Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (335338 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-28975 1 Wpmailster 1 Wp Mailster 2024-11-21 6.1 Medium
WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name, or connection_parameter parameter.
CVE-2021-28973 1 Perforce 1 Helix Alm 2024-11-21 4.9 Medium
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.
CVE-2021-28972 3 Fedoraproject, Linux, Netapp 5 Fedora, Linux Kernel, Cloud Backup and 2 more 2024-11-21 6.7 Medium
In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8.
CVE-2021-28971 5 Debian, Fedoraproject, Linux and 2 more 10 Debian Linux, Fedora, Linux Kernel and 7 more 2024-11-21 5.5 Medium
In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6.
CVE-2021-28970 1 Fireeye 2 Email Malware Protection System, Ex 3500 2024-11-21 6.5 Medium
eMPS 9.0.1.923211 on the Central Management of FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the job_id parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3.
CVE-2021-28969 1 Fireeye 2 Email Malware Protection System, Ex 3500 2024-11-21 6.5 Medium
eMPS 9.0.1.923211 on FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort_by parameter to the email search feature. According to the vendor, the issue is fixed in 9.0.3. NOTE: this is different from CVE-2020-25034 and affects newer versions of the software.
CVE-2021-28968 1 Gnu 1 Punbb 2024-11-21 5.4 Medium
An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authentication) injecting arbitrary JavaScript into any forum message.
CVE-2021-28966 2 Microsoft, Ruby-lang 2 Windows, Ruby 2024-11-21 7.5 High
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
CVE-2021-28965 3 Fedoraproject, Redhat, Ruby-lang 7 Fedora, Enterprise Linux, Rhel E4s and 4 more 2024-11-21 7.5 High
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
CVE-2021-28964 4 Debian, Fedoraproject, Linux and 1 more 9 Debian Linux, Fedora, Linux Kernel and 6 more 2024-11-21 4.7 Medium
A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.
CVE-2021-28963 2 Debian, Shibboleth 2 Debian Linux, Service Provider 2024-11-21 5.3 Medium
Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.
CVE-2021-28962 1 Stormshield 1 Stormshield Network Security 2024-11-21 7.2 High
Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands.
CVE-2021-28961 1 Openwrt 1 Openwrt 2024-11-21 8.8 High
applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests.
CVE-2021-28960 1 Manageengine 1 Desktop Central 2024-11-21 9.8 Critical
Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations.
CVE-2021-28959 1 Zohocorp 1 Manageengine Eventlog Analyzer 2024-11-21 9.8 Critical
Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution.
CVE-2021-28958 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 9.8 Critical
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
CVE-2021-28956 1 Sass Lint Project 1 Sass Lint 2024-11-21 8.8 High
The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2021-28955 1 Git-bug Project 1 Git-bug 2024-11-21 9.8 Critical
git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on Windows).
CVE-2021-28954 2 Bit Project, Microsoft 2 Bit, Windows 2024-11-21 7.8 High
In Chris Walz bit before 1.0.5 on Windows, attackers can run arbitrary code via a .exe file in a crafted repository.
CVE-2021-28953 1 C\/c\+\+ Advanced Lint Project 1 C\/c\+\+ Advanced Lint 2024-11-21 7.8 High
The unofficial C/C++ Advanced Lint extension before 1.9.0 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted repository.