METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3
Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases. Notice: LabX Standard was formerly known as LabX Cloud Local.
describes (21)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-26130US | — | — | ||
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-26127US | — | — | ||
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-2391US | high7.5 | — | ||
### Summary
The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory… | ||||
| CVE-2026-21218US | — | — | ||
Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2025-68121US | critical10.0 | — | ||
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed h… | ||||
| CVE-2026-24737US | — | — | ||
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such… | ||||
| CVE-2025-69419US | — | Exploit | ||
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously
crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing
non-ASCII BMP code point can tr… | ||||
| CVE-2025-15467US | — | Exploit | ||
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with
maliciously crafted AEAD parameters can trigger a stack buffer overflow.
Impact summary: A stack buffer… | ||||
| CVE-2025-15281US | — | — | ||
Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wo… | ||||
| CVE-2026-0915US | — | Exploit | ||
Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Libr… | ||||
| CVE-2026-22036US | high7.5 | — | ||
Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious s… | ||||
| CVE-2025-68154US | — | — | ||
systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injecti… | ||||
| CVE-2025-58187US | — | — | ||
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects program… | ||||
| CVE-2025-46817US | high8.8 | Exploit | ||
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer ov… | ||||
| CVE-2025-9230US | — | — | ||
Issue summary: An application trying to decrypt CMS messages encrypted using
password based encryption can trigger an out-of-bounds read and write.
Impact summary: This out-of-bou… | ||||
| CVE-2024-43483US | — | — | ||
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability | ||||
| CVE-2024-0056US | —OT elevated | — | ||
Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability | ||||
| CVE-2023-36414US | — | — | ||
Azure Identity SDK Remote Code Execution Vulnerability | ||||
| CVE-2023-29331US | — | — | ||
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability | ||||
| CVE-2021-24112US | high7.5 | — | ||
.NET Core Remote Code Execution Vulnerability | ||||
references
External citations — patches, advisories, analysis.
- VDE-2026-064: METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3 - HTMLself
- CERT@VDE Security Advisories for METTLER TOLEDOexternal
- VDE-2026-064: METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3 - CSAFself
- Product security website of METTLER TOLEDOexternal
remediations (21)
- No fix availableLabX Standard
This vulnerability will be fixed in the upcoming releases
- No fix availableLabX Standard
This vulnerability will be fixed in the upcoming releases
- No fix availableLabX Standard
This vulnerability will be fixed in the upcoming releases
- No fix availableLabX Standard
This vulnerability will be fixed in the upcoming releases
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
- FixedLabX Standard
Update to LabX Standard v21.4.23
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan