Search

You must be logged in to use the 'userTag' filter.
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43068 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-43297 1 Apache 1 Dubbo 2024-11-21 9.8 Critical
A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
CVE-2021-43296 1 Zohocorp 1 Manageengine Supportcenter Plus 2024-11-21 7.5 High
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.
CVE-2021-43205 1 Fortinet 1 Forticlient 2024-11-21 4.3 Medium
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries.
CVE-2021-43110 1 Puneethreddyhc Online-shopping-system Project 1 Puneethreddyhc Online-shopping-system 2024-11-21 9.8 Critical
An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add_products.
CVE-2021-43051 1 Tibco 1 Spotfire Server 2024-11-21 7.1 High
The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0.
CVE-2021-42943 1 Ipplan Project 1 Ipplan 2024-11-21 5.4 Medium
Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter.
CVE-2021-42897 1 Feminer Wms Project 1 Feminer Wms 2024-11-21 9.8 Critical
A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed into the $mysqlstr and is executed by exec.
CVE-2021-42870 1 Accel-ppp 1 Accel-ppp 2024-11-21 7.5 High
ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.
CVE-2021-42851 1 Lenovo 10 A1, A1 Firmware, T1 and 7 more 2024-11-21 6.3 Medium
A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.
CVE-2021-42848 1 Lenovo 10 A1, A1 Firmware, T1 and 7 more 2024-11-21 4.3 Medium
An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details.
CVE-2021-42811 1 Thalesgroup 1 Safenet Keysecure 2024-11-21 3.3 Low
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed.
CVE-2021-42751 1 Thingsboard 1 Thingsboard 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the description of a rule node.
CVE-2021-42750 1 Thingsboard 1 Thingsboard 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node.
CVE-2021-42732 3 Adobe, Apple, Microsoft 3 Indesign, Macos, Windows 2024-11-21 7.8 High
Access of Memory Location After End of Buffer (CWE-788)
CVE-2021-42675 1 Kreado 1 Kreasfero 2024-11-21 9.8 Critical
Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can upload a malicious PHP file and obtain remote code execution.
CVE-2021-42644 1 Cmseasy 1 Cmseasy 2024-11-21 6.5 Medium
cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability.
CVE-2021-42643 1 Cmseasy 1 Cmseasy 2024-11-21 8.8 High
cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability.
CVE-2021-42586 1 Gnu 1 Libredwg 2024-11-21 8.8 High
A heap buffer overflow was discovered in copy_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.
CVE-2021-42585 1 Gnu 1 Libredwg 2024-11-21 8.8 High
A heap buffer overflow was discovered in copy_compressed_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.
CVE-2021-42552 1 Archivista 1 Archivistabox 2024-11-21 6.1 Medium
Cross-site Scripting (XSS) vulnerability in ArchivistaBox webclient allows an attacker to craft a malicious link, executing JavaScript in the context of a victim's browser. This issue affects all ArchivistaBox versions prior to 2022/I.