Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (348521 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-33271 1 Dlink 2 Dir-809, Dir-809 Firmware 2024-11-21 9.8 Critical
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function sub_80046EB4 in /formSetPortTr. This vulnerability is triggered via a crafted POST request.
CVE-2021-33270 1 Dlink 2 Dir-809, Dir-809 Firmware 2024-11-21 9.8 Critical
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_800462c4 in /formAdvFirewall. This vulnerability is triggered via a crafted POST request.
CVE-2021-33269 1 Dlink 2 Dir-809, Dir-809 Firmware 2024-11-21 9.8 Critical
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_8004776c in /formVirtualServ. This vulnerability is triggered via a crafted POST request.
CVE-2021-33268 1 Dlink 2 Dir-809, Dir-809 Firmware 2024-11-21 9.8 Critical
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function sub_8003183C in /fromLogin. This vulnerability is triggered via a crafted POST request.
CVE-2021-33267 1 Dlink 2 Dir-809, Dir-809 Firmware 2024-11-21 9.8 Critical
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_80034d60 in /formStaticDHCP. This vulnerability is triggered via a crafted POST request.
CVE-2021-33266 1 Dlink 2 Dir-809, Dir-809 Firmware 2024-11-21 9.8 Critical
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_8004776c in /formVirtualApp. This vulnerability is triggered via a crafted POST request.
CVE-2021-33265 1 Dlink 2 Dir-809, Dir-809 Firmware 2024-11-21 9.8 Critical
D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability in the function FUN_80046eb4 in /formSetPortTr. This vulnerability is triggered via a crafted POST request.
CVE-2021-33259 2 D-link, Dlink 2 Dir-868lw Firmware, Dir-868lw 2024-11-21 5.3 Medium
Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers to obtain users' DNS query history.
CVE-2021-33256 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 8.8 High
A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Report" as CSV file. Note: The vendor disputes this vulnerability, claiming "This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side.
CVE-2021-33254 2 Embedthis, Linux 2 Appweb, Linux Kernel 2024-11-21 7.5 High
An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramter to the parseUri function.
CVE-2021-33221 1 Commscope 1 Ruckus Iot Controller 2024-11-21 9.8 Critical
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints.
CVE-2021-33220 1 Commscope 1 Ruckus Iot Controller 2024-11-21 7.8 High
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist.
CVE-2021-33219 1 Commscope 1 Ruckus Iot Controller 2024-11-21 9.8 Critical
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and nplus1user accounts.
CVE-2021-33218 1 Commscope 1 Ruckus Iot Controller 2024-11-21 9.8 Critical
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access.
CVE-2021-33217 1 Commscope 1 Ruckus Iot Controller 2024-11-21 8.8 High
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root.
CVE-2021-33216 1 Commscope 1 Ruckus Iot Controller 2024-11-21 9.8 Critical
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account.
CVE-2021-33215 1 Commscope 1 Ruckus Iot Controller 2024-11-21 4.3 Medium
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal.
CVE-2021-33214 1 Hms-networks 1 Ecatcher 2024-11-21 6.1 Medium
In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation.
CVE-2021-33213 1 Element-it 1 Http Commander 2024-11-21 6.5 Medium
An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address.
CVE-2021-33212 1 Element-it 1 Http Commander 2024-11-21 5.4 Medium
A Cross-site scripting (XSS) vulnerability in the "View in Browser" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SVG image.