CVE-2021-27722
MediumCVSS 5.5Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
An issue was discovered in SpotAuditor 5.3.5 where entering 300 bytes of character data into the 'Key' or 'Name' field during registration can crash the program.
Risk Assessment
An attacker can cause a denial of service (DoS) remotely or locally by sending crafted input, potentially disrupting system operations and affecting software availability.
Recommendation
Update SpotAuditor to the latest version if available, or implement input length restrictions on registration fields.
Other vulnerabilities in SpotAuditor
See all- CVE-2019-25666Medium
SpotAuditor 3.6.7 has a local buffer overflow in the Base64 Password Decoder component. An attacker can supply an oversized Base64 string to crash the application.
- CVE-2019-25434High
A denial of service vulnerability in SpotAuditor 5.3.1.0 allows unauthenticated attackers to crash the application by submitting excessive data in the registration name field. Entering a string of 5000 bytes or more triggers an unhandled exception that crashes the application.
Original NVD description (English source)
An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5. The program can be crashed by entering 300 bytes char data into the "Key" or "Name" field while registering.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS