CVE-2021-38465

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieved by generating large amounts of installations, which are then saved without limitation in the temp folder of the webinstaller executable.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Oct 22, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-384666.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not perform sufficient input validation on client requests from the hCVE-2021-384678.1A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then control what memory regCVE-2021-384684.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to stored cross-scripting, which may allow an attacker toCVE-2021-384697.1Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the unconCVE-2021-38477.8An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the wCVE-2021-384709.1InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into CVE-2021-384719.1There are multiple API function codes that permit data writing to any file, which may allow an attacker to modify existing files or create nCVE-2021-384724.7InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 management portal does not contain an X-FRAME-OPTIONS header, which an aCVE-2021-384738.8The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack overflow.CVE-2021-384749.8InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 have has no account lockout policy configured for the login page of the CVE-2021-384758.8The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to gain SYSDBA permissiCVE-2021-384765.3InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of
CVE-2021-38465: Medium severity, CVSS 6.5 | Vulnix