Export limit exceeded: 45426 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (45426 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-32504 | 1 Sick | 2 Ftmg, Ftmg Firmware | 2024-11-21 | 5.3 Medium |
| Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system. | ||||
| CVE-2021-32503 | 1 Sick | 2 Ftmg, Ftmg Firmware | 2024-11-21 | 4.9 Medium |
| Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system. | ||||
| CVE-2021-32477 | 1 Moodle | 1 Moodle | 2024-11-21 | 4.3 Medium |
| The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with the relevant capability (site administrators by default). Moodle versions 3.10 to 3.10.3 are affected. | ||||
| CVE-2021-32474 | 1 Moodle | 1 Moodle | 2024-11-21 | 7.2 High |
| An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer host. Note that this required site administrator access or access to the keypair. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected. | ||||
| CVE-2021-32472 | 1 Moodle | 1 Moodle | 2024-11-21 | 4.3 Medium |
| Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and 3.8 to 3.8.8 are affected. | ||||
| CVE-2021-32428 | 1 Viaviweb | 1 Ebook | 2024-11-21 | 9.8 Critical |
| SQL Injection vulnerability in viaviwebtech Android EBook App (Books App, PDF, ePub, Online Book Reading, Download Books) 10 via the author_id parameter to api.php. | ||||
| CVE-2021-32172 | 1 Maianscriptworld | 1 Maian Cart | 2024-11-21 | 9.8 Critical |
| Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin. | ||||
| CVE-2021-32104 | 1 Open-emr | 1 Openemr | 2024-11-21 | 8.8 High |
| A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1. | ||||
| CVE-2021-32102 | 1 Open-emr | 1 Openemr | 2024-11-21 | 8.8 High |
| A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1. | ||||
| CVE-2021-32099 | 1 Artica | 1 Pandora Fms | 2024-11-21 | 9.8 Critical |
| A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass. | ||||
| CVE-2021-32095 | 1 Nsa | 1 Emissary | 2024-11-21 | 8.1 High |
| U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files. | ||||
| CVE-2021-32093 | 1 Nsa | 1 Emissary | 2024-11-21 | 6.5 Medium |
| The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName parameter. | ||||
| CVE-2021-32056 | 2 Cyrus, Fedoraproject | 2 Imap, Fedora | 2024-11-21 | 4.3 Medium |
| Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall. | ||||
| CVE-2021-32051 | 1 Hexagon | 1 Intergraph G\!nius | 2024-11-21 | 7.5 High |
| Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter. | ||||
| CVE-2021-32015 | 1 Nuvoton | 2 Npct75x, Npct75x Firmware | 2024-11-21 | 6.0 Medium |
| In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-volatile memory. NOTE: Upgrading to firmware version 7.4.0.1 will mitigate against the vulnerability, but version 7.4.0.1 is not TCG or Common Criteria (CC) certified. Nuvoton recommends that users apply the NPCT75x TPM 1.2 firmware update. | ||||
| CVE-2021-31999 | 1 Rancher | 1 Rancher | 2024-11-21 | 8.8 High |
| A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16. | ||||
| CVE-2021-31926 | 1 Cubecoders | 1 Amp | 2024-11-21 | 6.5 Medium |
| AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by crafting an HTTP(S) request directly to the applicable API endpoint (despite not having permission to make changes to the system's network configuration). | ||||
| CVE-2021-31921 | 2 Istio, Redhat | 2 Istio, Service Mesh | 2024-11-21 | 9.8 Critical |
| Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO_PASSTHROUGH routing configuration. | ||||
| CVE-2021-31920 | 2 Istio, Redhat | 2 Istio, Service Mesh | 2024-11-21 | 6.5 Medium |
| Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization policy when path based authorization rules are used. | ||||
| CVE-2021-31909 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | 9.8 Critical |
| In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible. | ||||