Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (347901 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-13406 1 Androvideo 2 Vd 1, Vd 1 Firmware 2024-11-21 N/A
A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication.
CVE-2019-13405 1 Androvideo 2 Vd 1, Vd 1 Firmware 2024-11-21 N/A
A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software.
CVE-2019-13404 2 Microsoft, Python 2 Windows, Python 2024-11-21 N/A
The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x
CVE-2019-13403 1 Temenos 1 Cwx 2024-11-21 N/A
Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information.
CVE-2019-13402 1 Fortinet 2 Fcm-mb40, Fcm-mb40 Firmware 2024-11-21 N/A
/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.
CVE-2019-13401 1 Fortinet 2 Fcm-mb40, Fcm-mb40 Firmware 2024-11-21 N/A
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.
CVE-2019-13400 1 Fortinet 2 Fcm-mb40, Fcm-mb40 Firmware 2024-11-21 N/A
Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.
CVE-2019-13399 1 Fortinet 2 Fcm-mb40, Fcm-mb40 Firmware 2024-11-21 N/A
Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation.
CVE-2019-13398 1 Fortinet 2 Fcm-mb40, Fcm-mb40 Firmware 2024-11-21 N/A
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.
CVE-2019-13397 1 Enhancesoft 1 Osticket 2024-11-21 N/A
Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket.
CVE-2019-13396 1 Getflightpath 1 Flightpath 2024-11-21 N/A
FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module.
CVE-2019-13395 1 Netgear 2 Cg3700b, Cg3700b Firmware 2024-11-21 8.8 High
The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify all settings including WEP/WPA/WPA2 keys, restore the router to factory settings, or even upload an entire malicious configuration file.
CVE-2019-13394 1 Netgear 2 Cg3700b, Cg3700b Firmware 2024-11-21 9.8 Critical
The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP.
CVE-2019-13393 1 Netgear 2 Cg3700b, Cg3700b Firmware 2024-11-21 7.5 High
The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the WPA2 pre-shared key. Either an attack against HTTP Basic Authentication or an attack against WPA2 could be used to determine this passphrase.
CVE-2019-13392 1 Mindpalette 1 Natemail 2024-11-21 6.1 Medium
A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that this array is keyed via integers by default, so any string input will be invalid.
CVE-2019-13391 1 Imagemagick 1 Imagemagick 2024-11-21 N/A
In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.
CVE-2019-13390 1 Ffmpeg 1 Ffmpeg 2024-11-21 N/A
In FFmpeg 4.1.3, there is a division by zero at adx_write_trailer in libavformat/rawenc.c.
CVE-2019-13389 1 Rainloop 1 Webmail 2024-11-21 6.1 Medium
RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection header, and the Content-Security-Policy header.
CVE-2019-13387 1 Control-webpanel 1 Webpanel 2024-11-21 6.1 Medium
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or session, or redirect to a phishing website.
CVE-2019-13386 1 Centos-webpanel 1 Centos Web Panel 2024-11-21 8.8 High
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.