Search

Expected end of text, found 's' (at char 51), (line:1, col:52)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43073 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-42252 2 Linux, Netapp 19 Linux Kernel, H300e, H300e Firmware and 16 more 2024-11-21 7.8 High
An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.
CVE-2021-42233 2 Simple Blog Project, Wondercms 2 Simple Blog, Wondercms 2024-11-21 5.4 Medium
The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability. When any user opens a particular blog hosted on an attackers' site, XSS may occur.
CVE-2021-42228 1 Kindsoft 1 Kindeditor 2024-11-21 8.8 High
A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.
CVE-2021-42227 1 Kindsoft 1 Kindeditor 2024-11-21 6.1 Medium
Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor (the file suffix is allowed).
CVE-2021-42224 1 Phpgurukul 1 Ifsc Code Finder 2024-11-21 9.8 Critical
SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.
CVE-2021-42223 1 Phpgurukul 1 Online Dj Booking Management System 2024-11-21 6.1 Medium
Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php.
CVE-2021-42219 1 Ethereum 1 Go Ethereum 2024-11-21 7.5 High
Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.
CVE-2021-42194 1 Eyoucms 1 Eyoucms 2024-11-21 7.2 High
The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.
CVE-2021-42171 1 Tribalsystems 1 Zenario 2024-11-21 7.2 High
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
CVE-2021-42139 1 Deno 1 Deno Standard Modules 2024-11-21 9.8 Critical
Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations.
CVE-2021-42137 1 Zammad 1 Zammad 2024-11-21 5.3 Medium
An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc.
CVE-2021-42135 1 Hashicorp 1 Vault 2024-11-21 8.1 High
HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.
CVE-2021-42134 1 Django-unicorn 1 Unicorn 2024-11-21 6.1 Medium
The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.
CVE-2021-42112 1 Limesurvey 1 Limesurvey 2024-11-21 6.1 Medium
The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
CVE-2021-42109 1 Vitec 19 Avediastream M9305, Avediastream M9305 Firmware, Avediastream M9325 and 16 more 2024-11-21 9.8 Critical
VITEC Exterity IPTV products through 2021-04-30 allow privilege escalation to root.
CVE-2021-42009 1 Apache 1 Traffic Control 2024-11-21 4.3 Medium
An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.
CVE-2021-41976 1 Tad Uploader Project 1 Tad Uploader 2024-11-21 5.3 Medium
Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book list without logging in.
CVE-2021-41975 1 Tadtools Project 1 Tadtools 2024-11-21 7.5 High
TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system without logging in.
CVE-2021-41974 1 Tad Book3 Project 1 Tad Book3 2024-11-21 9.1 Critical
Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission.
CVE-2021-41965 1 Churchcrm 1 Churchcrm 2024-11-21 8.8 High
A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized EN_tyid, theID and EID fields used when an Edit action on an existing record is being performed.