Export limit exceeded: 381188 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (381188 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-26540 | 2 Apostrophecms, Redhat | 2 Sanitize-html, Openshift | 2024-11-21 | 5.3 Medium |
| Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com". | ||||
| CVE-2021-26539 | 2 Apostrophecms, Redhat | 2 Sanitize-html, Openshift | 2024-11-21 | 5.3 Medium |
| Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option. | ||||
| CVE-2021-26530 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 9.1 Critical |
| The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool. | ||||
| CVE-2021-26529 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 9.1 Critical |
| The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool. | ||||
| CVE-2021-26528 | 1 Cesanta | 1 Mongoose | 2024-11-21 | 9.1 Critical |
| The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool. | ||||
| CVE-2021-26505 | 1 Hello.js Project | 1 Hello.js | 2024-11-21 | 9.8 Critical |
| Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function. | ||||
| CVE-2021-26504 | 1 Dgtl | 1 Huemagic | 2024-11-21 | 7.5 High |
| Directory Traversal vulnerability in Foddy node-red-contrib-huemagic version 3.0.0, allows remote attackers to gain sensitive information via crafted request in res.sendFile API in hue-magic.js. | ||||
| CVE-2021-26476 | 1 Eprints | 1 Eprints | 2024-11-21 | 9.8 Critical |
| EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI. | ||||
| CVE-2021-26475 | 1 Eprints | 1 Eprints | 2024-11-21 | 6.1 Medium |
| EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI. | ||||
| CVE-2021-26474 | 1 Vembu | 2 Bdr Suite, Offsite Dr | 2024-11-21 | 8.6 High |
| Various Vembu products allow an attacker to execute a (non-blind) http-only Cross Site Request Forgery (Other products or versions of products in this family may be affected too.) | ||||
| CVE-2021-26473 | 1 Vembu | 2 Bdr Suite, Offsite Dr | 2024-11-21 | 9.8 Critical |
| In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server. | ||||
| CVE-2021-26472 | 2 Microsoft, Vembu | 3 Windows, Bdr Suite, Offsite Dr | 2024-11-21 | 10 Critical |
| In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges. | ||||
| CVE-2021-26471 | 1 Vembu | 2 Bdr Suite, Offsite Dr | 2024-11-21 | 9.8 Critical |
| In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands. | ||||
| CVE-2021-26461 | 1 Apache | 1 Nuttx | 2024-11-21 | 9.8 Critical |
| Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. | ||||
| CVE-2021-26442 | 1 Microsoft | 22 Windows 10, Windows 10 1507, Windows 10 1607 and 19 more | 2024-11-21 | 7 High |
| Windows HTTP.sys Elevation of Privilege Vulnerability | ||||
| CVE-2021-26441 | 1 Microsoft | 19 Windows 10, Windows 10 1507, Windows 10 1607 and 16 more | 2024-11-21 | 7.8 High |
| Storage Spaces Controller Elevation of Privilege Vulnerability | ||||
| CVE-2021-26427 | 1 Microsoft | 1 Exchange Server | 2024-11-21 | 9 Critical |
| Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
| CVE-2021-26422 | 1 Microsoft | 2 Lync Server, Skype For Business Server | 2024-11-21 | 7.2 High |
| Skype for Business and Lync Remote Code Execution Vulnerability | ||||
| CVE-2021-26421 | 1 Microsoft | 2 Lync Server, Skype For Business Server | 2024-11-21 | 6.5 Medium |
| Skype for Business and Lync Spoofing Vulnerability | ||||
| CVE-2021-26420 | 1 Microsoft | 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server | 2024-11-21 | 7.1 High |
| Microsoft SharePoint Server Remote Code Execution Vulnerability | ||||