Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (111340 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-3341 1 Dh2i 2 Dxenterprise, Dxodyssey 2024-11-21 7.5 High
A path traversal vulnerability in the DxWebEngine component of DH2i DxEnterprise and DxOdyssey for Windows, version 19.5 through 20.x before 20.0.219.0, allows an attacker to read any file on the host file system via an HTTP request.
CVE-2021-3337 1 Hide Thread Content Project 1 Hide Thread Content 2024-11-21 7.5 High
The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicking on reply or quote in the postbit.
CVE-2021-3336 1 Wolfssl 1 Wolfssl 2024-11-21 8.1 High
DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.
CVE-2021-3330 1 Zephyrproject 1 Zephyr 2024-11-21 7.1 High
RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr. Zephyr versions >= >=2.4.0 contain Out-of-bounds Write (CWE-787). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj4r-373f-9456
CVE-2021-3328 1 Aprelium 1 Abyss Web Server X1 2024-11-21 7.5 High
An issue was discovered in Aprelium Abyss Web Server X1 2.12.1 and 2.14. A crafted HTTP request can lead to an out-of-bounds read that crashes the application.
CVE-2021-3323 1 Zephyrproject 1 Zephyr 2024-11-21 8.3 High
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Zephyr versions >= >=2.4.0 contain Integer Underflow (Wrap or Wraparound) (CWE-191). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-89j6-qpxf-pfpc
CVE-2021-3321 1 Zephyrproject 1 Zephyr 2024-11-21 7.5 High
Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal. Zephyr versions >= >=2.4.0 contain Integer Overflow to Buffer Overflow (CWE-680). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-w44j-66g7-xw99
CVE-2021-3317 1 Klogserver 1 Klog Server 2024-11-21 8.8 High
KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter.
CVE-2021-3310 1 Westerndigital 9 My Cloud Dl2100, My Cloud Dl4100, My Cloud Ex2100 and 6 more 2024-11-21 7.8 High
Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files).
CVE-2021-3309 1 Wekan Project 1 Wekan 2024-11-21 8.1 High
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,
CVE-2021-3291 1 Zen-cart 1 Zen Cart 2024-11-21 7.2 High
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
CVE-2021-3283 1 Hashicorp 1 Nomad 2024-11-21 7.5 High
HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
CVE-2021-3282 1 Hashicorp 1 Vault 2024-11-21 7.5 High
HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.
CVE-2021-3277 1 Nagios 1 Nagios Xi 2024-11-21 7.2 High
Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.
CVE-2021-3273 1 Nagios 1 Nagios Xi 2024-11-21 7.2 High
Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system.
CVE-2021-3264 1 Cxuu 1 Cxuucms 2024-11-21 7.2 High
SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php.
CVE-2021-3254 1 Asus 2 Dsl-n14u-b1, Dsl-n14u-b1 Firmware 2024-11-21 7.5 High
Asus DSL-N14U-B1 1.1.2.3_805 allows remote attackers to cause a Denial of Service (DoS) via a TCP SYN scan using nmap.
CVE-2021-3252 1 Kaco-newenergy 2 Xp100u, Xp100u Firmware 2024-11-21 7.5 High
KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. Credentials will always be returned in plain-text from the local server during the KACO XP100U authentication process, regardless of whatever passwords have been provided, which leads to an information disclosure vulnerability.
CVE-2021-3246 4 Debian, Fedoraproject, Libsndfile Project and 1 more 5 Debian Linux, Fedora, Libsndfile and 2 more 2024-11-21 8.8 High
A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file.
CVE-2021-3229 1 Asus 2 Rt-ax3000, Rt-ax3000 Firmware 2024-11-21 7.5 High
Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.384_10177 and earlier versions allows an attacker to disrupt the use of device setup services via continuous login error.