Export limit exceeded: 425803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95356 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-31794 | 1 Directum | 1 Directum | 2024-11-21 | 6.1 Medium |
| Settings.aspx?view=About in Directum 5.8.2 allows XSS via the HTTP User-Agent header. | ||||
| CVE-2021-31792 | 1 Salesagility | 1 Suitecrm | 2024-11-21 | 5.4 Medium |
| XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field | ||||
| CVE-2021-31787 | 1 Actions-semi | 10 Ats2815, Ats2815 Firmware, Ats2819 and 7 more | 2024-11-21 | 6.5 Medium |
| The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and shutdown of a device by flooding the target device with LMP_features_res packets. | ||||
| CVE-2021-31784 | 2 Opendesign, Siemens | 2 Drawings Sdk, Comos | 2024-11-21 | 7.8 High |
| An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supported by ODA platforms in static configuration. This can allow attackers to cause a crash, potentially enabling a denial of service attack (Crash, Exit, or Restart) or possible code execution. | ||||
| CVE-2021-31778 | 1 Media2click Project | 1 Media2click | 2024-11-21 | 5.4 Medium |
| The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account. | ||||
| CVE-2021-31769 | 1 Myq-solution | 1 Myq Server | 2024-11-21 | 8.8 High |
| MyQ Server in MyQ X Smart before 8.2 allows remote code execution by unprivileged users because administrative session data can be read in the %PROGRAMFILES%\MyQ\PHP\Sessions directory. The "Select server file" feature is only intended for administrators but actually does not require authorization. An attacker can inject arbitrary OS commands (such as commands to create new .php files) via the Task Scheduler component. | ||||
| CVE-2021-31761 | 1 Webmin | 1 Webmin | 2024-11-21 | 9.6 Critical |
| Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature. | ||||
| CVE-2021-31758 | 1 Tenda | 2 Ac11, Ac11 Firmware | 2024-11-21 | 9.8 Critical |
| An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request. | ||||
| CVE-2021-31757 | 1 Tenda | 2 Ac11, Ac11 Firmware | 2024-11-21 | 9.8 Critical |
| An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request. | ||||
| CVE-2021-31756 | 1 Tenda | 2 Ac11, Ac11 Firmware | 2024-11-21 | 9.8 Critical |
| An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copied to the stack variable. | ||||
| CVE-2021-31738 | 1 Adiscon | 1 Loganalyzer | 2024-11-21 | 6.1 Medium |
| Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS. | ||||
| CVE-2021-31726 | 1 Akuvox | 2 C315, C315 Firmware | 2024-11-21 | 9.8 Critical |
| Akuvox C315 115.116.2613 allows remote command Injection via the cfgd_server service. The attack vector is sending a payload to port 189 (default root 0.0.0.0). | ||||
| CVE-2021-31721 | 1 Chevereto | 1 Chevereto | 2024-11-21 | 6.1 Medium |
| Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage. | ||||
| CVE-2021-31712 | 1 React Draft Wysiwyg Project | 1 React Draft Wysiwyg | 2024-11-21 | 5.4 Medium |
| react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS. | ||||
| CVE-2021-31701 | 1 Mintty Project | 1 Mintty | 2024-11-21 | 7.5 High |
| Mintty before 3.4.7 mishandles Bracketed Paste Mode. | ||||
| CVE-2021-31698 | 1 Quectel | 2 Eg25-g, Eg25-g Firmware | 2024-11-21 | 9.8 Critical |
| Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in quectel_handle_fumo_cfg input in atfwd_daemon. | ||||
| CVE-2021-31684 | 3 Json-smart Project, Oracle, Redhat | 4 Json-smart-v1, Json-smart-v2, Utilities Framework and 1 more | 2024-11-21 | 7.5 High |
| A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of service (DOS) via a crafted web request. | ||||
| CVE-2021-31682 | 1 Automatedlogic | 1 Webctrl | 2024-11-21 | 6.1 Medium |
| The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization. | ||||
| CVE-2021-31676 | 1 Pescms | 1 Pescms Team | 2024-11-21 | 6.1 Medium |
| A reflected XSS was discovered in PESCMS-V2.3.3. When combined with CSRF in the same file, they can cause bigger destruction. | ||||
| CVE-2021-31673 | 1 Cyclos | 1 Cyclos | 2024-11-21 | 6.1 Medium |
| A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inject arbitrary web script or HTML via the groupId parameter. | ||||