Export limit exceeded: 24732 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 51588 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 94530 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94530 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-32605 | 1 Zzzcms | 1 Zzzphp | 2024-11-21 | 9.8 Critical |
| zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block. | ||||
| CVE-2021-32604 | 1 Solarwinds | 1 Serv-u | 2024-11-21 | 5.4 Medium |
| Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS." | ||||
| CVE-2021-32602 | 1 Fortinet | 1 Fortiportal | 2024-11-21 | 5.8 Medium |
| An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1.2 and below, 5.0.3 and below, 4.2.2 and below, 4.1.2 and below, 4.0.4 and below may allow a remote and unauthenticated attacker to perform an XSS attack via sending a crafted request with an invalid lang parameter or with an invalid org.springframework.web.servlet.i18n.CookieLocaleResolver.LOCALE value. | ||||
| CVE-2021-32597 | 1 Fortinet | 2 Fortianalyzer, Fortimanager | 2024-11-21 | 4.6 Medium |
| Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface, may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious payload in GET parameters. | ||||
| CVE-2021-32588 | 1 Fortinet | 1 Fortiportal | 2024-11-21 | 9.8 Critical |
| A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading and deploying malicious web application archive files using the default hard-coded Tomcat Manager username and password. | ||||
| CVE-2021-32585 | 1 Fortinet | 1 Fortiwan | 2024-11-21 | 7.2 High |
| An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perform a stored cross-site scripting attack via specifically crafted HTTP requests. | ||||
| CVE-2021-32577 | 1 Acronis | 1 True Image | 2024-11-21 | 7.8 High |
| Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions. | ||||
| CVE-2021-32573 | 1 Express-cart Project | 1 Express-cart | 2024-11-21 | 4.8 Medium |
| The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website. | ||||
| CVE-2021-32569 | 1 Ericsson | 2 Operations Support System-radio And Core, Operations Support System-radio And Core Firmware | 2024-11-21 | 6.1 Medium |
| In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. This problem is completely resolved in new Ericsson library browsing tool ELEX used in systems like Ericsson Network Manager. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Ericsson Network Manager is a new generation OSS system which OSS-RC customers shall upgrade to | ||||
| CVE-2021-32561 | 1 Octoprint | 1 Octoprint | 2024-11-21 | 6.1 Medium |
| OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters. | ||||
| CVE-2021-32558 | 2 Debian, Digium | 3 Debian Linux, Asterisk, Certified Asterisk | 2024-11-21 | 7.5 High |
| An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur. | ||||
| CVE-2021-32556 | 1 Canonical | 1 Apport | 2024-11-21 | 3.8 Low |
| It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call. | ||||
| CVE-2021-32544 | 1 Igt\+ Project | 1 Igt\+ | 2024-11-21 | 5.4 Medium |
| Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS (Cross-site scripting) attacks. | ||||
| CVE-2021-32542 | 1 Sysjust | 1 Cts Web | 2024-11-21 | 4.7 Medium |
| The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack. | ||||
| CVE-2021-32540 | 1 Hundredplus | 1 101eip | 2024-11-21 | 5.4 Medium |
| Add announcement function in the 101EIP system does not filter special characters, which allows authenticated users to inject JavaScript and perform a stored XSS attack. | ||||
| CVE-2021-32539 | 1 Hundredplus | 1 101eip | 2024-11-21 | 5.4 Medium |
| Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavaScript and perform a stored XSS attack. | ||||
| CVE-2021-32536 | 1 Mcusystem | 1 Mcusystem | 2024-11-21 | 6.1 Medium |
| The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaScript without privilege and thus perform reflected XSS attacks. | ||||
| CVE-2021-32535 | 1 Qsan | 1 Sanos | 2024-11-21 | 9.8 Critical |
| The vulnerability of hard-coded default credentials in QSAN SANOS allows unauthenticated remote attackers to obtain administrator’s permission and execute arbitrary functions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0. | ||||
| CVE-2021-32534 | 1 Qsan | 1 Sanos | 2024-11-21 | 9.8 Critical |
| QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0. | ||||
| CVE-2021-32533 | 1 Qsan | 1 Sanos | 2024-11-21 | 9.8 Critical |
| The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0. | ||||