Export limit exceeded: 372765 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372765 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-45905 | 1 Openwrt | 1 Openwrt | 2024-11-21 | 5.4 Medium |
| OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen. | ||||
| CVE-2021-45904 | 1 Openwrt | 1 Openwrt | 2024-11-21 | 5.4 Medium |
| OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen. | ||||
| CVE-2021-45903 | 1 Salesagility | 1 Suitecrm | 2024-11-21 | 6.1 Medium |
| A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268. | ||||
| CVE-2021-45901 | 1 Servicenow | 1 Servicenow | 2024-11-21 | 5.3 Medium |
| The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists. | ||||
| CVE-2021-45900 | 1 Vivoh | 1 Webinar Manager | 2024-11-21 | 6.5 Medium |
| Vivoh Webinar Manager before 3.6.3.0 has improper API authentication. When a user logs in to the administration configuration web portlet, a VIVOH_AUTH cookie is assigned so that they can be uniquely identified. Certain APIs can be successfully executed without proper authentication. This can let an attacker impersonate as victim and make state changing requests on their behalf. | ||||
| CVE-2021-45899 | 1 Salesagility | 1 Suitecrm | 2024-11-21 | 9.8 Critical |
| SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution. | ||||
| CVE-2021-45898 | 1 Salesagility | 1 Suitecrm | 2024-11-21 | 9.8 Critical |
| SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion. | ||||
| CVE-2021-45897 | 1 Salesagility | 1 Suitecrm | 2024-11-21 | 8.8 High |
| SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution. | ||||
| CVE-2021-45896 | 1 Nokia | 2 Fastmile, Fastmile Firmware | 2024-11-21 | 8.8 High |
| Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of Import Config File. | ||||
| CVE-2021-45895 | 1 Netgen | 1 Tags Bundle | 2024-11-21 | 6.1 Medium |
| Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface. | ||||
| CVE-2021-45894 | 1 Zauner | 1 Arc | 2024-11-21 | 5.9 Medium |
| An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Cleartext Transmission of Sensitive Information. | ||||
| CVE-2021-45893 | 1 Zauner | 1 Arc | 2024-11-21 | 7.5 High |
| An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is Improper Handling of Case Sensitivity, which makes password guessing easier. | ||||
| CVE-2021-45892 | 1 Zauner | 1 Arc | 2024-11-21 | 5.9 Medium |
| An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is storage of Passwords in a Recoverable Format. | ||||
| CVE-2021-45891 | 1 Zauner | 1 Arc | 2024-11-21 | 8.8 High |
| An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4., that allows attackers to escalate privileges within the application, since all permission checks are done client-side, not server-side. | ||||
| CVE-2021-45890 | 1 Authguard Project | 1 Authguard | 2024-11-21 | 9.8 Critical |
| basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier. | ||||
| CVE-2021-45889 | 1 Ponton | 1 X\/p Messenger | 2024-11-21 | 5.4 Medium |
| An issue was discovered in PONTON X/P Messenger before 3.11.2. Several functions are vulnerable to reflected XSS, as demonstrated by private/index.jsp?partners/ShowNonLocalPartners.do?localID= or private/index.jsp or private/index.jsp?database/databaseTab.jsp or private/index.jsp?activation/activationMainTab.jsp or private/index.jsp?communication/serverTab.jsp or private/index.jsp?emailNotification/notificationTab.jsp. | ||||
| CVE-2021-45888 | 1 Ponton | 1 X\/p Messenger | 2024-11-21 | 4.8 Medium |
| An issue was discovered in PONTON X/P Messenger before 3.11.2. The navigation tree that is shown on the left side of every page of the web application is vulnerable to XSS: it allows injection of JavaScript into its nodes. Creating such nodes is only possible for users who have the role Configuration Administrator or Administrator. | ||||
| CVE-2021-45887 | 1 Ponton | 1 X\/p Messenger | 2024-11-21 | 9.8 Critical |
| An issue was discovered in PONTON X/P Messenger before 3.11.2. Due to path traversal in private/SchemaSetUpload.do for uploaded ZIP files, an executable script can be uploaded by web application administrators, giving the attacker remote code execution on the underlying server via an imgs/*.jsp URI. | ||||
| CVE-2021-45886 | 1 Ponton | 1 X\/p Messenger | 2024-11-21 | 8.8 High |
| An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user (such as operator) can be used to confirm actions of higher-privileged ones (such as xpadmin). | ||||
| CVE-2021-45885 | 1 Stormshield | 1 Network Security | 2024-11-21 | 7.5 High |
| An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH password change does not properly clear the old password. | ||||