Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,829

CVE-2021-26635

Bandisoft ARK Library buffer overflow vulnerability

In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wrong use of the data type. An attacker could use this vulnerability to cause a stack buffer overflow and as a result, perform an attack such as remote code execution.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed
Vendors
Bandisoft
Products
Ark Library
CVE-2021-26634

Maxboard multiple vulnerabilities

SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Linux Maxb
Products
Linux Kernel Maxboard
CVE-2021-26633

Maxboard SQL injection and LFI vulnerability

SQL injection and Local File Inclusion (LFI) vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulnerabilities can be exploited by manipulating a variable with a desired value and inserting and arbitrary file.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Linux Maxb
Products
Linux Kernel Maxboard
CVE-2021-26631

Mangboard parameter modulation vulnerability

Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploit this vulnerability to manipulate the total order amount into a negative number and then pay for the order.

CVSS 3.1 · 8 High EPSS 1.1% KEV · Not listed
Vendors
Mangboard
Products
Commerce
CVE-2021-26630

HANDY Groupware file download and execute vulnerability

Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Handysoft Microsoft
Products
Groupware Windows
CVE-2021-26629

tobesoft XPLATFORM Path Traversal Vulnerability

A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be d in the parent path by using the path traversal pattern ‘..\’.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Microsoft Tobesoft
Products
Windows Xplatform
CVE-2021-26628

MaxBoard XSS and File Upload Vulnerability

Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file in a specific menu, the verification of the files is insufficient. It allows remote attackers to upload arbitrary files disguising them as image files.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Linux Maxb
Products
Linux Kernel Maxboard
CVE-2021-26627

EDrhyme QCP 200W Information Exposure Vulnerability

Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerability could allow to remote attackers to send the RTSP requests using ffplay command and lead to leakage a live image.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Qcp
Products
Qcp200w Qcp200w Firmware
CVE-2021-26626

tobesoft XPLATFORM Arbitrary file execution Vulnerability

Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowser function is ‘default’, the first parameter value could be passed to the ShellExecuteW API. The passed parameter is an arbitrary code to be executed. Remote attackers can use this vulnerability to execute arbitrary remote code.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed
Vendors
Microsoft Tobesoft
Products
Windows Xplatform
CVE-2021-26625

tobesoft Nexacro arbitrary file download vulnerability

Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerability is caused by an automatic update function that does not verify input data except version information. Remote attackers can use this incomplete validation logic to download and execute arbitrary malicious file.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Tobesoft
Products
Windows Nexacro
CVE-2021-26624

eScan Anti-Virus Local privilege escalation Vulnerability

An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid arguments and insufficient execution conditions related to "runasroot" command. This vulnerability can induce remote attackers to exploit root privileges by manipulating parameter values.

CVSS 3.1 · 7.8 High EPSS 2.4% KEV · Not listed
Vendors
Escanav
Products
Escan Anti-virus
CVE-2021-26623

Bandisoft ARK Library Out-of-bound Vulnerability

A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark library. Remote attackers can induce exploit malicious code using this function.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Bandisoft Microsoft
Products
Bandizip Windows
CVE-2021-26622

Genian NAC remote code execution vulnerability

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability.

CVSS 3.1 · 9.6 Critical EPSS 3.0% KEV · Not listed
Vendors
Genians Microsoft
Products
Genian Nac Windows
CVE-2021-26621

Netis Korea MEX01 Buffer overflow vulnerability

An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this vulnerability by using the property that the target program copies parameter values to memory through the strcpy() function.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed
Vendors
Netu
Products
Mex01 Mex01 Firmware
CVE-2021-26620

IPTIME NAS2dual improper authentication vulnerability

An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s passwords.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Iptime
Products
Nas-i Nas-i Firmware Nas-ii and 15 more
CVE-2021-26619

BigFileAgent arbitrary file Deleting vulnerability

An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerability to delete arbitrary files of unspecified number of users.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bigfile Microsoft
Products
Bigfileagent Windows
CVE-2021-26618

Tmax ToOffice arbitrary file creation vulnerability

An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitrary file included malicious code.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Microsoft Tmax
Products
Windows Tooffice
CVE-2021-26617

Gabia Firstmall remote code execution vulnerability

This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to execute malicious code in Firstmall via navercheckout_add function.

CVSS 3.1 · 8.1 High EPSS 1.3% KEV · Not listed
Vendors
Firstmall Microsoft
Products
Firstmall Windows
CVE-2021-26616

SecuwaySSL OS command injection vulnerability

An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Secuwiz
Products
Secuwayssl U
CVE-2021-26615

bandisoft ARK library integer overflow vulnerability

ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an integer overflow.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Bandisoft Linux
Products
Ark Library Linux Kernel