Export limit exceeded: 94517 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94517 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-30214 | 1 Eng | 1 Knowage | 2024-11-21 | 5.4 Medium |
| Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter. | ||||
| CVE-2021-30213 | 1 Eng | 1 Knowage | 2024-11-21 | 6.1 Medium |
| Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter. | ||||
| CVE-2021-30212 | 1 Eng | 1 Knowage | 2024-11-21 | 5.4 Medium |
| Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter. | ||||
| CVE-2021-30211 | 1 Eng | 1 Knowage | 2024-11-21 | 5.4 Medium |
| Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter. | ||||
| CVE-2021-30174 | 1 Ruiyanai | 1 Cloudiso | 2024-11-21 | 5.4 Medium |
| RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks. | ||||
| CVE-2021-30172 | 1 Junhetec | 1 Omnidirectional Communication System | 2024-11-21 | 4.6 Medium |
| Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS (Cross-site scripting) attacks, additionally access and manipulate customer’s information. | ||||
| CVE-2021-30171 | 1 Junhetec | 1 Enterprise Resource Planning Point Of Sale System | 2024-11-21 | 4.6 Medium |
| Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information. | ||||
| CVE-2021-30170 | 1 Junhetec | 1 Enterprise Resource Planning Point Of Sale System | 2024-11-21 | 4.6 Medium |
| Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information. | ||||
| CVE-2021-30166 | 1 Meritlilin | 82 P2g1022, P2g1022 Firmware, P2g1022x and 79 more | 2024-11-21 | 7.2 High |
| The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission. | ||||
| CVE-2021-30165 | 1 Edimax | 2 Ic-3140w, Ic-3140w Firmware | 2024-11-21 | 7.5 High |
| The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware to obtain the privileged permission and further control the devices. | ||||
| CVE-2021-30157 | 3 Debian, Fedoraproject, Mediawiki | 3 Debian Linux, Fedora, Mediawiki | 2024-11-21 | 6.1 Medium |
| An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS. | ||||
| CVE-2021-30154 | 3 Debian, Fedoraproject, Mediawiki | 3 Debian Linux, Fedora, Mediawiki | 2024-11-21 | 6.1 Medium |
| An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS. | ||||
| CVE-2021-30151 | 3 Contribsys, Debian, Redhat | 3 Sidekiq, Debian Linux, Satellite | 2024-11-21 | 6.1 Medium |
| Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. | ||||
| CVE-2021-30150 | 1 Ocproducts | 1 Composr | 2024-11-21 | 6.1 Medium |
| Composr 10.0.36 allows XSS in an XML script. | ||||
| CVE-2021-30146 | 1 Seafile | 1 Seafile | 2024-11-21 | 5.4 Medium |
| Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality." | ||||
| CVE-2021-30140 | 1 Liquidfiles | 1 Liquidfiles | 2024-11-21 | 5.4 Medium |
| LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with HTML content), the payload is executed upon a click. This is fixed in 3.5. | ||||
| CVE-2021-30133 | 1 Cloverdx | 1 Cloverdx | 2024-11-21 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and 5.10. | ||||
| CVE-2021-30129 | 3 Apache, Oracle, Redhat | 13 Sshd, Banking Payments, Banking Trade Finance and 10 more | 2024-11-21 | 6.5 Medium |
| A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0 | ||||
| CVE-2021-30125 | 1 Jamf | 1 Jamf | 2024-11-21 | 6.1 Medium |
| Jamf Pro before 10.28.0 allows XSS related to inventory history, aka PI-009376. | ||||
| CVE-2021-30119 | 1 Kaseya | 1 Vsa | 2024-11-21 | 5.4 Medium |
| Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078` | ||||