CVE-2021-27197

DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page (e.g., with "OBJECT classid=" and "<SCRIPT language='vbscript'>") to overwrite arbitrary files.

• CWE-346

• https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server_AFW.txtExploit, Third Party Advisory
• https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-revision-historyRelease Notes, Vendor Advisory
• https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server_AFW.txtExploit, Third Party Advisory
• https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-revision-historyRelease Notes, Vendor Advisory

Published

Feb 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27191The get-ip-range package before 4.0.0 for Node.js is vulnera…7.5
• CVE-2021-27192Local privilege escalation vulnerability in Windows clients …7.8
• CVE-2021-27193Incorrect default permissions vulnerability in the API of Ne…9.8
• CVE-2021-27194Cleartext transmission of sensitive information in Netop Vis…8.8
• CVE-2021-27195Improper Authorization vulnerability in Netop Vision Pro up …5.9
• CVE-2021-27196Improper Input Validation vulnerability in Hitachi ABB Power…7.5
• CVE-2021-27198An issue was discovered in Visualware MyConnection Server be…9.8
• CVE-2021-27200In WoWonder 3.0.4, remote attackers can take over any accoun…9.8
• CVE-2021-27201Endian Firewall Community (aka EFW) 3.3.2 allows remote auth…8.8
• CVE-2021-27203In Dekart Private Disk 2.15, invalid use of the Type3 user b…5.5
• CVE-2021-27204Telegram before 7.4 (212543) Stable on macOS stores the loca…5.5
• CVE-2021-27205Telegram before 7.4 (212543) Stable on macOS stores the loca…5.5