Total
65442 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-20696 | 1 Gilacms | 1 Gila Cms | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field. | |||||
| CVE-2021-25526 | 1 Samsung | 1 Blockchain Wallet | 2023-12-10 | 2.1 LOW | 5.5 MEDIUM |
| Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action. | |||||
| CVE-2021-45938 | 1 Wolfssl | 1 Wolfmqtt | 2023-12-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Unsubscribe). | |||||
| CVE-2022-22919 | 1 Adenza | 1 Axiomsl Controllerview | 2023-12-10 | 5.8 MEDIUM | 6.1 MEDIUM |
| Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs. | |||||
| CVE-2021-22007 | 1 Vmware | 2 Cloud Foundation, Vcenter Server | 2023-12-10 | 2.1 LOW | 5.5 MEDIUM |
| The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administrative privilege may exploit this issue to gain access to sensitive information. | |||||
| CVE-2021-31364 | 1 Juniper | 14 Junos, Srx1500, Srx300 and 11 more | 2023-12-10 | 4.3 MEDIUM | 5.9 MEDIUM |
| An Improper Check for Unusual or Exceptional Conditions vulnerability combined with a Race Condition in the flow daemon (flowd) of Juniper Networks Junos OS on SRX300 Series, SRX500 Series, SRX1500, and SRX5000 Series with SPC2 allows an unauthenticated network based attacker sending specific traffic to cause a crash of the flowd/srxpfe process, responsible for traffic forwarding in SRX, which will cause a Denial of Service (DoS). Continued receipt and processing of this specific traffic will create a sustained Denial of Service (DoS) condition. This issue can only occur when specific packets are trying to create the same session and logging for session-close is configured as a policy action. Affected platforms are: SRX300 Series, SRX500 Series, SRX1500, and SRX5000 Series with SPC2. Not affected platforms are: SRX4000 Series, SRX5000 Series with SPC3, and vSRX Series. This issue affects Juniper Networks Junos OS SRX300 Series, SRX500 Series, SRX1500, and SRX5000 Series with SPC2: All versions prior to 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R1-S7, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R3; 20.3 versions prior to 20.3R2-S1, 20.3R3; 20.4 versions prior to 20.4R2. | |||||
| CVE-2021-42053 | 1 Django-unicorn | 1 Unicorn | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| The Unicorn framework through 0.35.3 for Django allows XSS via component.name. | |||||
| CVE-2021-43977 | 1 Smartertools | 1 Smartermail | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS. | |||||
| CVE-2021-37910 | 1 Asus | 10 Gt-axe11000, Gt-axe11000 Firmware, Rt-ax3000 and 7 more | 2023-12-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames. | |||||
| CVE-2021-39828 | 2 Adobe, Apple | 2 Digital Editions, Macos | 2023-12-10 | 6.8 MEDIUM | 6.5 MEDIUM |
| Adobe Digital Editions 4.5.11.187646 (and earlier) are affected by a privilege escalation vulnerability in the Digital Editions installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before product installation to abuse this vulnerability. | |||||
| CVE-2021-42664 | 1 Engineers Online Portal Project | 1 Engineers Online Portal | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) quiz description parameters to add_quiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which can lead to cookie stealing and more. | |||||
| CVE-2022-21683 | 1 Torchbox | 1 Wagtail | 2023-12-10 | 4.0 MEDIUM | 4.3 MEDIUM |
| Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not have editing access to, as long as they have left a comment or reply somewhere on the site. A patched version has been released as Wagtail 2.15.2, which restores the intended behaviour - to send notifications for new replies to the participants in the active thread only (editing permissions are not considered). New comments can be disabled by setting `WAGTAILADMIN_COMMENTS_ENABLED = False` in the Django settings file. | |||||
| CVE-2021-24686 | 1 Benbodhi | 1 Svg Support | 2023-12-10 | 3.5 LOW | 4.8 MEDIUM |
| The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2021-39420 | 1 Vfront | 1 Vfront | 2023-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple Cross Site Scripting (XSS) vulnerabilities exist in VFront 0.99.5 via the (1) s parameter in search_all.php and the (2) msg parameter in add.attach.php. | |||||
| CVE-2022-0414 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2023-12-10 | 4.0 MEDIUM | 4.3 MEDIUM |
| Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0. | |||||
| CVE-2021-20806 | 1 Cybozu | 1 Remote Service Manager | 2023-12-10 | 5.8 MEDIUM | 6.1 MEDIUM |
| Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | |||||
| CVE-2021-46532 | 1 Cesanta | 1 Mjs | 2023-12-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via exec_expr at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS). | |||||
| CVE-2022-22804 | 1 Schneider-electric | 1 Ecostruxure Power Monitoring Expert | 2023-12-10 | 3.5 LOW | 5.4 MEDIUM |
| A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authenticated attacker to view data, change settings, or impact availability of the software when the user visits a page containing the injected payload. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior) | |||||
| CVE-2021-38721 | 1 Thedaylightstudio | 1 Fuel Cms | 2023-12-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability | |||||
| CVE-2022-22716 | 1 Microsoft | 7 365 Apps, Excel, Office and 4 more | 2023-12-10 | 4.3 MEDIUM | 5.5 MEDIUM |
| Microsoft Excel Information Disclosure Vulnerability | |||||