CVE-2021-45891

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4., that allows attackers to escalate privileges within the application, since all permission checks are done client-side, not server-side.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-669

Affected software

No affected versions have been published.

Timeline

Published: Apr 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-458925.9An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is storage of Passwords in a Recoverable Format.CVE-2021-458937.5An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Improper Handling of Case Sensitivity, which makes password guessing e CVE-2021-458945.9An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Cleartext Transmission of Sensitive Information.CVE-2021-458956.1Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface.CVE-2021-458968.8Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of CVE-2021-458978.8SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.CVE-2021-458989.8SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion.CVE-2021-458999.8SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.CVE-2021-459006.5Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a CVE-2021-459015.3The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the usern CVE-2021-459036.1A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a CVE-2021-459045.4OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen.