Export limit exceeded: 40649 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (40649 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-32615 | 1 Piwigo | 1 Piwigo | 2024-11-21 | 9.8 Critical |
| Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection. | ||||
| CVE-2021-32590 | 1 Fortinet | 1 Fortiportal | 2024-11-21 | 9.9 Critical |
| Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests. | ||||
| CVE-2021-32582 | 1 Connectwise | 1 Connectwise Automate | 2024-11-21 | 7.5 High |
| An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses. | ||||
| CVE-2021-32504 | 1 Sick | 2 Ftmg, Ftmg Firmware | 2024-11-21 | 5.3 Medium |
| Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system. | ||||
| CVE-2021-32503 | 1 Sick | 2 Ftmg, Ftmg Firmware | 2024-11-21 | 4.9 Medium |
| Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system. | ||||
| CVE-2021-32477 | 1 Moodle | 1 Moodle | 2024-11-21 | 4.3 Medium |
| The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected. | ||||
| CVE-2021-32474 | 1 Moodle | 1 Moodle | 2024-11-21 | 7.2 High |
| An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected. | ||||
| CVE-2021-32472 | 1 Moodle | 1 Moodle | 2024-11-21 | 4.3 Medium |
| Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and 3.8 to 3.8.8 are affected. | ||||
| CVE-2021-32428 | 1 Viaviweb | 1 Ebook | 2024-11-21 | 9.8 Critical |
| SQL Injection vulnerability in viaviwebtech Android EBook App (Books App, PDF, ePub, Online Book Reading, Download Books) 10 via the author_id parameter to api.php. | ||||
| CVE-2021-32172 | 1 Maianscriptworld | 1 Maian Cart | 2024-11-21 | 9.8 Critical |
| Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin. | ||||
| CVE-2021-32104 | 1 Open-emr | 1 Openemr | 2024-11-21 | 8.8 High |
| A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1. | ||||
| CVE-2021-32102 | 1 Open-emr | 1 Openemr | 2024-11-21 | 8.8 High |
| A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1. | ||||
| CVE-2021-32099 | 1 Artica | 1 Pandora Fms | 2024-11-21 | 9.8 Critical |
| A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass. | ||||
| CVE-2021-32095 | 1 Nsa | 1 Emissary | 2024-11-21 | 8.1 High |
| U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files. | ||||
| CVE-2021-32093 | 1 Nsa | 1 Emissary | 2024-11-21 | 6.5 Medium |
| The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter. | ||||
| CVE-2021-32056 | 2 Cyrus, Fedoraproject | 2 Imap, Fedora | 2024-11-21 | 4.3 Medium |
| Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall. | ||||
| CVE-2021-32051 | 1 Hexagon | 1 Intergraph G\!nius | 2024-11-21 | 7.5 High |
| Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter. | ||||
| CVE-2021-32015 | 1 Nuvoton | 2 Npct75x, Npct75x Firmware | 2024-11-21 | 6.0 Medium |
| In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-volatile memory. NOTE: Upgrading to firmware version 7.4.0.1 will mitigate against the vulnerability, but version 7.4.0.1 is not TCG or Common Criteria (CC) certified. Nuvoton recommends that users apply the NPCT75x TPM 1.2 firmware update. | ||||
| CVE-2021-31999 | 1 Rancher | 1 Rancher | 2024-11-21 | 8.8 High |
| A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16. | ||||
| CVE-2021-31926 | 1 Cubecoders | 1 Amp | 2024-11-21 | 6.5 Medium |
| AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by crafting an HTTP(S) request directly to the applicable API endpoint (despite not having permission to make changes to the system's network configuration). | ||||