CVE-2021-38459
8.1 HIGHThe data of a network capture of the initial handshake phase can be used to authenticate at a SYSDBA level
Published: 2021-10-22 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 8.1 HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-294
Affected products
| Vendor | Product |
|---|---|
| auvesy | versiondog |
Description
The data of a network capture of the initial handshake phase can be used to authenticate at a SYSDBA level. If a specific .exe is not restarted often, it is possible to access the needed handshake packets between admin/client connections. Using the SYSDBA permission, an attacker can change user passwords or delete the database.
Source: NVD
References
Related CVEs
Same vendor
- CVE-2021-38481 — The scheduler service running on a specific TCP port enables the user to start and stop jobs (8.1 HIGH)
- CVE-2021-38479 — Many API function codes receive raw pointers remotely from the user and trust these pointers as valid in-bound memory regions (6.5 MEDIUM)
- CVE-2021-38477 — There are multiple API function codes that permit reading and writing data to or from files and directories, which could lead to the mani... (9.8 CRITICAL)
- CVE-2021-38475 — The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to gain SYSDBA permi... (7.3 HIGH)
- CVE-2021-38473 — The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack overflow (8.0 HIGH)
Same CWE
- CVE-2026-34021 — The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the...
- CVE-2026-41000 — Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks (3.7 LOW)
- CVE-2026-49322 — Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-... (4.3 MEDIUM)
- CVE-2026-9095 — Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection (8.1 HIGH)
- CVE-2026-46538 — Microsoft UFO open-source framework for intelligent automation across devices and platforms (5.9 MEDIUM)