Export limit exceeded: 424983 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 95197 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95197 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-29011 | 1 Dmasoftlab | 1 Dma Radius Manager | 2024-11-21 | 6.1 Medium |
| DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field (under admin.php). | ||||
| CVE-2021-29010 | 1 Seopanel | 1 Seo Panel | 2024-11-21 | 4.8 Medium |
| A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "report_type" parameter. | ||||
| CVE-2021-29009 | 1 Seopanel | 1 Seo Panel | 2024-11-21 | 4.8 Medium |
| A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "type" parameter. | ||||
| CVE-2021-29008 | 1 Seopanel | 1 Seo Panel | 2024-11-21 | 4.8 Medium |
| A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.php in the "to_time" parameter. | ||||
| CVE-2021-29003 | 1 Genexis | 2 Platinum 4410, Platinum 4410 Firmware | 2024-11-21 | 9.8 Critical |
| Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstrated by the sys_config_valid.xgi?exeshell=%60telnetd%20%26%60 URI. | ||||
| CVE-2021-29002 | 1 Plone | 1 Plone | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter. | ||||
| CVE-2021-28994 | 2 Kopano, Zarafa | 2 Groupware Core, Zarafa | 2024-11-21 | 7.5 High |
| kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers. | ||||
| CVE-2021-28979 | 1 Thalesgroup | 1 Safenet Keysecure | 2024-11-21 | 6.5 Medium |
| SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. | ||||
| CVE-2021-28977 | 1 Get-simple | 1 Getsimplecms | 2024-11-21 | 4.8 Medium |
| Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files, | ||||
| CVE-2021-28975 | 1 Wpmailster | 1 Wp Mailster | 2024-11-21 | 6.1 Medium |
| WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name, or connection_parameter parameter. | ||||
| CVE-2021-28971 | 5 Debian, Fedoraproject, Linux and 2 more | 10 Debian Linux, Fedora, Linux Kernel and 7 more | 2024-11-21 | 5.5 Medium |
| In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6. | ||||
| CVE-2021-28968 | 1 Gnu | 1 Punbb | 2024-11-21 | 5.4 Medium |
| An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authentication) injecting arbitrary JavaScript into any forum message. | ||||
| CVE-2021-28963 | 2 Debian, Shibboleth | 2 Debian Linux, Service Provider | 2024-11-21 | 5.3 Medium |
| Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters. | ||||
| CVE-2021-28961 | 1 Openwrt | 1 Openwrt | 2024-11-21 | 8.8 High |
| applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests. | ||||
| CVE-2021-28960 | 1 Manageengine | 1 Desktop Central | 2024-11-21 | 9.8 Critical |
| Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations. | ||||
| CVE-2021-28958 | 1 Zohocorp | 1 Manageengine Adselfservice Plus | 2024-11-21 | 9.8 Critical |
| Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password. | ||||
| CVE-2021-28935 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-11-21 | 5.4 Medium |
| CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field. | ||||
| CVE-2021-28927 | 2 Libretro, Microsoft | 2 Retroarch, Windows | 2024-11-21 | 7.8 High |
| The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names. | ||||
| CVE-2021-28924 | 1 Nagios | 1 Network Analyzer | 2024-11-21 | 6.1 Medium |
| Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page. | ||||
| CVE-2021-28918 | 2 Netmask Project, Redhat | 2 Netmask, Acm | 2024-11-21 | 9.1 Critical |
| Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts. | ||||