Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (84715 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-44620 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 9.8 Critical
A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters.
CVE-2021-44608 1 Bloofox 1 Bloofoxcms 2024-11-21 5.4 Medium
Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter in an edit action in index.php.
CVE-2021-44607 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 5.4 Medium
A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.
CVE-2021-44598 1 Attendance Management System Project 1 Attendance Management System 2024-11-21 6.1 Medium
Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system, by using the XSS-reflected method, and then can store information by injecting the admin account on this system.
CVE-2021-44591 1 Libming 1 Libming 2024-11-21 6.5 Medium
In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks via a crafted SWF file.
CVE-2021-44590 1 Libming 1 Libming 2024-11-21 6.5 Medium
In libming 0.4.8, a memory exhaustion vulnerability exist in the function cws2fws in util/main.c. Remote attackers could launch denial of service attacks by submitting a crafted SWF file that exploits this vulnerability.
CVE-2021-44585 1 Jeecg 1 Jeecg Boot 2024-11-21 6.1 Medium
A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.
CVE-2021-44584 1 Emlog 1 Emlog 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2021-44568 2 Opensuse, Redhat 3 Libsolv, Satellite, Satellite Capsule 2024-11-21 6.5 Medium
Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 & line 1995), which could cause a remote Denial of Service.
CVE-2021-44566 1 Rosariosis 1 Rosariosis 2024-11-21 5.4 Medium
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php.
CVE-2021-44565 1 Rosariosis 1 Rosariosis 2024-11-21 5.4 Medium
A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields.
CVE-2021-44550 1 Stanford 1 Corenlp 2024-11-21 9.8 Critical
An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
CVE-2021-44544 1 Deltaww 1 Diaenergie 2024-11-21 7.5 High
DIAEnergie Version 1.7.5 and prior is vulnerable to multiple cross-site scripting vulnerabilities when arbitrary code is injected into the parameter “name” of the script “HandlerEnergyType.ashx”.
CVE-2021-44543 1 Privoxy 1 Privoxy 2024-11-21 6.1 Medium
An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the template name when Privoxy is configured to servce the user-manual itself.
CVE-2021-44537 2 Fedoraproject, Owncloud 2 Fedora, Owncloud Desktop Client 2024-11-21 7.8 High
ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution.
CVE-2021-44530 1 Ui 1 Unifi Network Controller 2024-11-21 9.8 Critical
An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a malicious actor to control the application.
CVE-2021-44521 1 Apache 1 Cassandra 2024-11-21 9.1 Critical
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
CVE-2021-44520 1 Citrix 1 Xenmobile Server 2024-11-21 8.8 High
In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Command Injection vulnerability, leading to remote code execution with root privileges.
CVE-2021-44512 1 Tmate 1 Tmate-ssh-server 2024-11-21 7.0 High
World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory.
CVE-2021-44502 1 Fisglobal 1 Gt.m 2024-11-21 7.5 High
An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can control the size of a memset that occurs in calls to util_format in sr_unix/util_output.c.