Export limit exceeded: 369876 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (369876 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-31939 | 1 Microsoft | 5 365 Apps, Excel, Office and 2 more | 2024-11-21 | 7.8 High |
| Microsoft Excel Remote Code Execution Vulnerability | ||||
| CVE-2021-31938 | 1 Microsoft | 1 Kubernetes Tools | 2024-11-21 | 7.3 High |
| Microsoft VsCode Kubernetes Tools Extension Elevation of Privilege Vulnerability | ||||
| CVE-2021-31936 | 1 Microsoft | 1 Accessibility Insights For Web | 2024-11-21 | 7.4 High |
| Microsoft Accessibility Insights for Web Information Disclosure Vulnerability | ||||
| CVE-2021-31935 | 1 Open-xchange | 1 Open-xchange Appsuite | 2024-11-21 | 6.1 Medium |
| OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view. | ||||
| CVE-2021-31934 | 1 Open-xchange | 1 Open-xchange Appsuite | 2024-11-21 | 6.1 Medium |
| OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone. | ||||
| CVE-2021-31933 | 1 Chamilo | 1 Chamilo | 2024-11-21 | 7.2 High |
| A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php directory traversal to achieve PHP code execution. | ||||
| CVE-2021-31932 | 1 Nokia | 1 Bts Trs Web Console | 2024-11-21 | 9.8 Critical |
| Nokia BTS TRS web console FTM_W20_FP2_2019.08.16_0010 allows Authentication Bypass. A malicious unauthenticated user can get access to all the functionalities exposed via the web panel, circumventing the authentication process, by using URL encoding for the . (dot) character. | ||||
| CVE-2021-31930 | 1 Concerto-signage | 1 Concerto | 2024-11-21 | 6.1 Medium |
| Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the account, the XSS payload will be executed. | ||||
| CVE-2021-31929 | 1 Annexcloud | 1 Loyalty Experience Platform | 2024-11-21 | 4.3 Medium |
| Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify loyalty campaigns and settings, such as fraud prevention, coupon groups, email templates, or referrals. | ||||
| CVE-2021-31928 | 1 Annexcloud | 1 Loyalty Experience Platform | 2024-11-21 | 8.8 High |
| Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to escalate privileges to superadministrator. It was fixed in v2021.1.0.2. | ||||
| CVE-2021-31927 | 1 Annexcloud | 1 Loyalty Experience Platform | 2024-11-21 | 4.3 Medium |
| An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. It was fixed in v2021.1.0.2. | ||||
| CVE-2021-31926 | 1 Cubecoders | 1 Amp | 2024-11-21 | 6.5 Medium |
| AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by crafting an HTTP(S) request directly to the applicable API endpoint (despite not having permission to make changes to the system's network configuration). | ||||
| CVE-2021-31925 | 1 Pexip | 1 Pexip Infinity | 2024-11-21 | 7.5 High |
| Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via the administrative web interface. | ||||
| CVE-2021-31924 | 2 Fedoraproject, Yubico | 2 Fedora, Pam-u2f | 2024-11-21 | 6.8 Medium |
| Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence (touch) or cryptographic signature verification to be bypassed, so an attacker would still need to physically possess and interact with the YubiKey or another enrolled authenticator. If pam-u2f is configured to require PIN authentication, and the application using pam-u2f allows the user to submit NULL as the PIN, pam-u2f will attempt to perform a FIDO2 authentication without PIN. If this authentication is successful, the PIN requirement is bypassed. | ||||
| CVE-2021-31923 | 1 Pingidentity | 1 Pingaccess | 2024-11-21 | 5.3 Medium |
| Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation. | ||||
| CVE-2021-31922 | 1 Pulsesecure | 1 Virtual Traffic Manager | 2024-11-21 | 7.5 High |
| An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3. | ||||
| CVE-2021-31921 | 2 Istio, Redhat | 2 Istio, Service Mesh | 2024-11-21 | 9.8 Critical |
| Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO_PASSTHROUGH routing configuration. | ||||
| CVE-2021-31920 | 2 Istio, Redhat | 2 Istio, Service Mesh | 2024-11-21 | 6.5 Medium |
| Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization policy when path based authorization rules are used. | ||||
| CVE-2021-31919 | 1 Rkyv Project | 1 Rkyv | 2024-11-21 | 7.5 High |
| An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct. | ||||
| CVE-2021-31918 | 1 Redhat | 1 Openstack | 2024-11-21 | 7.5 High |
| A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality. | ||||