Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88023 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-28280 1 Php-fusion 1 Phpfusion 2024-11-21 6.1 Medium
CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
CVE-2021-28278 1 Jhead Project 1 Jhead 2024-11-21 7.8 High
A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via the RemoveSectionType function in jpgfile.c.
CVE-2021-28277 1 Jhead Project 1 Jhead 2024-11-21 7.8 High
A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c.
CVE-2021-28275 1 Jhead Project 1 Jhead 2024-11-21 5.5 Medium
A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file.
CVE-2021-28269 1 Soyal 1 701client 2024-11-21 8.8 High
Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permissions.
CVE-2021-28247 1 Ca 1 Ehealth Performance Manager 2024-11-21 5.4 Medium
CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the platform users. The affected endpoints are: cgi/nhWeb with the parameter report, aviewbin/filtermibobjects.pl with the parameter namefilter, and aviewbin/query.pl with the parameters System, SystemText, Group, and GroupText. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2021-28237 1 Gnu 1 Libredwg 2024-11-21 9.8 Critical
LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13.
CVE-2021-28233 1 Ok-file-formats Project 1 Ok-file-formats 2024-11-21 8.8 High
Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c.
CVE-2021-28211 2 Redhat, Tianocore 2 Enterprise Linux, Edk2 2024-11-21 6.7 Medium
A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.
CVE-2021-28204 1 Asus 6 Asmb8-ikvm, Asmb8-ikvm Firmware, Z10pe-d16 Ws and 3 more 2024-11-21 7.2 High
The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.
CVE-2021-28203 1 Asus 6 Asmb8-ikvm, Asmb8-ikvm Firmware, Z10pe-d16 Ws and 3 more 2024-11-21 7.2 High
The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary.
CVE-2021-28161 1 Eclipse 1 Theia 2024-11-21 6.1 Medium
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
CVE-2021-28160 1 Acexy Wireless-n Wifi Repeater Project 2 Acexy Wireless-n Wifi Repeater, Acexy Wireless-n Wifi Repeater Firmware 2024-11-21 6.1 Medium
Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is displayed in the /repeater.html page ("Repeater Wizard" homepage section).
CVE-2021-28151 1 Hongdian 2 H8922, H8922 Firmware 2024-11-21 8.8 High
Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, which is accessible with the username guest and password guest.
CVE-2021-28145 1 Concretecms 1 Concrete Cms 2024-11-21 5.4 Medium
Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.
CVE-2021-28144 1 Dlink 2 Dir-3060, Dir-3060 Firmware 2024-11-21 8.8 High
prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely.
CVE-2021-28143 1 Dlink 2 Dir-841, Dir-841 Firmware 2024-11-21 8.0 High
/jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools).
CVE-2021-28136 1 Espressif 2 Esp-idf, Esp32 2024-11-21 6.5 Medium
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.
CVE-2021-28132 1 Lucysecurity 1 Security Awareness 2024-11-21 9.8 Critical
LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI.
CVE-2021-28126 1 Compassplus 1 Tranzware E-commerce Payment Gateway 2024-11-21 6.1 Medium
index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability