Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (346758 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-37424 1 Zohocorp 1 Manageengine Admanager Plus 2024-11-21 9.8 Critical
ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.
CVE-2021-37423 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 9.8 Critical
Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.
CVE-2021-37422 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 9.8 Critical
Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.
CVE-2021-37421 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 9.8 Critical
Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.
CVE-2021-37420 1 Zohocorp 1 Manageengine Admanager Plus 2024-11-21 6.5 Medium
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.
CVE-2021-37419 1 Zohocorp 1 Manageengine Admanager Plus 2024-11-21 7.5 High
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.
CVE-2021-37417 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 9.8 Critical
Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.
CVE-2021-37416 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 6.1 Medium
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
CVE-2021-37414 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 7.5 High
Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication.
CVE-2021-37413 1 Grandcom 1 Dynweb 2024-11-21 9.8 Critical
GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login script does not verify and sanitize user-provided strings.
CVE-2021-37412 1 It-economics 1 Techradar 2024-11-21 6.1 Medium
The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar.
CVE-2021-37404 1 Apache 1 Hadoop 2024-11-21 9.8 Critical
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
CVE-2021-37403 1 Open-xchange 1 Open-xchange Appsuite 2024-11-21 6.1 Medium
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used.
CVE-2021-37402 1 Open-xchange 1 Open-xchange Appsuite 2024-11-21 6.1 Medium
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled.
CVE-2021-37401 1 Idec 15 Data File Manager, Ft1a Smartaxix Lite, Ft1a Smartaxix Lite Firmware and 12 more 2024-11-21 9.8 Critical
An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
CVE-2021-37400 1 Idec 15 Data File Manager, Ft1a Smartaxix Lite, Ft1a Smartaxix Lite Firmware and 12 more 2024-11-21 9.8 Critical
An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered, and/or downloaded.
CVE-2021-37394 1 Rpcms 1 Rpcms 2024-11-21 8.8 High
In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.
CVE-2021-37393 1 Rpcms 1 Rpcms 2024-11-21 5.4 Medium
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.
CVE-2021-37392 1 Rpcms 1 Rpcms 2024-11-21 5.4 Medium
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.
CVE-2021-37391 1 Chamilo 1 Chamilo Lms 2024-11-21 5.4 Medium
A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.