CVE-2021-42703

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Advantech	HMI Designer	>= All versions, <= 2.1.11.0

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01Third Party Advisory, US Government Resource

Timeline

Published: Nov 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-427047.8Inkscape version 0.91 is vulnerable to an out-of-bounds write, which may allow an attacker to arbitrary execute code.CVE-2021-427057.8PLC Editor Versions 1.3.8 and prior is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attack CVE-2021-427067.8This vulnerability could allow an attacker to disclose information and execute arbitrary code on affected installations of WebAccess/MHI Des CVE-2021-427077.8PLC Editor Versions 1.3.8 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to e CVE-2021-42716.1A vulnerability was found in panicsteve w2wiki. It has been rated as problematic. Affected by this issue is the function toHTML of the file CVE-2021-427117.8Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. This file is executed with S CVE-2021-427127.8Splashtop Streamer through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-427137.8Splashtop Remote Client (Personal Edition) through 3.4.6.1 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-427147.8Splashtop Remote Client (Business Edition) through 3.4.8.3 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-427155.5An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR loader parsed truncated end-of-file RLE scanlines as an infinite seque CVE-2021-427167.1An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, l CVE-2021-427177.5ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could res