Export limit exceeded: 17663 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (17663 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-23994 | 2 Mozilla, Redhat | 5 Firefox, Firefox Esr, Thunderbird and 2 more | 2024-11-21 | 8.8 High |
| A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. | ||||
| CVE-2021-23927 | 1 Open-xchange | 1 Open-xchange Appsuite | 2024-11-21 | 6.4 Medium |
| OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request. | ||||
| CVE-2021-23820 | 2 Manuelstofer, Redhat | 2 Json-pointer, Advanced Cluster Security | 2024-11-21 | 5.6 Medium |
| This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays. | ||||
| CVE-2021-23718 | 1 Ssrf-agent Project | 1 Ssrf-agent | 2024-11-21 | 6.5 Medium |
| The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private. | ||||
| CVE-2021-23664 | 1 Isomorphic-git | 1 Cors-proxy | 2024-11-21 | 8.6 High |
| The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js. | ||||
| CVE-2021-23518 | 3 Cached-path-relative Project, Debian, Redhat | 3 Cached-path-relative, Debian Linux, Acm | 2024-11-21 | 7.3 High |
| The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573 | ||||
| CVE-2021-23406 | 1 Pac-resolver Project | 1 Pac-resolver | 2024-11-21 | 8.1 High |
| This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer. | ||||
| CVE-2021-23390 | 1 Totaljs | 1 Total4 | 2024-11-21 | 9.8 Critical |
| The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. | ||||
| CVE-2021-23389 | 1 Totaljs | 1 Total.js | 2024-11-21 | 9.8 Critical |
| The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. | ||||
| CVE-2021-23386 | 1 Dns-packet Project | 1 Dns-packet | 2024-11-21 | 7.7 High |
| This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names. | ||||
| CVE-2021-23383 | 3 Handlebarsjs, Netapp, Redhat | 6 Handlebars, E-series Performance Analyzer, Acm and 3 more | 2024-11-21 | 5.6 Medium |
| The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. | ||||
| CVE-2021-23369 | 2 Handlebarsjs, Redhat | 5 Handlebars, Acm, Jboss Enterprise Bpms Platform and 2 more | 2024-11-21 | 5.6 Medium |
| The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source. | ||||
| CVE-2021-23345 | 1 Thecodingmachine | 1 Gotenberg | 2024-11-21 | 5.3 Medium |
| All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as <iframe src='file:///etc/passwd'>. | ||||
| CVE-2021-23344 | 1 Totaljs | 1 Total.js | 2024-11-21 | 9.8 Critical |
| The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set. | ||||
| CVE-2021-23281 | 1 Eaton | 1 Intelligent Power Manager | 2024-11-21 | 10 Critical |
| Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially crafted packet to make IPM connect to rouge SNMP server and execute attacker-controlled code. | ||||
| CVE-2021-23277 | 1 Eaton | 3 Intelligent Power Manager, Intelligent Power Manager Virtual Appliance, Intelligent Power Protector | 2024-11-21 | 8.3 High |
| Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands. | ||||
| CVE-2021-23267 | 1 Craftercms | 1 Crafter Cms | 2024-11-21 | 7.6 High |
| Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods. | ||||
| CVE-2021-23262 | 1 Craftercms | 1 Crafter Cms | 2024-11-21 | 4.2 Medium |
| Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE. | ||||
| CVE-2021-23259 | 1 Craftercms | 1 Crafter Cms | 2024-11-21 | 4.2 Medium |
| Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script does not have security restrictions, which will cause attackers to execute arbitrary commands remotely(RCE). | ||||
| CVE-2021-23258 | 1 Craftercms | 1 Crafter Cms | 2024-11-21 | 4.2 Medium |
| Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely (RCE). | ||||