Export limit exceeded: 420979 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94569 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-35358 | 1 Dotcms | 1 Dotcms | 2024-11-21 | 4.8 Medium |
| A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' and 'Filename' parameters. | ||||
| CVE-2021-35346 | 1 Tsmuxer Project | 1 Tsmuxer | 2024-11-21 | 9.8 Critical |
| tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function HevcSpsUnit::short_term_ref_pic_set(int) in hevc.cpp. | ||||
| CVE-2021-35344 | 1 Tsmuxer Project | 1 Tsmuxer | 2024-11-21 | 9.8 Critical |
| tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h. | ||||
| CVE-2021-35325 | 1 Totolink | 2 A720r, A720r Firmware | 2024-11-21 | 7.5 High |
| A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS). | ||||
| CVE-2021-35323 | 1 Bludit | 1 Bludit | 2024-11-21 | 6.1 Medium |
| Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. | ||||
| CVE-2021-35303 | 1 Zammad | 1 Zammad | 2024-11-21 | 6.1 Medium |
| Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. | ||||
| CVE-2021-35298 | 1 Zammad | 1 Zammad | 2024-11-21 | 6.1 Medium |
| Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information. | ||||
| CVE-2021-35265 | 1 Maxsite | 1 Maxsite Cms | 2024-11-21 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page. | ||||
| CVE-2021-35248 | 2 Microsoft, Solarwinds | 2 Windows, Orion Platform | 2024-11-21 | 6.8 Medium |
| It has been reported that any Orion user, e.g. guest accounts can query the Orion.UserSettings entity and enumerate users and their basic settings. | ||||
| CVE-2021-35243 | 1 Solarwinds | 1 Web Help Desk | 2024-11-21 | 5.3 Medium |
| The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests. The HTTP PUT method is normally used to upload data that is saved on the server with a user-supplied URL. While the DELETE method requests that the origin server removes the association between the target resource and its current functionality. Improper use of these methods may lead to a loss of integrity. | ||||
| CVE-2021-35240 | 2 Microsoft, Solarwinds | 2 Internet Explorer, Orion Platform | 2024-11-21 | 6.5 Medium |
| A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'. | ||||
| CVE-2021-35239 | 1 Solarwinds | 1 Orion Platform | 2024-11-21 | 7.5 High |
| A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink. | ||||
| CVE-2021-35238 | 1 Solarwinds | 1 Orion Platform | 2024-11-21 | 4.8 Medium |
| User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website. | ||||
| CVE-2021-35232 | 1 Solarwinds | 1 Webhelpdesk | 2024-11-21 | 6.8 Medium |
| Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users or insert arbitrary data into the database. | ||||
| CVE-2021-35229 | 1 Solarwinds | 2 Database Performance Analyzer, Database Performance Monitor | 2024-11-21 | 6.8 Medium |
| Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query | ||||
| CVE-2021-35228 | 1 Solarwinds | 1 Database Performance Analyzer | 2024-11-21 | 5.5 Medium |
| This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remote victim. | ||||
| CVE-2021-35227 | 1 Solarwinds | 1 Access Rights Manager | 2024-11-21 | 4.7 Medium |
| The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available. | ||||
| CVE-2021-35222 | 2 Microsoft, Solarwinds | 2 Windows, Orion Platform | 2024-11-21 | 8 High |
| This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page. | ||||
| CVE-2021-35220 | 1 Solarwinds | 1 Orion Platform | 2024-11-21 | 8.1 High |
| Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page. | ||||
| CVE-2021-35210 | 1 Contao | 1 Contao | 2024-11-21 | 6.1 Medium |
| Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end. | ||||