Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (325369 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-28972 3 Fedoraproject, Linux, Netapp 5 Fedora, Linux Kernel, Cloud Backup and 2 more 2024-11-21 6.7 Medium
In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8.
CVE-2021-28971 5 Debian, Fedoraproject, Linux and 2 more 10 Debian Linux, Fedora, Linux Kernel and 7 more 2024-11-21 5.5 Medium
In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6.
CVE-2021-28970 1 Fireeye 2 Email Malware Protection System, Ex 3500 2024-11-21 6.5 Medium
eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the job_id parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3.
CVE-2021-28969 1 Fireeye 2 Email Malware Protection System, Ex 3500 2024-11-21 6.5 Medium
eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort_by parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3. NOTE: this is different from CVE-2020-25034 and affects newer versions of the software.
CVE-2021-28968 1 Gnu 1 Punbb 2024-11-21 5.4 Medium
An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authentication) injecting arbitrary JavaScript into any forum message.
CVE-2021-28966 2 Microsoft, Ruby-lang 2 Windows, Ruby 2024-11-21 7.5 High
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
CVE-2021-28965 3 Fedoraproject, Redhat, Ruby-lang 7 Fedora, Enterprise Linux, Rhel E4s and 4 more 2024-11-21 7.5 High
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
CVE-2021-28964 4 Debian, Fedoraproject, Linux and 1 more 9 Debian Linux, Fedora, Linux Kernel and 6 more 2024-11-21 4.7 Medium
A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.
CVE-2021-28963 2 Debian, Shibboleth 2 Debian Linux, Service Provider 2024-11-21 5.3 Medium
Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.
CVE-2021-28962 1 Stormshield 1 Stormshield Network Security 2024-11-21 7.2 High
Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands.
CVE-2021-28961 1 Openwrt 1 Openwrt 2024-11-21 8.8 High
applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests.
CVE-2021-28960 1 Manageengine 1 Desktop Central 2024-11-21 9.8 Critical
Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations.
CVE-2021-28959 1 Zohocorp 1 Manageengine Eventlog Analyzer 2024-11-21 9.8 Critical
Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution.
CVE-2021-28958 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 9.8 Critical
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
CVE-2021-28956 1 Sass Lint Project 1 Sass Lint 2024-11-21 8.8 High
The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2021-28955 1 Git-bug Project 1 Git-bug 2024-11-21 9.8 Critical
git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on Windows).
CVE-2021-28954 2 Bit Project, Microsoft 2 Bit, Windows 2024-11-21 7.8 High
In Chris Walz bit before 1.0.5 on Windows, attackers can run arbitrary code via a .exe file in a crafted repository.
CVE-2021-28953 1 C\/c\+\+ Advanced Lint Project 1 C\/c\+\+ Advanced Lint 2024-11-21 7.8 High
The unofficial C/C++ Advanced Lint extension before 1.9.0 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted repository.
CVE-2021-28952 3 Fedoraproject, Linux, Netapp 11 Fedora, Linux Kernel, A250 and 8 more 2024-11-21 7.8 High
An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This has been fixed in 5.12-rc4.)
CVE-2021-28951 3 Fedoraproject, Linux, Netapp 11 Fedora, Linux Kernel, A250 and 8 more 2024-11-21 5.5 Medium
An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (deadlock) because exit may be waiting to park a SQPOLL thread, but concurrently that SQPOLL thread is waiting for a signal to start, aka CID-3ebba796fa25.