Export limit exceeded: 384730 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 384730 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (384730 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-44921 | 1 Gpac | 1 Gpac | 2024-11-21 | 5.5 Medium |
| A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_isom_parse_movie_boxes_internal function, which causes a segmentation fault and application crash. | ||||
| CVE-2021-44920 | 1 Gpac | 1 Gpac | 2024-11-21 | 5.5 Medium |
| An invalid memory address dereference vulnerability exists in gpac 1.1.0 in the dump_od_to_saf.isra function, which causes a segmentation fault and application crash. | ||||
| CVE-2021-44919 | 1 Gpac | 1 Gpac | 2024-11-21 | 5.5 Medium |
| A Null Pointer Dereference vulnerability exists in the gf_sg_vrml_mf_alloc function in gpac 1.1.0-DEV, which causes a segmentation fault and application crash. | ||||
| CVE-2021-44918 | 1 Gpac | 1 Gpac | 2024-11-21 | 5.5 Medium |
| A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf_node_get_field function, which can cause a segmentation fault and application crash. | ||||
| CVE-2021-44917 | 1 Gnuplot | 1 Gnuplot | 2024-11-21 | 5.5 Medium |
| A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash. | ||||
| CVE-2021-44916 | 1 Opmantek | 1 Open-audit | 2024-11-21 | 6.1 Medium |
| Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser. | ||||
| CVE-2021-44915 | 1 Taogogo | 1 Taocms | 2024-11-21 | 7.2 High |
| Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category. | ||||
| CVE-2021-44912 | 1 Xpressengine | 1 Xpressengine | 2024-11-21 | 5.4 Medium |
| In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is improper, for example before the XE 1.11.2 version, you can upload the PHP type file to GETSHELL. | ||||
| CVE-2021-44911 | 1 Xpressengine | 1 Xpressengine | 2024-11-21 | 5.4 Medium |
| XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. | ||||
| CVE-2021-44908 | 1 Sailsjs | 1 Sails | 2024-11-21 | 9.8 Critical |
| SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules(). | ||||
| CVE-2021-44906 | 2 Redhat, Substack | 12 Enterprise Linux, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Eus and 9 more | 2024-11-21 | 9.8 Critical |
| Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). | ||||
| CVE-2021-44905 | 1 Cef | 2 Fortessa Ftbtld, Fortessa Ftbtld Firmware | 2024-11-21 | 8.2 High |
| Incorrect permissions in the Bluetooth Services in the Fortessa FTBTLD Smart Lock as of 12-13-2022 allows a remote attacker to disable the lock via an unauthenticated edit to the lock name. | ||||
| CVE-2021-44903 | 1 Msi | 1 Center Pro | 2024-11-21 | 7.8 High |
| Micro-Star International (MSI) Center Pro <= 2.0.16.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests. | ||||
| CVE-2021-44901 | 1 Msi | 1 Dragon Center | 2024-11-21 | 7.8 High |
| Micro-Star International (MSI) Dragon Center <= 2.0.116.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests. | ||||
| CVE-2021-44900 | 1 Msi | 1 App Player | 2024-11-21 | 7.8 High |
| Micro-Star International (MSI) App Player <= 4.280.1.6309 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the NTIOLib_X64.sys and BstkDrv_msi2.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests. | ||||
| CVE-2021-44899 | 1 Msi | 1 Center | 2024-11-21 | 7.8 High |
| Micro-Star International (MSI) Center <= 1.0.31.0 is vulnerable to multiple Privilege Escalation vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLib_X64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests. | ||||
| CVE-2021-44896 | 1 Dmproadmap Project | 1 Dmproadmap | 2024-11-21 | 6.1 Medium |
| DMP Roadmap before 3.0.4 allows XSS. | ||||
| CVE-2021-44892 | 1 Thinkphp | 1 Thinkphp | 2024-11-21 | 8.8 High |
| A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges. | ||||
| CVE-2021-44886 | 1 Zammad | 1 Zammad | 2024-11-21 | 5.3 Medium |
| In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to. | ||||
| CVE-2021-44882 | 1 Dlink | 2 Dir-878, Dir-878 Firmware | 2024-11-21 | 9.8 Critical |
| D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request. | ||||