CVE-2021-44523

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.85 (All versions), Siveillance Identity V1.5 (All versions), Siveillance Identity V1.6 (All versions < V1.6.284.0). Affected applications insufficiently limit the access to the internal activity feed database. This could allow an unauthenticated remote attacker to read, modify or delete activity feed entries.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-668

Affected software

VendorProductVersions
SiemensSiPass integrated V2.76All versions
SiemensSiPass integrated V2.80All versions
SiemensSiPass integrated V2.85All versions
SiemensSiveillance Identity V1.5All versions
SiemensSiveillance Identity V1.6All versions < V1.6.284.0

References

Timeline

Published
Dec 14, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-445249.8A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.CVE-2021-445259.8Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in whichCVE-2021-445269.8Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.CVE-2021-445276.5A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the netCVE-2021-445286.1A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combinatiCVE-2021-445299.8A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code witCVE-2021-44535.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a potential gpu_metrics_table memory leak Memory is alCVE-2021-445309.8An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a CVE-2021-445317.4Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bCVE-2021-445325.3Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to cCVE-2021-445335.3Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craCVE-2021-445346.5Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclos
CVE-2021-44523: Critical severity, CVSS 9.1 | Vulnix