Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (346376 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-27692 1 Tendacn 4 G1, G1 Firmware, G3 and 1 more 2024-11-21 9.8 Critical
Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the "doSystemCmd" function with untrusted input.
CVE-2021-27691 1 Tendacn 6 G0, G0 Firmware, G1 and 3 more 2024-11-21 9.8 Critical
Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This occurs because the "formSetDebugCfg" function executes glibc's system function with untrusted input.
CVE-2021-27679 1 Batflat 1 Batflat 2024-11-21 5.4 Medium
Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-27678 1 Batflat 1 Batflat 2024-11-21 5.4 Medium
Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-27677 1 Batflat 1 Batflat 2024-11-21 5.4 Medium
Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-27676 1 Centreon 1 Centreon 2024-11-21 5.4 Medium
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page.
CVE-2021-27673 1 Tribalsystems 1 Zenario 2024-11-21 4.8 Medium
Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component.
CVE-2021-27672 1 Tribalsystems 1 Zenario 2024-11-21 4.9 Medium
SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component.
CVE-2021-27671 1 Comrak Project 1 Comrak 2024-11-21 6.1 Medium
An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.
CVE-2021-27670 1 Appspace 1 Appspace 2024-11-21 9.8 Critical
Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.
CVE-2021-27668 1 Hashicorp 1 Vault 2024-11-21 5.3 Medium
HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.
CVE-2021-27665 1 Johnsoncontrols 1 Exacqvision Server 2024-11-21 7.5 High
An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition.
CVE-2021-27664 1 Johnsoncontrols 1 Exacqvision Web Service 2024-11-21 9.8 Critical
Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.
CVE-2021-27663 1 Johnsoncontrols 2 Ac2000, Ac2000 Firmware 2024-11-21 8.2 High
A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization. This issue affects: Johnson Controls CEM Systems AC2000 10.1; 10.2; 10.3; 10.4; 10.5.
CVE-2021-27662 1 Johnsoncontrols 2 Kantech Kt-1 Door Controller, Kantech Kt-1 Door Controller Firmware 2024-11-21 8.6 High
The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01
CVE-2021-27661 1 Johnsoncontrols 2 F4-snc, F4-snc Firmware 2024-11-21 8.8 High
Successful exploitation of this vulnerability could give an authenticated Facility Explorer SNC Series Supervisory Controller (F4-SNC) user an unintended level of access to the controller’s file system, allowing them to access or modify system files by sending specifically crafted web messages to the F4-SNC.
CVE-2021-27660 1 Johnsoncontrols 2 C-cure 9000, C-cure 9000 Firmware 2024-11-21 8.8 High
An insecure client auto update feature in C-CURE 9000 can allow remote execution of lower privileged Windows programs.
CVE-2021-27659 1 Johnsoncontrols 1 Exacqvision Web Service 2024-11-21 5.3 Medium
exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2021-27658 1 Johnsoncontrols 1 Exacqvision Enterprise Manager 2024-11-21 4.3 Medium
exacqVision Enterprise Manager 20.12 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2021-27657 1 Johnsoncontrols 1 Metasys 2024-11-21 8.8 High
Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.