Export limit exceeded: 24323 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (24323 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-40903 | 1 Antminer Monitor Project | 1 Antminer Monitor | 2024-11-21 | 9.8 Critical |
| A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefined secret string, which would be randomly generated, however it is static. | ||||
| CVE-2021-40813 | 1 Element-it | 1 Http Commander | 2024-11-21 | 5.4 Medium |
| A cross-site scripting (XSS) vulnerability in the "Zip content" feature in Element-IT HTTP Commander 3.1.9 allows remote authenticated users to inject arbitrary web script or HTML via filenames. | ||||
| CVE-2021-40494 | 1 Adaptivescale | 1 Lxdui | 2024-11-21 | 9.8 Critical |
| A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system. | ||||
| CVE-2021-3914 | 1 Redhat | 4 Build Of Quarkus, Openshift Application Runtimes, Quarkus and 1 more | 2024-11-21 | 6.1 Medium |
| It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks. | ||||
| CVE-2021-3866 | 1 Zulip | 1 Zulip | 2024-11-21 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6. | ||||
| CVE-2021-3862 | 1 Icecoder | 1 Icecoder | 2024-11-21 | 4.8 Medium |
| icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||||
| CVE-2021-3857 | 1 Chaskiq | 1 Chaskiq | 2024-11-21 | 5.4 Medium |
| chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||||
| CVE-2021-3853 | 1 Chaskiq | 1 Chaskiq | 2024-11-21 | 6.1 Medium |
| chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||||
| CVE-2021-3816 | 1 Cacti | 1 Cacti | 2024-11-21 | 5.4 Medium |
| Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the group_prefix field during the creation of a new group via "Copy" method at user_group_admin.php. | ||||
| CVE-2021-3672 | 6 C-ares Project, Fedoraproject, Nodejs and 3 more | 19 C-ares, Fedora, Node.js and 16 more | 2024-11-21 | 5.6 Medium |
| A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability. | ||||
| CVE-2021-3662 | 1 Hp | 2 Futuresmart 4, Futuresmart 5 | 2024-11-21 | 5.4 Medium |
| Certain HP Enterprise LaserJet and PageWide MFPs may be vulnerable to stored cross site scripting (XSS). | ||||
| CVE-2021-3646 | 1 Btcpayserver | 1 Btcpay Server | 2024-11-21 | 6.1 Medium |
| btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||||
| CVE-2021-3628 | 1 Openkm | 1 Openkm | 2024-11-21 | 4.6 Medium |
| OpenKM Community Edition in its 6.3.10 version is vulnerable to authenticated Cross-site scripting (XSS). A remote attacker could exploit this vulnerability by injecting arbitrary code via de uuid parameter. | ||||
| CVE-2021-3619 | 1 Rapid7 | 1 Velociraptor | 2024-11-21 | 3.5 Low |
| Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to Velociraptor is nearly always reserved for trusted and verified users with IT security backgrounds. | ||||
| CVE-2021-3565 | 3 Fedoraproject, Redhat, Tpm2-tools Project | 3 Fedora, Enterprise Linux, Tpm2-tools | 2024-11-21 | 5.9 Medium |
| A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this vulnerability is to data confidentiality. | ||||
| CVE-2021-3539 | 1 Espocrm | 1 Espocrm | 2024-11-21 | 6.3 Medium |
| EspoCRM 6.1.6 and prior suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in processing user-supplied avatar images. This issue was fixed in version 6.1.7 of the product. | ||||
| CVE-2021-3536 | 1 Redhat | 12 Build Of Quarkus, Data Grid, Descision Manager and 9 more | 2024-11-21 | 4.8 Medium |
| A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity. | ||||
| CVE-2021-3535 | 1 Rapid7 | 1 Nexpose | 2024-11-21 | 4.3 Medium |
| Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific search criterion and operator combination in Filtered Asset Search could have allowed a user to pass code through the provided search field. This issue affects version 6.6.80 and prior, and is fixed in 6.6.81. If your Security Console currently falls on or within this affected version range, ensure that you update your Security Console to the latest version. | ||||
| CVE-2021-3529 | 1 Redhat | 3 Noobaa-operator, Openshift Container Platform, Openshift Container Storage | 2024-11-21 | 7.1 High |
| A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a payload script. The input was echoed unmodified in the application response, resulting in arbitrary JavaScript being injected into an application's response. The highest threat to the system is for confidentiality, availability, and integrity. | ||||
| CVE-2021-3509 | 1 Redhat | 1 Ceph Storage | 2024-11-21 | 6.1 Medium |
| A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS.The greatest threat to the system is for confidentiality, integrity, and availability. | ||||