVE-2026-20742.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"id": "CVE-2026-20742",
3+
"sourceIdentifier": "ics-cert@hq.dhs.gov",
4+
"published": "2026-02-27T01:16:17.317",
5+
"lastModified": "2026-02-27T01:16:17.317",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "An OS command injection \n\nvulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an \nauthenticated attacker to achieve remote code execution on the system by\n injecting malicious input into requests sent to the templates route."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "ics-cert@hq.dhs.gov",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
22+
"baseScore": 8.0,
23+
"baseSeverity": "HIGH",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "HIGH",
26+
"privilegesRequired": "HIGH",
27+
"userInteraction": "NONE",
28+
"scope": "CHANGED",
29+
"confidentialityImpact": "HIGH",
30+
"integrityImpact": "HIGH",
31+
"availabilityImpact": "HIGH"
32+
},
33+
"exploitabilityScore": 1.3,
34+
"impactScore": 6.0
35+
}
36+
]
37+
},
38+
"weaknesses": [
39+
{
40+
"source": "ics-cert@hq.dhs.gov",
41+
"type": "Primary",
42+
"description": [
43+
{
44+
"lang": "en",
45+
"value": "CWE-78"
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json",
53+
"source": "ics-cert@hq.dhs.gov"
54+
},
55+
{
56+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate",
57+
"source": "ics-cert@hq.dhs.gov"
58+
},
59+
{
60+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10",
61+
"source": "ics-cert@hq.dhs.gov"
62+
}
63+
]
64+
}

‎CVE-2026/CVE-2026-207xx/CVE-2026-20764.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"id": "CVE-2026-20764",
3+
"sourceIdentifier": "ics-cert@hq.dhs.gov",
4+
"published": "2026-02-27T02:16:18.140",
5+
"lastModified": "2026-02-27T02:16:18.140",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "An OS command injection \nvulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an \nauthenticated attacker to achieve remote code execution on the system by\n providing malicious input via the device hostname configuration which \nis later processed during system setup, resulting in remote code \nexecution."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "ics-cert@hq.dhs.gov",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
22+
"baseScore": 8.0,
23+
"baseSeverity": "HIGH",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "HIGH",
26+
"privilegesRequired": "HIGH",
27+
"userInteraction": "NONE",
28+
"scope": "CHANGED",
29+
"confidentialityImpact": "HIGH",
30+
"integrityImpact": "HIGH",
31+
"availabilityImpact": "HIGH"
32+
},
33+
"exploitabilityScore": 1.3,
34+
"impactScore": 6.0
35+
}
36+
]
37+
},
38+
"weaknesses": [
39+
{
40+
"source": "ics-cert@hq.dhs.gov",
41+
"type": "Primary",
42+
"description": [
43+
{
44+
"lang": "en",
45+
"value": "CWE-78"
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json",
53+
"source": "ics-cert@hq.dhs.gov"
54+
},
55+
{
56+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate",
57+
"source": "ics-cert@hq.dhs.gov"
58+
},
59+
{
60+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10",
61+
"source": "ics-cert@hq.dhs.gov"
62+
}
63+
]
64+
}

‎CVE-2026/CVE-2026-207xx/CVE-2026-20797.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"id": "CVE-2026-20797",
3+
"sourceIdentifier": "ics-cert@hq.dhs.gov",
4+
"published": "2026-02-27T02:16:18.343",
5+
"lastModified": "2026-02-27T02:16:18.343",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "A stack based buffer overflow exists in an API route of XWEB Pro version\n 1.12.1 and prior, enabling unauthenticated attackers to cause stack \ncorruption and a termination of the program."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "ics-cert@hq.dhs.gov",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
22+
"baseScore": 4.3,
23+
"baseSeverity": "MEDIUM",
24+
"attackVector": "ADJACENT_NETWORK",
25+
"attackComplexity": "LOW",
26+
"privilegesRequired": "NONE",
27+
"userInteraction": "NONE",
28+
"scope": "UNCHANGED",
29+
"confidentialityImpact": "NONE",
30+
"integrityImpact": "NONE",
31+
"availabilityImpact": "LOW"
32+
},
33+
"exploitabilityScore": 2.8,
34+
"impactScore": 1.4
35+
}
36+
]
37+
},
38+
"references": [
39+
{
40+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json",
41+
"source": "ics-cert@hq.dhs.gov"
42+
},
43+
{
44+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate",
45+
"source": "ics-cert@hq.dhs.gov"
46+
},
47+
{
48+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10",
49+
"source": "ics-cert@hq.dhs.gov"
50+
}
51+
]
52+
}

