Export limit exceeded: 370465 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 370465 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370465 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-23432 | 1 Mootools Project | 1 Mootools | 2024-11-21 | 5.4 Medium |
| This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge() | ||||
| CVE-2021-23431 | 1 Joplinapp | 1 Joplin | 2024-11-21 | 5.4 Medium |
| The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms. | ||||
| CVE-2021-23430 | 1 Startserver Project | 1 Startserver | 2024-11-21 | 7.5 High |
| All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization. | ||||
| CVE-2021-23429 | 1 Transpile Project | 1 Transpile | 2024-11-21 | 6.5 Medium |
| All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function. | ||||
| CVE-2021-23428 | 1 Elfinder.netcore Project | 1 Elfinder.netcore | 2024-11-21 | 8.6 High |
| This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal | ||||
| CVE-2021-23427 | 1 Elfinder.netcore Project | 1 Elfinder.netcore | 2024-11-21 | 8.6 High |
| This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation. | ||||
| CVE-2021-23426 | 1 Proto Project | 1 Proto | 2024-11-21 | 5.6 Medium |
| This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function. | ||||
| CVE-2021-23425 | 2 Redhat, Trim-off-newlines Project | 2 Rhev Manager, Trim-off-newlines | 2024-11-21 | 5.3 Medium |
| All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing. | ||||
| CVE-2021-23424 | 1 Ansi-html Project | 1 Ansi-html | 2024-11-21 | 7.5 High |
| This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time. | ||||
| CVE-2021-23423 | 1 Bikeshed Project | 1 Bikeshed | 2024-11-21 | 5.5 Medium |
| This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output. | ||||
| CVE-2021-23422 | 1 Bikeshed Project | 1 Bikeshed | 2024-11-21 | 7.8 High |
| This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output. | ||||
| CVE-2021-23421 | 1 Merge-change Project | 1 Merge-change | 2024-11-21 | 5.6 Medium |
| All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function. | ||||
| CVE-2021-23420 | 1 Codeception | 1 Codeception | 2024-11-21 | 7.7 High |
| This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation. | ||||
| CVE-2021-23419 | 1 Open-graph Project | 1 Open-graph | 2024-11-21 | 7.3 High |
| This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload. | ||||
| CVE-2021-23418 | 1 Glances Project | 1 Glances | 2024-11-21 | 6.3 Medium |
| The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks. | ||||
| CVE-2021-23417 | 1 Deepmergefn Project | 1 Deepmergefn | 2024-11-21 | 5.6 Medium |
| All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function. | ||||
| CVE-2021-23416 | 1 Curly-bracket-parser Project | 1 Curly-bracket-parser | 2024-11-21 | 5.4 Medium |
| This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input. | ||||
| CVE-2021-23415 | 1 Elfinder.aspnet Project | 1 Elfinder.aspnet | 2024-11-21 | 7.5 High |
| This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path. | ||||
| CVE-2021-23414 | 2 Fedoraproject, Videojs | 2 Fedora, Video.js | 2024-11-21 | 6.5 Medium |
| This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code. | ||||
| CVE-2021-23413 | 1 Jszip Project | 1 Jszip | 2024-11-21 | 5.3 Medium |
| This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance. | ||||