Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (360502 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-27693 1 Publiccms 1 Publiccms 2024-11-21 9.8 Critical
Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.
CVE-2021-27692 1 Tendacn 4 G1, G1 Firmware, G3 and 1 more 2024-11-21 9.8 Critical
Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the "doSystemCmd" function with untrusted input.
CVE-2021-27691 1 Tendacn 6 G0, G0 Firmware, G1 and 3 more 2024-11-21 9.8 Critical
Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This occurs because the "formSetDebugCfg" function executes glibc's system function with untrusted input.
CVE-2021-27679 1 Batflat 1 Batflat 2024-11-21 5.4 Medium
Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-27678 1 Batflat 1 Batflat 2024-11-21 5.4 Medium
Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-27677 1 Batflat 1 Batflat 2024-11-21 5.4 Medium
Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-27676 1 Centreon 1 Centreon 2024-11-21 5.4 Medium
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page.
CVE-2021-27673 1 Tribalsystems 1 Zenario 2024-11-21 4.8 Medium
Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component.
CVE-2021-27672 1 Tribalsystems 1 Zenario 2024-11-21 4.9 Medium
SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component.
CVE-2021-27671 1 Comrak Project 1 Comrak 2024-11-21 6.1 Medium
An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.
CVE-2021-27670 1 Appspace 1 Appspace 2024-11-21 9.8 Critical
Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.
CVE-2021-27668 1 Hashicorp 1 Vault 2024-11-21 5.3 Medium
HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.
CVE-2021-27665 1 Johnsoncontrols 1 Exacqvision Server 2024-11-21 7.5 High
An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition.
CVE-2021-27664 1 Johnsoncontrols 1 Exacqvision Web Service 2024-11-21 9.8 Critical
Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.
CVE-2021-27663 1 Johnsoncontrols 2 Ac2000, Ac2000 Firmware 2024-11-21 8.2 High
A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization. This issue affects: Johnson Controls CEM Systems AC2000 10.1; 10.2; 10.3; 10.4; 10.5.
CVE-2021-27662 1 Johnsoncontrols 2 Kantech Kt-1 Door Controller, Kantech Kt-1 Door Controller Firmware 2024-11-21 8.6 High
The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01
CVE-2021-27661 1 Johnsoncontrols 2 F4-snc, F4-snc Firmware 2024-11-21 8.8 High
Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC.
CVE-2021-27660 1 Johnsoncontrols 2 C-cure 9000, C-cure 9000 Firmware 2024-11-21 8.8 High
An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs.
CVE-2021-27659 1 Johnsoncontrols 1 Exacqvision Web Service 2024-11-21 5.3 Medium
exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2021-27658 1 Johnsoncontrols 1 Exacqvision Enterprise Manager 2024-11-21 4.3 Medium
exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.