Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (361517 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-23518 3 Cached-path-relative Project, Debian, Redhat 3 Cached-path-relative, Debian Linux, Acm 2024-11-21 7.3 High
The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
CVE-2021-23514 1 Crowcpp 1 Crow 2024-11-21 6.5 Medium
This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server.
CVE-2021-23509 1 Json-ptr Project 1 Json-ptr 2024-11-21 5.6 Medium
This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.
CVE-2021-23507 1 Skratchdot 1 Object-path-set 2024-11-21 7.5 High
The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908
CVE-2021-23497 1 Set Project 1 Set 2024-11-21 7.5 High
This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821
CVE-2021-23495 1 Karma Project 1 Karma 2024-11-21 5.4 Medium
The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.
CVE-2021-23490 1 Parse-link-header Project 1 Parse-link-header 2024-11-21 7.5 High
The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
CVE-2021-23484 1 Zip-local Project 1 Zip-local 2024-11-21 9.8 Critical
The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.
CVE-2021-23472 1 Bootstrap-table 1 Bootstrap Table 2024-11-21 3.1 Low
This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.
CVE-2021-23470 1 Putil-merge Project 1 Putil-merge 2024-11-21 8.2 High
This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077
CVE-2021-23463 1 H2database 1 H2 2024-11-21 8.1 High
The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
CVE-2021-23460 1 Camunda 1 Min-dash 2024-11-21 7.5 High
The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
CVE-2021-23452 1 Binaryops 1 X-assign 2024-11-21 8.6 High
This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.
CVE-2021-23451 1 Otp-generator Project 1 Otp-generator 2024-11-21 6.5 Medium
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.
CVE-2021-23450 3 Debian, Linuxfoundation, Oracle 5 Debian Linux, Dojo, Communications Policy Management and 2 more 2024-11-21 7.5 High
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
CVE-2021-23449 1 Vm2 Project 1 Vm2 2024-11-21 9.8 Critical
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.
CVE-2021-23448 1 Config-handler Project 1 Config-handler 2024-11-21 6.5 Medium
All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.
CVE-2021-23447 1 Teddy Project 1 Teddy 2024-11-21 5.4 Medium
This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).
CVE-2021-23446 1 Handsontable 1 Handsontable 2024-11-21 7.5 High
The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.
CVE-2021-23445 2 Datatables, Redhat 2 Datatables.net, Jboss Enterprise Application Platform 2024-11-21 3.1 Low
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.