CVE-2021-36751

MediumCVSS 4.2/10Last modified Jun 17, 2026

Description

ENC DataVault 7.2.3 and before, and OEM versions, use an encryption algorithm that is vulnerable to data manipulation (without knowledge of the key). This is called ciphertext malleability. There is no data integrity mechanism to detect this manipulation.

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-SoftwareVendor Advisory
https://encsecurity.zendesk.com/hc/en-us/articles/7860771829533Vendor Advisory
https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/Third Party Advisory
https://encsecurity.zendesk.com/hc/en-us/articles/4413283717265-Update-for-ENC-SoftwareVendor Advisory
https://encsecurity.zendesk.com/hc/en-us/articles/7860771829533Vendor Advisory
https://pretalx.c3voc.de/rc3-2021-r3s/talk/QMYGR3/Third Party Advisory

Timeline

Published: Jan 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-367537.8sharkdp BAT before 0.18.2 executes less.exe from the current working directory.CVE-2021-367547.5PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes a CVE-2021-367556.1Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.CVE-2021-367566.5CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation.CVE-2021-367585.41Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be us CVE-2021-367606.1In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the CVE-2021-367615.3The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.CVE-2021-367627.5An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3. The tfshnd():tftpsrv.c TFTP packet processing function doesn't en CVE-2021-367637.5In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.CVE-2021-367647.5In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer derefer CVE-2021-367657.5In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherN CVE-2021-367667.2Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/envi