Medium severity · published Nov 2, 2021
CVE-2021-27722
An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5
5.5
CVSS
0.7%
EPSS
No
On KEV
Description
An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5. The program can be crashed by entering 300 bytes char data into the "Key" or "Name" field while registering.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spotauditor · Nsasoft
5.3.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27722
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27722
Not Applicable
https://www.exploit-db.com/exploits/49590
Not Applicable
https://www.exploit-db.com/exploits/49638
More from Spotauditor
7.8
CVE-2019-25336
SpotAuditor 5.3.2 - 'Base64' Local Buffer Overflow (SEH)
7.5
CVE-2019-25340
SpotAuditor 5.3.2 - 'Base64' Denial Of Service
6.2
CVE-2019-25596
SpotAuditor 5.2.6 Name Field Denial of Service
5.5
CVE-2019-25666
SpotAuditor 3.6.7 Denial of Service Buffer Overflow
5.5
CVE-2019-25434
SpotAuditor 5.3.1.0 Denial of Service via Registration Name Field