Export limit exceeded: 88023 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (88023 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-36746 | 1 Blackboard | 1 Blackboard Learn | 2024-11-21 | 5.4 Medium |
| Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor. | ||||
| CVE-2021-36738 | 1 Apache | 1 Pluto | 2024-11-21 | 6.1 Medium |
| The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact | ||||
| CVE-2021-36737 | 1 Apache | 1 Pluto | 2024-11-21 | 6.1 Medium |
| The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact | ||||
| CVE-2021-36720 | 1 Pineapp | 1 Mail Secure | 2024-11-21 | 6.1 Medium |
| PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=<script>alert(1)</script> and stealing cookies . | ||||
| CVE-2021-36707 | 1 Prolink | 2 Prc2402m, Prc2402m Firmware | 2024-11-21 | 9.8 Critical |
| In ProLink PRC2402M V1.0.18 and older, the set_ledonoff function in the adm.cgi binary, accessible with a page parameter value of ledonoff contains a trivial command injection where the value of the led_cmd parameter is passed directly to do_system. | ||||
| CVE-2021-36706 | 1 Prolink | 2 Prc2402m, Prc2402m Firmware | 2024-11-21 | 9.8 Critical |
| In ProLink PRC2402M V1.0.18 and older, the set_sys_cmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD contains a trivial command injection where the value of the command parameter is passed directly to system. | ||||
| CVE-2021-36705 | 1 Prolink | 2 Prc2402m, Prc2402m Firmware | 2024-11-21 | 9.8 Critical |
| In ProLink PRC2402M V1.0.18 and older, the set_TR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contains a trivial command injection where the value of the TR069_local_port parameter is passed directly to system. | ||||
| CVE-2021-36703 | 1 Htmly | 1 Htmly | 2024-11-21 | 6.1 Medium |
| The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website name. | ||||
| CVE-2021-36702 | 1 Htmly | 1 Htmly | 2024-11-21 | 6.1 Medium |
| The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through special content. | ||||
| CVE-2021-36698 | 1 Artica | 1 Pandora Fms | 2024-11-21 | 5.4 Medium |
| Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name. | ||||
| CVE-2021-36697 | 1 Artica | 1 Pandora Fms | 2024-11-21 | 6.7 Medium |
| With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rewrite Rule with a type definition. A normal PHP file can be uploaded with this new "file type" and the code can be executed with an HTTP request. | ||||
| CVE-2021-36696 | 1 Deskpro | 1 Deskpro | 2024-11-21 | 5.4 Medium |
| Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social media links on a user profile due to lack of input validation. | ||||
| CVE-2021-36695 | 1 Deskpro | 1 Deskpro | 2024-11-21 | 5.4 Medium |
| Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in the download file feature on a manager profile due to lack of input validation. | ||||
| CVE-2021-36668 | 1 Druva | 1 Insync Client | 2024-11-21 | 7.8 High |
| URL injection in Driva inSync 6.9.0 for MacOS, allows attackers to force a visit to an arbitrary url via the port parameter to the Electron App. | ||||
| CVE-2021-36667 | 1 Druva | 1 Insync Client | 2024-11-21 | 7.8 High |
| Command injection vulnerability in Druva inSync 6.9.0 for MacOS, allows attackers to execute arbitrary commands via crafted payload to the local HTTP server due to un-sanitized call to the python os.system library. | ||||
| CVE-2021-36654 | 1 Cmsuno Project | 1 Cmsuno | 2024-11-21 | 5.4 Medium |
| CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) while updating the theme. | ||||
| CVE-2021-36646 | 1 Kodcloud | 1 Kodexplorer | 2024-11-21 | 6.1 Medium |
| A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.45 allows remote attackers to run arbitrary code via /index.php page. | ||||
| CVE-2021-36609 | 1 Webtareas Project | 1 Webtareas | 2024-11-21 | 5.4 Medium |
| Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php. | ||||
| CVE-2021-36608 | 1 Webtareas Project | 1 Webtareas | 2024-11-21 | 5.4 Medium |
| Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php. | ||||
| CVE-2021-36605 | 1 Engineercms Project | 1 Engineercms | 2024-11-21 | 5.4 Medium |
| engineercms 1.03 is vulnerable to Cross Site Scripting (XSS). There is no escaping in the nickname field on the user list page. When viewing this page, the JavaScript code will be executed in the user's browser. | ||||