CVE-2021-44448

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products is vulnerable to an out of bounds read past the end of an allocated buffer when parsing JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14843, ZDI-CAN-15051)

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Siemens	JT Utilities	All versions < V13.0.3.0
Siemens	JTTK	All versions < V11.0.3.0

References

https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdfVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdfVendor Advisory

Timeline

Published: Dec 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-444497.8A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected pr CVE-2021-44454.3The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. Thi CVE-2021-444507.8A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1). JTTK library in affected pr CVE-2021-444516.5Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This informatio CVE-2021-444539.8mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inje CVE-2021-444547.8Improper input validation in a third-party component for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticate CVE-2021-444589.6Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket CVE-2021-44464.3The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to m CVE-2021-444606.5Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to ac CVE-2021-444616.1Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the CVE-2021-444627.1This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prio CVE-2021-444637.3Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control Sys