Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (346336 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-3286 1 Spotweb Project 1 Spotweb 2024-11-21 9.8 Critical
SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload may be used. NOTE: this issue exists because of an incomplete fix for CVE-2020-35545.
CVE-2021-3285 1 Ti 1 Code Composer Studio Intgrated Development Environment 2024-11-21 5.3 Medium
jxbrowser in TI Code Composer Studio IDE 8.x through 10.x before 10.1.1 does not verify X.509 certificates for HTTPS.
CVE-2021-3283 1 Hashicorp 1 Nomad 2024-11-21 7.5 High
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
CVE-2021-3282 1 Hashicorp 1 Vault 2024-11-21 7.5 High
HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.
CVE-2021-3281 4 Djangoproject, Fedoraproject, Netapp and 1 more 5 Django, Fedora, Snapcenter and 2 more 2024-11-21 5.3 Medium
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
CVE-2021-3279 1 Fortics 1 Szchat 2024-11-21 6.1 Medium
sz.chat version 4 allows injection of web scripts and HTML in the message box.
CVE-2021-3278 1 Local Services Search Engine Management System Project 1 Local Services Search Engine Management System 2024-11-21 9.8 Critical
Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . Using this vulnerability, an attacker can bypass the login page.
CVE-2021-3277 1 Nagios 1 Nagios Xi 2024-11-21 7.2 High
Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.
CVE-2021-3275 1 Tp-link 10 Archer-c3150, Archer-c3150 Firmware, Td-w9977 and 7 more 2024-11-21 6.1 Medium
Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper validation of the hostname. Some of the pages including dhcp.htm, networkMap.htm, dhcpClient.htm, qsEdit.htm, and qsReview.htm and use this vulnerable hostname function (setDefaultHostname()) without sanitization.
CVE-2021-3273 1 Nagios 1 Nagios Xi 2024-11-21 7.2 High
Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system.
CVE-2021-3272 3 Fedoraproject, Jasper Project, Redhat 3 Fedora, Jasper, Enterprise Linux 2024-11-21 5.5 Medium
jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.
CVE-2021-3271 1 Pressbooks 1 Pressbooks 2024-11-21 4.8 Medium
PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or preview the books page will result in the triggering the stored XSS.
CVE-2021-3264 1 Cxuu 1 Cxuucms 2024-11-21 7.2 High
SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php.
CVE-2021-3262 1 Trispark 2 Novusedu, Veo Transportation 2024-11-21 9.8 Critical
TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users without sanitizing using server-side logic. It was possible to inject custom SQL commands into the "Student Busing Information" search queries.
CVE-2021-3258 1 Qa-themes 1 Q2a Ultimate Seo 2024-11-21 5.4 Medium
Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting (XSS), which may lead to arbitrary remote code execution.
CVE-2021-3256 1 Kuaifan 1 Kuaifancms 2024-11-21 6.5 Medium
KuaiFanCMS V5.x contains an arbitrary file read vulnerability in the html_url parameter of the chakanhtml.module.php file.
CVE-2021-3254 1 Asus 2 Dsl-n14u-b1, Dsl-n14u-b1 Firmware 2024-11-21 7.5 High
Asus DSL-N14U-B1 1.1.2.3_805 allows remote attackers to cause a Denial of Service (DoS) via a TCP SYN scan using nmap.
CVE-2021-3252 1 Kaco-newenergy 2 Xp100u, Xp100u Firmware 2024-11-21 7.5 High
KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability.
CVE-2021-3246 4 Debian, Fedoraproject, Libsndfile Project and 1 more 5 Debian Linux, Fedora, Libsndfile and 2 more 2024-11-21 8.8 High
A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file.
CVE-2021-3243 1 Wfiltericf 1 Wfilter Internet Content Filter 2024-11-21 6.1 Medium
Wfilter ICF 5.0.117 contains a cross-site scripting (XSS) vulnerability. An attacker in the same LAN can craft a packet with a malicious User-Agent header to inject a payload in its logs, where an attacker can take over the system by through its plugin-running function.