Export limit exceeded: 350852 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 80695 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (80695 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-27962 | 1 Grafana | 1 Grafana | 2024-11-21 | 7.1 High |
| Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access. | ||||
| CVE-2021-27954 | 1 Ecobee | 2 Ecobee3 Lite, Ecobee3 Lite Firmware | 2024-11-21 | 8.2 High |
| A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to force the device to connect to a SSID or cause a denial of service. | ||||
| CVE-2021-27953 | 1 Ecobee | 2 Ecobee3 Lite, Ecobee3 Lite Firmware | 2024-11-21 | 7.5 High |
| A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to cause a denial of service, forcing the device to reboot via a crafted HTTP request. | ||||
| CVE-2021-27950 | 1 Sitasoftware | 1 Azurcms | 2024-11-21 | 8.8 High |
| A SQL injection vulnerability in azurWebEngine in Sita AzurCMS through 1.2.3.12 allows an authenticated attacker to execute arbitrary SQL commands via the id parameter to mesdocs.ajax.php in azurWebEngine/eShop. By default, the query is executed as DBA. | ||||
| CVE-2021-27948 | 1 Mybb | 1 Mybb | 2024-11-21 | 7.2 High |
| SQL Injection vulnerability in MyBB before 1.8.26 via User Groups. (issue 3 of 3). | ||||
| CVE-2021-27947 | 1 Mybb | 1 Mybb | 2024-11-21 | 7.2 High |
| SQL Injection vulnerability in MyBB before 1.8.26 via the Copy Forum feature in Forum Management. (issue 2 of 3). | ||||
| CVE-2021-27946 | 1 Mybb | 1 Mybb | 2024-11-21 | 8.8 High |
| SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3). | ||||
| CVE-2021-27943 | 1 Vizio | 4 E50x-e1, E50x-e1 Firmware, P65-f1 and 1 more | 2024-11-21 | 7.5 High |
| The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-force attack (against only 10000 possibilities), allowing a threat actor to forcefully pair the device, leading to remote control of the TV settings and configurations. | ||||
| CVE-2021-27935 | 1 Adguard | 1 Adguard Home | 2024-11-21 | 7.5 High |
| An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce their password offline, because the hash of the password is stored in the cookie. | ||||
| CVE-2021-27932 | 1 Stormshield | 1 Ssl Vpn Client | 2024-11-21 | 7.8 High |
| Stormshield Network Security (SNS) VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions. | ||||
| CVE-2021-27928 | 5 Debian, Galeracluster, Mariadb and 2 more | 8 Debian Linux, Wsrep, Mariadb and 5 more | 2024-11-21 | 7.2 High |
| A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product. | ||||
| CVE-2021-27927 | 1 Zabbix | 1 Zabbix | 2024-11-21 | 8.8 High |
| In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code inside this controller calls diableSIDValidation inside the init() method. An attacker doesn't have to know Zabbix user login credentials, but has to know the correct Zabbix URL and contact information of an existing user with sufficient privileges. | ||||
| CVE-2021-27918 | 2 Golang, Redhat | 4 Go, Enterprise Linux, Openshift Container Storage and 1 more | 2024-11-21 | 7.5 High |
| encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method. | ||||
| CVE-2021-27914 | 1 Acquia | 1 Mautic | 2024-11-21 | 7.6 High |
| A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript | ||||
| CVE-2021-27912 | 1 Acquia | 1 Mautic | 2024-11-21 | 7.1 High |
| Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets. | ||||
| CVE-2021-27911 | 1 Acquia | 1 Mautic | 2024-11-21 | 8.3 High |
| Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc. | ||||
| CVE-2021-27910 | 1 Acquia | 1 Mautic | 2024-11-21 | 8.2 High |
| Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information. | ||||
| CVE-2021-27900 | 1 Proofpoint | 1 Insider Threat Management | 2024-11-21 | 8.1 High |
| The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This enables a view-only user to change any configuration setting and delete any registered agents. All versions before 7.11.1 are affected. | ||||
| CVE-2021-27899 | 1 Proofpoint | 1 Insider Threat Management | 2024-11-21 | 7.4 High |
| The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server's certificate, which enables a remote attacker to intercept and alter these communications using a man-in-the-middle attack. All versions before 7.11.1 are affected. Agents for Windows and Cloud are not affected. | ||||
| CVE-2021-27893 | 2 Microsoft, Ssh | 4 Windows, Tectia Client, Tectia Connectsecure and 1 more | 2024-11-21 | 7.0 High |
| SSH Tectia Client and Server before 6.4.19 on Windows allow local privilege escalation in nonstandard conditions. ConnectSecure on Windows is affected. | ||||