CVE-2021-44447

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14911)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Siemens	JT Utilities	All versions < V13.0.3.0
Siemens	JTTK	All versions < V11.0.3.0

References

https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdfVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdfVendor Advisory

Timeline

Published: Dec 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-444483.3A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected pr CVE-2021-444497.8A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected pr CVE-2021-44454.3The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. Thi CVE-2021-444507.8A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected pr CVE-2021-444516.5Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This informatio CVE-2021-444539.8mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inje CVE-2021-444547.8Improper input validation in a third-party component for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticate CVE-2021-444589.6Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket CVE-2021-44464.3The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to m CVE-2021-444606.5Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to ac CVE-2021-444616.1Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the CVE-2021-444627.1This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prio