Export limit exceeded: 371163 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 371163 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (371163 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-38390 | 1 Deltaww | 1 Diaenergie | 2024-11-21 | 9.8 Critical |
| A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER. | ||||
| CVE-2021-38389 | 1 Advantech | 1 Webaccess | 2024-11-21 | 9.8 Critical |
| Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code. | ||||
| CVE-2021-38387 | 1 Contiki-os | 1 Contiki | 2024-11-21 | 7.5 High |
| In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop and waiting forever, which may cause excessive CPU consumption. | ||||
| CVE-2021-38386 | 1 Contiki-os | 1 Contiki | 2024-11-21 | 7.5 High |
| In Contiki 3.0, a buffer overflow in the Telnet service allows remote attackers to cause a denial of service because the ls command is mishandled when a directory has many files with long names. | ||||
| CVE-2021-38385 | 1 Torproject | 1 Tor | 2024-11-21 | 7.5 High |
| Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007. | ||||
| CVE-2021-38384 | 1 Serverless Offline Project | 1 Serverless Offline | 2024-11-21 | 9.8 Critical |
| Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions). | ||||
| CVE-2021-38382 | 1 Live555 | 1 Live555 | 2024-11-21 | 6.5 Medium |
| Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash. | ||||
| CVE-2021-38381 | 1 Live555 | 1 Live555 | 2024-11-21 | 6.5 Medium |
| Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash. | ||||
| CVE-2021-38380 | 1 Live555 | 1 Live555 | 2024-11-21 | 7.5 High |
| Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack. | ||||
| CVE-2021-38379 | 1 Northern.tech | 1 Cfengine | 2024-11-21 | 5.5 Medium |
| The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure. | ||||
| CVE-2021-38378 | 1 Open-xchange | 1 Ox App Suite | 2024-11-21 | 4.3 Medium |
| OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name. | ||||
| CVE-2021-38377 | 1 Open-xchange | 1 Ox App Suite | 2024-11-21 | 6.1 Medium |
| OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results. | ||||
| CVE-2021-38376 | 1 Open-xchange | 1 Ox App Suite | 2024-11-21 | 5.3 Medium |
| OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. | ||||
| CVE-2021-38375 | 1 Open-xchange | 1 Ox App Suite | 2024-11-21 | 6.1 Medium |
| OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message. | ||||
| CVE-2021-38374 | 1 Open-xchange | 1 Ox App Suite | 2024-11-21 | 5.4 Medium |
| OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL. | ||||
| CVE-2021-38373 | 1 Kde | 1 Kmail | 2024-11-21 | 5.3 Medium |
| In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked. | ||||
| CVE-2021-38372 | 1 Kde | 1 Trojita | 2024-11-21 | 3.7 Low |
| In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS. | ||||
| CVE-2021-38370 | 1 Alpine Project | 1 Alpine | 2024-11-21 | 5.9 Medium |
| In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS. | ||||
| CVE-2021-38366 | 1 Sitecore | 1 Sitecore | 2024-11-21 | 8.8 High |
| Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL. | ||||
| CVE-2021-38365 | 1 Tonewinner | 2 Winner Desktop Speakers, Winner Desktop Speakers Firmware | 2024-11-21 | 3.7 Low |
| Winner (aka ToneWinner) desktop speakers through 2021-08-09 allow remote attackers to recover speech signals from the power-indicator LED via a telescope and an electro-optical sensor, aka a "Glowworm" attack. | ||||