CVE-2021-37128

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jan 3, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-371297.5There is an out of bounds write vulnerability in some Huawei products. The vulnerability is caused by a function of a module that does not pCVE-2021-37137.4An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device useCVE-2021-371307.5There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses external input to consCVE-2021-371316.8There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit tCVE-2021-371325.3PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may caCVE-2021-371337.5There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentCVE-2021-371348.1Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for invCVE-2021-371367.5The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocatiCVE-2021-371377.5The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may bufferCVE-2021-37145.9A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via CVE-2021-371449.1CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect CVE-2021-371457.2A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker
CVE-2021-37128: Critical severity, CVSS 9.8 | Vulnix