Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (357117 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-45898 1 Salesagility 1 Suitecrm 2024-11-21 9.8 Critical
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion.
CVE-2021-45897 1 Salesagility 1 Suitecrm 2024-11-21 8.8 High
SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.
CVE-2021-45896 1 Nokia 2 Fastmile, Fastmile Firmware 2024-11-21 8.8 High
Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of Import Config File.
CVE-2021-45895 1 Netgen 1 Tags Bundle 2024-11-21 6.1 Medium
Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface.
CVE-2021-45894 1 Zauner 1 Arc 2024-11-21 5.9 Medium
An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Cleartext Transmission of Sensitive Information.
CVE-2021-45893 1 Zauner 1 Arc 2024-11-21 7.5 High
An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Improper Handling of Case Sensitivity, which makes password guessing easier.
CVE-2021-45892 1 Zauner 1 Arc 2024-11-21 5.9 Medium
An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is storage of Passwords in a Recoverable Format.
CVE-2021-45891 1 Zauner 1 Arc 2024-11-21 8.8 High
An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4., that allows attackers to escalate privileges within the application, since all permission checks are done client-side, not server-side.
CVE-2021-45890 1 Authguard Project 1 Authguard 2024-11-21 9.8 Critical
basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier.
CVE-2021-45889 1 Ponton 1 X\/p Messenger 2024-11-21 5.4 Medium
An issue was discovered in PONTON X/P Messenger before 3.11.2. Several functions are vulnerable to reflected XSS, as demonstrated by private/index.jsp?partners/ShowNonLocalPartners.do?localID= or private/index.jsp or private/index.jsp?database/databaseTab.jsp or private/index.jsp?activation/activationMainTab.jsp or private/index.jsp?communication/serverTab.jsp or private/index.jsp?emailNotification/notificationTab.jsp.
CVE-2021-45888 1 Ponton 1 X\/p Messenger 2024-11-21 4.8 Medium
An issue was discovered in PONTON X/P Messenger before 3.11.2. The navigation tree that is shown on the left side of every page of the web application is vulnerable to XSS: it allows injection of JavaScript into its nodes. Creating such nodes is only possible for users who have the role Configuration Administrator or Administrator.
CVE-2021-45887 1 Ponton 1 X\/p Messenger 2024-11-21 9.8 Critical
An issue was discovered in PONTON X/P Messenger before 3.11.2. Due to path traversal in private/SchemaSetUpload.do for uploaded ZIP files, an executable script can be uploaded by web application administrators, giving the attacker remote code execution on the underlying server via an imgs/*.jsp URI.
CVE-2021-45886 1 Ponton 1 X\/p Messenger 2024-11-21 8.8 High
An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user (such as operator) can be used to confirm actions of higher-privileged ones (such as xpadmin).
CVE-2021-45885 1 Stormshield 1 Network Security 2024-11-21 7.5 High
An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH password change does not properly clear the old password.
CVE-2021-45884 4 Apple, Brave, Linux and 1 more 4 Macos, Brave, Linux Kernel and 1 more 2024-11-21 7.5 High
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue exists because of an incomplete fix for CVE-2021-21323 and CVE-2021-22916.
CVE-2021-45878 1 Garo 6 Wallbox Glb, Wallbox Glb Firmware, Wallbox Gtb and 3 more 2024-11-21 9.1 Critical
Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by incorrect access control. Lack of access control on the web manger pages allows any user to view and modify information.
CVE-2021-45877 1 Garo 6 Wallbox Glb, Wallbox Glb Firmware, Wallbox Gtb and 3 more 2024-11-21 9.8 Critical
Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by hard coded credentials. A hardcoded credential exist in /etc/tomcat8/tomcat-user.xml, which allows attackers to gain authorized access and control the tomcat completely on port 8000 in the tomcat manger page.
CVE-2021-45876 1 Garo 6 Wallbox Glb, Wallbox Glb Firmware, Wallbox Gtb and 3 more 2024-11-21 9.8 Critical
Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware.
CVE-2021-45868 2 Linux, Netapp 17 Linux Kernel, H300e, H300e Firmware and 14 more 2024-11-21 5.5 Medium
In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.
CVE-2021-45866 1 Student Attendance Management System Project 1 Student Attendance Management System 2024-11-21 5.4 Medium
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Student Attendance Management System 1.0 via the couse filed in index.php.