Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (97362 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-23419 1 Open-graph Project 1 Open-graph 2024-11-21 7.3 High
This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.
CVE-2021-23415 1 Elfinder.aspnet Project 1 Elfinder.aspnet 2024-11-21 7.5 High
This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path.
CVE-2021-23412 1 Gitlogplus Project 1 Gitlogplus 2024-11-21 8.1 High
All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.
CVE-2021-23409 1 Go-proxyproto Project 1 Go-proxyproto 2024-11-21 7.5 High
The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.
CVE-2021-23407 1 Elfinder.net.core Project 1 Elfinder.net.core 2024-11-21 7.5 High
This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path.
CVE-2021-23406 1 Pac-resolver Project 1 Pac-resolver 2024-11-21 8.1 High
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
CVE-2021-23405 1 Pimcore 1 Pimcore 2024-11-21 8.3 High
This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.
CVE-2021-23404 1 Sqlite-web Project 1 Sqlite-web 2024-11-21 7.6 High
This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.
CVE-2021-23403 1 Ts-nodash Project 1 Ts-nodash 2024-11-21 7.3 High
All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
CVE-2021-23402 1 Record-like-deep-assign Project 1 Record-like-deep-assign 2024-11-21 7.3 High
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
CVE-2021-23399 1 Wincred Project 1 Wincred 2024-11-21 7.3 High
This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23395 1 Nedb Project 1 Nedb 2024-11-21 7.3 High
This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor.prototype payload.
CVE-2021-23394 1 Std42 1 Elfinder 2024-11-21 8.1 High
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
CVE-2021-23391 1 Calipso Project 1 Calipso 2024-11-21 7.3 High
This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.
CVE-2021-23386 1 Dns-packet Project 1 Dns-packet 2024-11-21 7.7 High
This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.
CVE-2021-23381 1 Killing Project 1 Killing 2024-11-21 7.3 High
This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23379 1 Portkiller Project 1 Portkiller 2024-11-21 7.3 High
This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23375 1 Psnode Project 1 Psnode 2024-11-21 7.3 High
This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23374 1 Ps-visitor Project 1 Ps-visitor 2024-11-21 7.3 High
This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
CVE-2021-23373 1 Set-deep-prop Project 1 Set-deep-prop 2024-11-21 7.5 High
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.