Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

CVE-2021-28187

ASUS BMC's firmware: buffer overflow - Generate new SSL certificate

The specific function in ASUS BMC’s firmware Web management page (Generate new SSL certificate) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.1% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28186

ASUS BMC's firmware: buffer overflow - ActiveX configuration-2 acquisition

The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-2 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28185

ASUS BMC's firmware: buffer overflow - ActiveX configuration-1 acquisition

The specific function in ASUS BMC’s firmware Web management page (ActiveX configuration-1 acquisition) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28184

ASUS BMC's firmware: buffer overflow - Active Directory configuration function

The Active Directory configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28183

ASUS BMC's firmware: buffer overflow - Web License configuration setting

The specific function in ASUS BMC’s firmware Web management page (Web License configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28182

ASUS BMC's firmware: buffer overflow - Web Service configuration function

The Web Service configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28181

ASUS BMC's firmware: buffer overflow - Remote video configuration setting

The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28180

ASUS BMC's firmware: buffer overflow - Audit log configuration setting

The specific function in ASUS BMC’s firmware Web management page (Audit log configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28179

ASUS BMC's firmware: buffer overflow - Media support configuration setting

The specific function in ASUS BMC’s firmware Web management page (Media support configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28178

ASUS BMC's firmware: buffer overflow - UEFI configuration function

The UEFI configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28177

ASUS BMC's firmware: buffer overflow - LDAP configuration function

The LDAP configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28176

ASUS BMC's firmware: buffer overflow - DNS configuration function

The DNS configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28175

ASUS BMC's firmware: buffer overflow - Radius configuration function

The Radius configuration function in ASUS BMC’s firmware Web management page does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Asus
Products
Asmb8-ikvm Asmb8-ikvm Firmware Z10pe-d16 Ws and 3 more
CVE-2021-28174

Mitake Smart Stock Selection System - Broken Authentication

Mitake smart stock selection system contains a broken authentication vulnerability. By manipulating the parameters in the URL, remote attackers can gain the privileged permissions to access transaction record, and fraudulent trading without login.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mitake
Products
Smart Stock Selection
CVE-2021-28173

Vangene deltaFlow E-platform - Arbitrary File Upload

The file upload function of Vangene deltaFlow E-platform does not perform access controlled properly. Remote attackers can upload and execute arbitrary files without login.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Deltaflow Project
Products
Deltaflow
CVE-2021-28172

Vangene deltaFlow E-platform - Path Traversal

There is a Path Traversal vulnerability in the file download function of Vangene deltaFlow E-platform. Remote attackers can access credential data with this leakage.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Deltaflow Project
Products
Deltaflow
CVE-2021-28171

Vangene deltaFlow E-platform - Broken Authentication

The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data in the Cookie.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Deltaflow Project
Products
Deltaflow
CVE-2021-28169

jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CVSS 3.1 · 5.3 Medium EPSS 78.5% KEV · Not listed
Vendors
Debian Eclipse Netapp and 2 more
Products
Debian Linux Jetty Active Iq Unified Manager and 11 more
CVE-2021-28168

jersey: Local information disclosure via system temporary directory

Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse Oracle Redhat
Products
Jersey Communications Cloud Native Core Policy Communications Cloud Native Core Unified Data Repository and 3 more