Export limit exceeded: 373471 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373471 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-37538 | 1 Smartdatasoft | 1 Smartblog | 2024-11-21 | 9.8 Critical |
| Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the id_category parameter to the controllers/front/category.php category controller. | ||||
| CVE-2021-37535 | 1 Sap | 1 Netweaver Application Server Java | 2024-11-21 | 9.8 Critical |
| SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for user privileges. | ||||
| CVE-2021-37534 | 1 Misp | 1 Misp | 2024-11-21 | 5.4 Medium |
| app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster. | ||||
| CVE-2021-37532 | 1 Sap | 1 Business One | 2024-11-21 | 4.3 Medium |
| SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the contents of index in the directory, which would otherwise be restricted to high privileged User. | ||||
| CVE-2021-37531 | 1 Sap | 1 Netweaver Knowledge Management Xml Forms | 2024-11-21 | 8.8 High |
| SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet file containing a script with OS-level commands, copy it into a location to be accessed by the system and then create a file which will trigger the XSLT engine to execute the script contained within the malicious XSL file. This can result in a full compromise of the confidentiality, integrity, and availability of the system. | ||||
| CVE-2021-37530 | 2 Debian, Fig2dev Project | 2 Debian Linux, Fig2dev | 2024-11-21 | 5.5 Medium |
| A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c. | ||||
| CVE-2021-37529 | 2 Debian, Fig2dev Project | 2 Debian Linux, Fig2dev | 2024-11-21 | 5.5 Medium |
| A double-free vulnerability exists in fig2dev through 3.28a is affected by: via the free_stream function in readpics.c, which could cause a denial of service (context-dependent). | ||||
| CVE-2021-37524 | 1 Fusionpbx | 1 Fusionpbx | 2024-11-21 | 6.1 Medium |
| Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "path" parameter in resources/login.php. | ||||
| CVE-2021-37522 | 1 Locke-bot Project | 1 Locke-bot | 2024-11-21 | 9.8 Critical |
| SQL injection vulnerability in HKing2802 Locke-Bot 2.0.2 allows remote attackers to run arbitrary SQL commands via crafted string to /src/db.js, /commands/mute.js, /modules/event/messageDelete.js. | ||||
| CVE-2021-37517 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2024-11-21 | 7.5 High |
| An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service. | ||||
| CVE-2021-37504 | 1 Hayageek | 1 Jquery Upload File | 2024-11-21 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name. | ||||
| CVE-2021-37478 | 1 Naviwebs | 1 Navigatecms | 2024-11-21 | 9.8 Critical |
| In NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on parameter `block-order`, which results in arbitrary sql query execution in the backend database. | ||||
| CVE-2021-37477 | 1 Naviwebs | 1 Navigatecms | 2024-11-21 | 9.8 Critical |
| In NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql injection on parameter `children_order`, which results in arbitrary sql query execution in the backend database. | ||||
| CVE-2021-37476 | 1 Naviwebs | 1 Navigatecms | 2024-11-21 | 9.8 Critical |
| In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `id` through a post request, which results in arbitrary sql query execution in the backend database. | ||||
| CVE-2021-37475 | 1 Naviwebs | 1 Navigatecms | 2024-11-21 | 9.8 Critical |
| In NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql injection on parameter `template-properties-order`, which results in arbitrary sql query execution in the backend database. | ||||
| CVE-2021-37473 | 1 Naviwebs | 1 Navigatecms | 2024-11-21 | 9.8 Critical |
| In NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection on parameter `products-order` through a post request, which results in arbitrary sql query execution in the backend database. | ||||
| CVE-2021-37471 | 1 Cradlepoint | 6 Ibr600, Ibr600 Firmware, Ibr600c and 3 more | 2024-11-21 | 7.5 High |
| Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local console and SSH command-line. | ||||
| CVE-2021-37470 | 1 Nchsoftware | 1 Webdictate | 2024-11-21 | 5.4 Medium |
| In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript. | ||||
| CVE-2021-37469 | 1 Nch | 1 Webdictate | 2024-11-21 | 6.5 Medium |
| In NCH WebDictate v2.13 and earlier, authenticated users can abuse logprop?file=/.. path traversal to read files on the filesystem. | ||||
| CVE-2021-37468 | 1 Nch | 1 Reflect Customer Relationship Management | 2024-11-21 | 3.3 Low |
| NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files. | ||||