Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (347865 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-38586 1 Cpanel 1 Cpanel 2024-11-21 4.4 Medium
In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589).
CVE-2021-38585 1 Cpanel 1 Cpanel 2024-11-21 7.2 High
The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585).
CVE-2021-38584 1 Cpanel 1 Cpanel 2024-11-21 7.2 High
The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585).
CVE-2021-38583 1 Openbaraza 1 Openbaraza Human Capital Management 2024-11-21 6.1 Medium
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pages: hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view= and data=).
CVE-2021-38574 1 Foxitsoftware 2 Foxit Reader, Phantompdf 2024-11-21 9.8 Critical
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string.
CVE-2021-38573 1 Foxitsoftware 2 Foxit Reader, Phantompdf 2024-11-21 9.8 Critical
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated.
CVE-2021-38572 1 Foxitsoftware 2 Foxit Reader, Phantompdf 2024-11-21 9.8 Critical
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because the extractPages pathname is not validated.
CVE-2021-38571 2 Foxitsoftware, Microsoft 3 Foxit Reader, Phantompdf, Windows 2024-11-21 7.8 High
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows DLL hijacking, aka CNVD-C-2021-68000 and CNVD-C-2021-68502.
CVE-2021-38570 1 Foxitsoftware 2 Foxit Reader, Phantompdf 2024-11-21 9.1 Critical
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink.
CVE-2021-38569 1 Foxitsoftware 2 Foxit Reader, Phantompdf 2024-11-21 7.5 High
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows stack consumption via recursive function calls during the handling of XFA forms or link objects.
CVE-2021-38568 1 Foxitsoftware 2 Foxit Reader, Phantompdf 2024-11-21 9.8 Critical
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows memory corruption during conversion of a PDF document to a different document format.
CVE-2021-38567 2 Foxit, Foxitsoftware 2 Pdf Reader, Pdf Editor 2024-11-21 7.5 High
An issue was discovered in Foxit PDF Editor before 11.0.1 and PDF Reader before 11.0.1 on macOS. It mishandles missing dictionary entries, leading to a NULL pointer dereference, aka CNVD-C-2021-95204.
CVE-2021-38566 1 Foxitsoftware 2 Pdf Editor, Pdf Reader 2024-11-21 7.5 High
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows stack consumption during recursive processing of embedded XML nodes.
CVE-2021-38565 1 Foxitsoftware 2 Pdf Editor, Pdf Reader 2024-11-21 7.5 High
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows writing to arbitrary files via submitForm.
CVE-2021-38564 1 Foxitsoftware 2 Pdf Editor, Pdf Reader 2024-11-21 9.1 Critical
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It allows an out-of-bounds read via util.scand.
CVE-2021-38563 2 Foxit, Foxitsoftware 2 Pdf Reader, Pdf Editor 2024-11-21 9.8 Critical
An issue was discovered in Foxit PDF Reader before 11.0.1 and PDF Editor before 11.0.1. It mishandles situations in which an array size (derived from a /Size entry) is smaller than the maximum indirect object number, and thus there is an attempted incorrect array access (leading to a NULL pointer dereference, or out-of-bounds read or write).
CVE-2021-38562 3 Bestpractical, Debian, Fedoraproject 3 Request Tracker, Debian Linux, Fedora 2024-11-21 7.5 High
Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.
CVE-2021-38560 1 Ivanti 1 Service Manager 2024-11-21 6.1 Medium
Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx.
CVE-2021-38559 1 Digitaldruid 1 Hoteldruid 2024-11-21 6.1 Medium
DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter.
CVE-2021-38557 1 Raspap 1 Raspap 2024-11-21 8.8 High
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content.