Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (84529 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-34243 1 Icehrm 1 Icehrm 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web scripts or HTML via a crafted file uploaded into the Document Management tab. The exploit is triggered when a user visits the upload location of the crafted file.
CVE-2021-34228 1 Totolink 2 A3002r, A3002r Firmware 2024-11-21 6.1 Medium
Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Description" field and "Service Name" field.
CVE-2021-34223 1 Totolink 2 A3002r, A3002r Firmware 2024-11-21 6.1 Medium
Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "URL Address" field.
CVE-2021-34220 1 Totolink 2 A3002r, A3002r Firmware 2024-11-21 6.1 Medium
Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "User Name" field or "Password" field.
CVE-2021-34215 1 Totolink 2 A3002r, A3002r Firmware 2024-11-21 6.1 Medium
Cross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Service Name" field.
CVE-2021-34207 1 Totolink 2 A3002r, A3002r Firmware 2024-11-21 6.1 Medium
Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Domain Name" field, "Server Address" field, "User Name/Email", or "Password/Key" field.
CVE-2021-34202 1 Dlink 2 Dir-2640-us, Dir-2640-us Firmware 2024-11-21 7.8 High
There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permissions can be elevated to administrator permissions, resulting in local arbitrary code execution. An attacker can combine other vulnerabilities to further achieve the purpose of remote code execution.
CVE-2021-34201 1 Dlink 2 Dir-2640-us, Dir-2640-us Firmware 2024-11-21 7.1 High
D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640). Local ordinary users can overwrite the global variables in the .bss section, causing the process crashes or changes.
CVE-2021-34190 1 Issabel 1 Pbx 2024-11-21 4.8 Medium
A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Name" or "Prefix" fields under the "Create New Rate" module.
CVE-2021-34123 1 Atasm Project 1 Atasm 2024-11-21 9.8 Critical
An issue was discovered on atasm, version 1.09. A stack-buffer-overflow vulnerability in function aprintf() in asm.c allows attackers to execute arbitrary code on the system via a crafted file.
CVE-2021-34119 1 Htmldoc Project 1 Htmldoc 2024-11-21 7.8 High
A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
CVE-2021-34111 1 Thecus 2 N4800eco, N4800eco Firmware 2024-11-21 9.8 Critical
Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php.
CVE-2021-34110 1 Nica 1 Winwaste.net 2024-11-21 7.8 High
WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious file that will be executed with "LocalSystem" privileges.
CVE-2021-34084 1 S3-uploader Project 1 S3-uploader 2024-11-21 9.8 Critical
OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata() function.
CVE-2021-34083 1 Google-it Project 1 Google-it 2024-11-21 8.1 High
Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially exposing the server to RCE.
CVE-2021-34082 1 Proctree Project 1 Proctree 2024-11-21 9.8 Critical
OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function.
CVE-2021-34081 1 Gitsome Project 1 Gitsome 2024-11-21 8.8 High
OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository.
CVE-2021-34080 1 Ssl-utils Project 1 Ssl-utils 2024-11-21 9.8 Critical
OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest() and the createCert() functions.
CVE-2021-34079 1 Docker-tester Project 1 Docker-tester 2024-11-21 9.8 Critical
OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports' entry of a crafted docker-compose.yml file.
CVE-2021-34078 1 Adp 1 Lifion-verifiy-dependencies 2024-11-21 8.8 High
lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.