CVE-2021-38142

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured (is not protected with TLS).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.barco.com/en/support/cmsVendor Advisory
https://www.barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=5&patchVersion=3&buildVersion=65Release Notes, Vendor Advisory
https://www.barco.com/en/support/cmsVendor Advisory
https://www.barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=5&patchVersion=3&buildVersion=65Release Notes, Vendor Advisory

Timeline

Published: Sep 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-381436.1An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to l CVE-2021-381445.4An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submissi CVE-2021-381459.8An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-privileged user (clie CVE-2021-381467.5The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute p CVE-2021-381477.5Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensiti CVE-2021-381489.8Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.CVE-2021-381495.4index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-38159.8utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-381506.5When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP CVE-2021-381515.4index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-381525.4index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-381535.9Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute for