Export limit exceeded: 425892 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 11764 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 11764 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,764

Export CSV
CVE-2021-28132

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI.

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Lucysecurity
Products
Security Awareness
CVE-2021-28116

squid: out-of-bounds read in WCCP protocol data may lead to information disclosure

Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.

CVSS 3.1 · 3.7 Low EPSS 12.9% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 1 more
CVE-2021-28042

Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution.

CVSS 3.1 · 7.8 High EPSS 3.4% KEV · Not listed
Vendors
Deutschepost
Products
Mailoptimizer
CVE-2021-27983

Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page.

CVSS 3.1 · 9.8 Critical EPSS 3.6% KEV · Not listed
Vendors
Max-3000
Products
Maxsite Cms
CVE-2021-27928

mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user

A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.

CVSS 3.1 · 7.2 High EPSS 38.2% KEV · Not listed
Vendors
Debian Galeracluster Mariadb and 2 more
Products
Debian Linux Wsrep Mariadb and 5 more