‎CVE-2026/CVE-2026-209xx/CVE-2026-20902.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"id": "CVE-2026-20902",
3+
"sourceIdentifier": "ics-cert@hq.dhs.gov",
4+
"published": "2026-02-27T01:16:17.520",
5+
"lastModified": "2026-02-27T01:16:17.520",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "An OS command injection \n\n\n\nvulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an \nauthenticated attacker to achieve remote code execution on the system by\n injecting malicious input into the map filename field during the map \nupload action of the parameters route."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "ics-cert@hq.dhs.gov",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
22+
"baseScore": 8.0,
23+
"baseSeverity": "HIGH",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "HIGH",
26+
"privilegesRequired": "HIGH",
27+
"userInteraction": "NONE",
28+
"scope": "CHANGED",
29+
"confidentialityImpact": "HIGH",
30+
"integrityImpact": "HIGH",
31+
"availabilityImpact": "HIGH"
32+
},
33+
"exploitabilityScore": 1.3,
34+
"impactScore": 6.0
35+
}
36+
]
37+
},
38+
"weaknesses": [
39+
{
40+
"source": "ics-cert@hq.dhs.gov",
41+
"type": "Primary",
42+
"description": [
43+
{
44+
"lang": "en",
45+
"value": "CWE-78"
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json",
53+
"source": "ics-cert@hq.dhs.gov"
54+
},
55+
{
56+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate",
57+
"source": "ics-cert@hq.dhs.gov"
58+
},
59+
{
60+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10",
61+
"source": "ics-cert@hq.dhs.gov"
62+
}
63+
]
64+
}

‎CVE-2026/CVE-2026-209xx/CVE-2026-20910.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"id": "CVE-2026-20910",
3+
"sourceIdentifier": "ics-cert@hq.dhs.gov",
4+
"published": "2026-02-27T01:16:17.707",
5+
"lastModified": "2026-02-27T01:16:17.707",
6+
"vulnStatus": "Received",
7+
"cveTags": [],
8+
"descriptions": [
9+
{
10+
"lang": "en",
11+
"value": "An OS command injection \nvulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an \nauthenticated attacker to achieve remote code execution on the system by\n injecting malicious input into the devices field of the firmware update\n update action to achieve remote code execution."
12+
}
13+
],
14+
"metrics": {
15+
"cvssMetricV31": [
16+
{
17+
"source": "ics-cert@hq.dhs.gov",
18+
"type": "Secondary",
19+
"cvssData": {
20+
"version": "3.1",
21+
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
22+
"baseScore": 8.0,
23+
"baseSeverity": "HIGH",
24+
"attackVector": "NETWORK",
25+
"attackComplexity": "HIGH",
26+
"privilegesRequired": "HIGH",
27+
"userInteraction": "NONE",
28+
"scope": "CHANGED",
29+
"confidentialityImpact": "HIGH",
30+
"integrityImpact": "HIGH",
31+
"availabilityImpact": "HIGH"
32+
},
33+
"exploitabilityScore": 1.3,
34+
"impactScore": 6.0
35+
}
36+
]
37+
},
38+
"weaknesses": [
39+
{
40+
"source": "ics-cert@hq.dhs.gov",
41+
"type": "Primary",
42+
"description": [
43+
{
44+
"lang": "en",
45+
"value": "CWE-78"
46+
}
47+
]
48+
}
49+
],
50+
"references": [
51+
{
52+
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-057-10.json",
53+
"source": "ics-cert@hq.dhs.gov"
54+
},
55+
{
56+
"url": "https://webapps.copeland.com/Dixell/Pages/SystemSoftwareUpdate",
57+
"source": "ics-cert@hq.dhs.gov"
58+
},
59+
{
60+
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10",
61+
"source": "ics-cert@hq.dhs.gov"
62+
}
63+
]
64+
}

0 commit comments

Comments
 (0)