35,538 results · Clear filters · Feed
-
Critical 9.0CVE-2021-43616 Public exploit
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in pac…
-
Unscored —CVE-2021-43579 Public exploit
A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim c…
-
Low 3.7CVE-2021-37910 Public exploit
ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication
ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames.
-
Unscored —
Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration searc…
-
Unscored —
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that…
-
Unscored —
Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.
-
Medium 5.7CVE-2021-3572 Public exploit
Improper Input Validation in pip
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This i…
-
Critical 9.8
PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces
A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The atta…
-
High 8.1
PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)
An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root us…
-
Unscored —
An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtai…
-
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 17, 2021 -
High 7.8
Microsoft Excel Security Feature Bypass Vulnerability
Microsoft Excel Security Feature Bypass Vulnerability
KEV Nov 17, 2021 -
High 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
KEV Apr 11, 2022 -
High 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
KEV Apr 11, 2022 -
Medium 4.3CVE-2021-41351 Public exploit
Microsoft Edge (Chrome based) Spoofing on IE Mode
Microsoft Edge (Chrome based) Spoofing on IE Mode
-
Medium 6.5
Microsoft Exchange Server Spoofing Vulnerability
Microsoft Exchange Server Spoofing Vulnerability
-
High 8.8
Remote Desktop Client Remote Code Execution Vulnerability
Remote Desktop Client Remote Code Execution Vulnerability
-
Unscored —CVE-2021-40577 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP a…
-
Unscored —CVE-2021-24807 Public exploit
Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically e…
-
Unscored —CVE-2021-24664 Public exploit
WPSchoolPress < 2.1.17 - Multiple Admin+ Stored Cross-Site Scripting
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
-
Unscored —
Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site b…
-
Medium 5.3
An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. Th…
-
Unscored —
An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained …
-
Unscored —
An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitori…
-
Unscored —CVE-2021-42670 Public exploit
A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the annou…
-
Unscored —
A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which al…
-
Unscored —CVE-2021-42668 Public exploit
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_cl…
-
Unscored —
A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-mana…
-
Unscored —CVE-2021-42666 Public exploit
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_ques…
-
Unscored —CVE-2021-42665 Public exploit
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of ind…
-
Unscored —CVE-2021-42664 Public exploit
A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) …
-
Unscored —
An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via t…
-
Unscored —CVE-2021-42662 Public exploit
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System …
-
Critical 9.8
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where i…
KEV Mar 25, 2022 -
Critical 10.0CVE-2021-40113 Public exploit
Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities
Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a d…
-
Unscored —CVE-2021-43032 Public exploit
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertis…
-
Unscored —CVE-2021-43339 Public exploit
In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via fil…
-
Unscored —CVE-2021-43141 Public exploit
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter …
-
Unscored —CVE-2021-43140 Public exploit
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.
-
Unscored —
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communic…