Export limit exceeded: 88023 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (88023 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-43331 | 2 Debian, Gnu | 2 Debian Linux, Mailman | 2024-11-21 | 6.1 Medium |
| In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. | ||||
| CVE-2021-43324 | 1 Librenms | 1 Librenms | 2024-11-21 | 6.1 Medium |
| LibreNMS through 21.10.2 allows XSS via a widget title. | ||||
| CVE-2021-43319 | 1 Zohocorp | 1 Manageengine Network Configuration Manager | 2024-11-21 | 9.8 Critical |
| Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality. | ||||
| CVE-2021-43295 | 1 Zohocorp | 1 Manageengine Supportcenter Plus | 2024-11-21 | 6.1 Medium |
| Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module. | ||||
| CVE-2021-43294 | 1 Zohocorp | 1 Manageengine Supportcenter Plus | 2024-11-21 | 6.1 Medium |
| Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module. | ||||
| CVE-2021-43288 | 1 Thoughtworks | 1 Gocd | 2024-11-21 | 5.4 Medium |
| An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report. | ||||
| CVE-2021-43286 | 1 Thoughtworks | 1 Gocd | 2024-11-21 | 8.8 High |
| An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command-line injection in the Git URL "Test Connection" feature to execute arbitrary code. | ||||
| CVE-2021-43284 | 1 Govicture | 2 Wr1200, Wr1200 Firmware | 2024-11-21 | 7.8 High |
| An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its default value of admin. This enables an attacker to gain control of the device through SSH (regardless of whether the admin password was changed on the web interface). | ||||
| CVE-2021-43283 | 1 Govicture | 2 Wr1200, Wr1200 Firmware | 2024-11-21 | 8.8 High |
| An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the web interface of the device, allowing an attacker with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges. This occurs in the ping and traceroute features. An attacker would thus be able to use this vulnerability to open a reverse shell on the device with root privileges. | ||||
| CVE-2021-43282 | 1 Govicture | 2 Wr1200, Wr1200 Firmware | 2024-11-21 | 6.5 Medium |
| An issue was discovered on Victure WR1200 devices through 1.0.3. The default Wi-Fi WPA2 key is advertised to anyone within Wi-Fi range through the router's MAC address. The device default Wi-Fi password corresponds to the last 4 bytes of the MAC address of its 2.4 GHz network interface controller (NIC). An attacker within scanning range of the Wi-Fi network can thus scan for Wi-Fi networks to obtain the default key. | ||||
| CVE-2021-43280 | 1 Opendesign | 1 Drawings Software Development Kit | 2024-11-21 | 7.8 High |
| A stack-based buffer overflow vulnerability exists in the DWF file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of proper validation of the length of user-supplied data before copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. | ||||
| CVE-2021-43279 | 1 Opendesign | 1 Oda Prc Software Development Kit | 2024-11-21 | 7.8 High |
| An out-of-bounds write vulnerability exists in the U3D file reading procedure in Open Design Alliance PRC SDK before 2022.10. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. | ||||
| CVE-2021-43272 | 1 Opendesign | 1 Oda Viewer | 2024-11-21 | 9.8 Critical |
| An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 2022.11. ODA Viewer continues to process invalid or malicious DWF files instead of stopping upon an exception. An attacker can leverage this vulnerability to execute code in the context of the current process. | ||||
| CVE-2021-43266 | 1 Mahara | 1 Mahara | 2024-11-21 | 7.3 High |
| In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution | ||||
| CVE-2021-43265 | 1 Mahara | 1 Mahara | 2024-11-21 | 5.4 Medium |
| In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element. | ||||
| CVE-2021-43247 | 1 Microsoft | 14 Windows 10, Windows 10 1809, Windows 10 1909 and 11 more | 2024-11-21 | 7.8 High |
| Windows TCP/IP Driver Elevation of Privilege Vulnerability | ||||
| CVE-2021-43215 | 1 Microsoft | 22 Windows 10, Windows 10 1507, Windows 10 1607 and 19 more | 2024-11-21 | 9.8 Critical |
| iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution | ||||
| CVE-2021-43198 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | 5.4 Medium |
| In JetBrains TeamCity before 2021.1.2, stored XSS is possible. | ||||
| CVE-2021-43197 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | 6.1 Medium |
| In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS. | ||||
| CVE-2021-43186 | 1 Jetbrains | 1 Youtrack | 2024-11-21 | 5.4 Medium |
| JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS. | ||||