Show filters
4,019 Total Results
Displaying 11-20 of 4,019
Sort by:
Attacker Value
Very High
CVE-2021-44077
Disclosure Date: November 29, 2021 (last updated October 07, 2023)
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
3
Attacker Value
Very High
CVE-2021-42668
Disclosure Date: November 05, 2021 (last updated February 23, 2025)
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code execution on the remote web server.
3
Attacker Value
Unknown
CVE-2020-11022
Disclosure Date: April 29, 2020 (last updated February 21, 2025)
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
4
Attacker Value
Unknown
CVE-2019-10719
Disclosure Date: June 21, 2019 (last updated November 27, 2024)
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.
3
Attacker Value
Moderate
CVE-2021-42847
Disclosure Date: November 11, 2021 (last updated October 07, 2023)
Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.
2
Attacker Value
Very High
CVE-2021-42671
Disclosure Date: November 05, 2021 (last updated February 23, 2025)
An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of authentication or authorization.
2
Attacker Value
Very High
CVE-2021-42665
Disclosure Date: November 05, 2021 (last updated February 23, 2025)
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication.
2
Attacker Value
Very High
CVE-2021-41511
Disclosure Date: October 04, 2021 (last updated February 23, 2025)
The username and password field of login in Lodging Reservation Management System V1 can give access to any user by using SQL injection to bypass authentication.
2
Attacker Value
Very High
CVE-2020-10189
Disclosure Date: March 06, 2020 (last updated February 21, 2025)
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
0
Attacker Value
Moderate
CVE-2019-13990
Disclosure Date: July 26, 2019 (last updated December 23, 2023)
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
2
