Export limit exceeded: 88023 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (88023 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-28280 | 1 Php-fusion | 1 Phpfusion | 2024-11-21 | 6.1 Medium |
| CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML | ||||
| CVE-2021-28278 | 1 Jhead Project | 1 Jhead | 2024-11-21 | 7.8 High |
| A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via the RemoveSectionType function in jpgfile.c. | ||||
| CVE-2021-28277 | 1 Jhead Project | 1 Jhead | 2024-11-21 | 7.8 High |
| A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c. | ||||
| CVE-2021-28275 | 1 Jhead Project | 1 Jhead | 2024-11-21 | 5.5 Medium |
| A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file. | ||||
| CVE-2021-28269 | 1 Soyal | 1 701client | 2024-11-21 | 8.8 High |
| Soyal Technology 701Client 9.0.1 is vulnerable to Insecure permissions via client.exe binary with Authenticated Users group with Full permissions. | ||||
| CVE-2021-28247 | 1 Ca | 1 Ehealth Performance Manager | 2024-11-21 | 5.4 Medium |
| CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and perform a Reflected Cross-Site Scripting attack against the platform users. The affected endpoints are: cgi/nhWeb with the parameter report, aviewbin/filtermibobjects.pl with the parameter namefilter, and aviewbin/query.pl with the parameters System, SystemText, Group, and GroupText. NOTE: This vulnerability only affects products that are no longer supported by the maintainer | ||||
| CVE-2021-28237 | 1 Gnu | 1 Libredwg | 2024-11-21 | 9.8 Critical |
| LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13. | ||||
| CVE-2021-28233 | 1 Ok-file-formats Project | 1 Ok-file-formats | 2024-11-21 | 8.8 High |
| Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c. | ||||
| CVE-2021-28211 | 2 Redhat, Tianocore | 2 Enterprise Linux, Edk2 | 2024-11-21 | 6.7 Medium |
| A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. | ||||
| CVE-2021-28204 | 1 Asus | 6 Asmb8-ikvm, Asmb8-ikvm Firmware, Z10pe-d16 Ws and 3 more | 2024-11-21 | 7.2 High |
| The specific function in ASUS BMC’s firmware Web management page (Modify user’s information function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary. | ||||
| CVE-2021-28203 | 1 Asus | 6 Asmb8-ikvm, Asmb8-ikvm Firmware, Z10pe-d16 Ws and 3 more | 2024-11-21 | 7.2 High |
| The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary. | ||||
| CVE-2021-28161 | 1 Eclipse | 1 Theia | 2024-11-21 | 6.1 Medium |
| In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected. | ||||
| CVE-2021-28160 | 1 Acexy Wireless-n Wifi Repeater Project | 2 Acexy Wireless-n Wifi Repeater, Acexy Wireless-n Wifi Repeater Firmware | 2024-11-21 | 6.1 Medium |
| Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is displayed in the /repeater.html page ("Repeater Wizard" homepage section). | ||||
| CVE-2021-28151 | 1 Hongdian | 2 H8922, H8922 Firmware | 2024-11-21 | 8.8 High |
| Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command, which is accessible with the username guest and password guest. | ||||
| CVE-2021-28145 | 1 Concretecms | 1 Concrete Cms | 2024-11-21 | 5.4 Medium |
| Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges. | ||||
| CVE-2021-28144 | 1 Dlink | 2 Dir-3060, Dir-3060 Firmware | 2024-11-21 | 8.8 High |
| prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root context because SetVirtualServerSettings calls CheckArpTables, which calls popen unsafely. | ||||
| CVE-2021-28143 | 1 Dlink | 2 Dir-841, Dir-841 Firmware | 2024-11-21 | 8.0 High |
| /jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools). | ||||
| CVE-2021-28136 | 1 Espressif | 2 Esp-idf, Esp32 | 2024-11-21 | 6.5 Medium |
| The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet. | ||||
| CVE-2021-28132 | 1 Lucysecurity | 1 Security Awareness | 2024-11-21 | 9.8 Critical |
| LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI. | ||||
| CVE-2021-28126 | 1 Compassplus | 1 Tranzware E-commerce Payment Gateway | 2024-11-21 | 6.1 Medium |
| index.jsp in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a Stored cross-site scripting (XSS) vulnerability | ||||