Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (98039 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-29054 1 Papoo 1 Papoo 2024-11-21 8.8 High
Certain Papoo products are affected by: Cross Site Request Forgery (CSRF) in the admin interface. This affects Papoo CMS Light through 21.02 and Papoo CMS Pro through 6.0.1. The impact is: gain privileges (remote).
CVE-2021-29053 1 Liferay 2 Dxp, Liferay Portal 2024-11-21 8.8 High
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.
CVE-2021-29047 1 Liferay 2 Dxp, Liferay Portal 2024-11-21 7.5 High
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.
CVE-2021-29005 1 Rconfig 1 Rconfig 2024-11-21 8.8 High
Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may let an attacker with low privilege to gain root access on server.
CVE-2021-29004 1 Rconfig 1 Rconfig 2024-11-21 8.8 High
rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the Mysql server is the same as rConfig, an attacker may successfully upload a webshell to the server and access it remotely.
CVE-2021-28994 2 Kopano, Zarafa 2 Groupware Core, Zarafa 2024-11-21 7.5 High
kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers.
CVE-2021-28993 1 Plixer 1 Scrutinizer 2024-11-21 7.5 High
Plixer Scrutinizer 19.0.2 is affected by: SQL Injection. The impact is: obtain sensitive information (remote).
CVE-2021-28976 1 Get-simple 1 Getsimplecms 2024-11-21 7.2 High
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.
CVE-2021-28966 2 Microsoft, Ruby-lang 2 Windows, Ruby 2024-11-21 7.5 High
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
CVE-2021-28965 3 Fedoraproject, Redhat, Ruby-lang 7 Fedora, Enterprise Linux, Rhel E4s and 4 more 2024-11-21 7.5 High
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
CVE-2021-28962 1 Stormshield 1 Stormshield Network Security 2024-11-21 7.2 High
Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands.
CVE-2021-28961 1 Openwrt 1 Openwrt 2024-11-21 8.8 High
applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests.
CVE-2021-28956 1 Sass Lint Project 1 Sass Lint 2024-11-21 8.8 High
The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2021-28954 2 Bit Project, Microsoft 2 Bit, Windows 2024-11-21 7.8 High
In Chris Walz bit before 1.0.5 on Windows, attackers can run arbitrary code via a .exe file in a crafted repository.
CVE-2021-28953 1 C\/c\+\+ Advanced Lint Project 1 C\/c\+\+ Advanced Lint 2024-11-21 7.8 High
The unofficial C/C++ Advanced Lint extension before 1.9.0 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted repository.
CVE-2021-28952 3 Fedoraproject, Linux, Netapp 11 Fedora, Linux Kernel, A250 and 8 more 2024-11-21 7.8 High
An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a buffer overflow when an unexpected port ID number is encountered, aka CID-1c668e1c0a0f. (This has been fixed in 5.12-rc4.)
CVE-2021-28937 1 Acexy 2 Wireless-n Wifi Repeater, Wireless-n Wifi Repeater Firmware 2024-11-21 7.5 High
The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrator account password in plaintext. The page can be intercepted on HTTP.
CVE-2021-28936 1 Acexy 2 Wireless-n Wifi Repeater, Wireless-n Wifi Repeater Firmware 2024-11-21 7.5 High
The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending a specially crafted HTTP GET request. The administrator username has to be known (default:admin) whereas no previous authentication is required.
CVE-2021-28931 1 Fork-cms 1 Fork Cms 2024-11-21 8.8 High
Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.
CVE-2021-28927 2 Libretro, Microsoft 2 Retroarch, Windows 2024-11-21 7.8 High
The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names.