CVE-2021-38142

Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured (is not protected with TLS).

• CWE-319

• https://www.barco.com/en/support/cmsVendor Advisory
• https://www.barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=5&patchVersion=3&buildVersion=65Release Notes, Vendor Advisory
• https://www.barco.com/en/support/cmsVendor Advisory
• https://www.barco.com/en/support/software/R33050099?majorVersion=2&minorVersion=5&patchVersion=3&buildVersion=65Release Notes, Vendor Advisory

Published

Sep 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38135Possible External Service Interaction attack in iManager h…9.8
• CVE-2021-38136Corero SecureWatch Managed Services 9.7.2.0020 is affected b…6.5
• CVE-2021-38137Corero SecureWatch Managed Services 9.7.2.0020 does not corr…8.1
• CVE-2021-38138OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE…5.4
• CVE-2021-3814It was found that 3scale's APIdocs does not validate the acc…7.5
• CVE-2021-38140The set_user extension module before 2.0.1 for PostgreSQL al…9.8
• CVE-2021-38143An issue was discovered in Form Tools through 3.0.20. When a…6.1
• CVE-2021-38144An issue was discovered in Form Tools through 3.0.20. A low-…5.4
• CVE-2021-38145An issue was discovered in Form Tools through 3.0.20. SQL In…9.8
• CVE-2021-38146The File Download API in Wipro Holmes Orchestrator 20.4.1 (2…7.5
• CVE-2021-38147Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows …7.5
• CVE-2021-38148Obsidian before 0.12.12 does not require user confirmation f…9.8