CVE-2021-44154

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit_opt, which will then be triggered when running the diagnostics (via /goform/diagnostics_doit), resulting in a buffer overflow.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Dec 13, 2021
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-441555.3An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response if a username is vali CVE-2021-441588.0ASUS RT-AX56U Wi-Fi Router is vulnerable to stack-based buffer overflow due to improper validation for httpd parameter length. An authentica CVE-2021-441599.84MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary files including webshel CVE-2021-44164.3The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing CVE-2021-441607.3Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s pr CVE-2021-441618.8Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input. A attacker in loca CVE-2021-441627.5Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of speci CVE-2021-441636.1Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaS CVE-2021-441649.8Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker CVE-2021-441657.2A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER M CVE-2021-441664.1An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a re CVE-2021-441677.5An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and