Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (119497 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-16656 1 Joyplus Project 1 Joyplus 2024-11-21 9.8 Critical
joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database.
CVE-2019-16653 1 Geniusbytes 1 Genius Server 2024-11-21 8.8 High
An application plugin in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to gain admin privileges.
CVE-2019-16652 1 Geniusbytes 1 Genius Server 2024-11-21 7.2 High
The BPM component in Genius Bytes Genius Server (Genius CDDS) 3.2.2 allows remote authenticated users to execute arbitrary commands.
CVE-2019-16530 1 Sonatype 2 Nexus Iq Server, Nexus Repository Manager 2024-11-21 7.2 High
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.
CVE-2019-16514 1 Connectwise 1 Control 2024-11-21 7.2 High
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.
CVE-2019-16405 1 Centreon 1 Centreon Web 2024-11-21 7.2 High
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.
CVE-2019-16398 1 Keeper 2 K5, K5 Firmware 2024-11-21 6.8 Medium
On Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD card containing a file named zskj_script_run.sh that executes a reverse shell.
CVE-2019-16353 1 Geautomation 1 Proficy 2024-11-21 7.5 High
Emerson GE Automation Proficy Machine Edition 8.0 allows an access violation and application crash via crafted traffic from a remote device, as demonstrated by an RX7i device.
CVE-2019-16344 1 Scadabr 1 Scadabr 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password parameter.
CVE-2019-16340 1 Linksys 6 Velop Whw0301, Velop Whw0301 Firmware, Velop Whw0302 and 3 more 2024-11-21 9.8 Critical
Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.
CVE-2019-16328 1 Rpyc Project 1 Rpyc 2024-11-21 7.5 High
In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
CVE-2019-16326 1 Dlink 2 Dir-601, Dir-601 Firmware 2024-11-21 8.8 High
D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented. A remote attacker could exploit this in conjunction with CVE-2019-16327 to enable remote router management and device compromise. NOTE: this is an end-of-life product.
CVE-2019-16314 1 Indexhibit 1 Indexhibit 2024-11-21 9.8 Critical
Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.
CVE-2019-16307 1 Fujixerox 1 Docushare 2024-11-21 6.1 Medium
A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter (webExMeetingLogin.jsp) and meetingKey parameter (deleteWebExMeetingCheck.jsp).
CVE-2019-16294 2 Notepad-plus-plus, Scintilla 2 Notepad\+\+, Scintilla 2024-11-21 7.8 High
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.
CVE-2019-16271 1 Dten 4 D5, D5 Firmware, D7 and 1 more 2024-11-21 5.3 Medium
DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/emulated/0/Notes/PDF on TCP port 8080 without authentication.
CVE-2019-16268 1 Zohocorp 1 Manageengine Remote Access Plus 2024-11-21 4.8 Medium
Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen.
CVE-2019-16257 1 Motorola 2 Motorola, Motorola Firmware 2024-11-21 9.8 Critical
Some Motorola devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
CVE-2019-16213 1 Tendacn 2 Pa6, Pa6 Firmware 2024-11-21 8.8 High
Tenda PA6 Wi-Fi Powerline extender 1.0.1.21 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted string, an attacker could modify the device name of an attached PLC adapter to inject and execute arbitrary commands on the system with root privileges.
CVE-2019-16212 1 Broadcom 1 Brocade Sannav 2024-11-21 8.8 High
A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulnerability could allow a remote attacker to bypass the authentication process.