Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (347190 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-19397 1 Huawei 14 S12700, S12700 Firmware, S1700 and 11 more 2024-11-21 7.5 High
There is a weak algorithm vulnerability in some Huawei products. The affected products use weak algorithms by default. Attackers may exploit the vulnerability to cause information leaks.
CVE-2019-19396 1 Omniosce 1 Omnios 2024-11-21 7.5 High
illumos, as used in OmniOS Community Edition before r151030y, allows a kernel crash via an application with multiple threads calling sendmsg concurrently over a single socket, because uts/common/inet/ip/ip_attr.c mishandles conn_ixa dereferences.
CVE-2019-19394 1 Northern.tech 1 Cfengine 2024-11-21 6.1 Medium
Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS. This is fixed in 3.10.7, 3.12.3, and 3.15.0.
CVE-2019-19393 1 Rittal 2 Cmc Pu Iii 7030.000, Cmc Pu Iii 7030.000 Firmware 2024-11-21 6.1 Medium
The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts) as the content is always displayed after and before login. Persistent XSS allows an attacker to modify displayed content or to change the victim's information. Successful exploitation requires access to the web management interface, either with valid credentials or a hijacked session.
CVE-2019-19392 1 Fordnn 1 Usersexportimport 2024-11-21 9.8 Critical
The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (create) new users with Administrator privileges, as demonstrated by Roles="Administrators" in XML or CSV data.
CVE-2019-19390 1 Matrix42 1 Workspace Management 2024-11-21 5.4 Medium
The Search parameter of the Software Catalogue section of Matrix42 Workspace Management 9.1.2.2765 and below accepts unfiltered parameters that lead to multiple reflected XSS issues.
CVE-2019-19389 1 Jetbrains 1 Ktor 2024-11-21 5.4 Medium
JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting.
CVE-2019-19388 1 Fusionpbx 1 Fusionpbx 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in app/dialplans/dialplan_detail_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the dialplan_uuid parameter.
CVE-2019-19387 1 Fusionpbx 1 Fusionpbx 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in app/fifo_list/fifo_interactive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the c parameter.
CVE-2019-19386 1 Fusionpbx 1 Fusionpbx 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id and/or voicemail_id parameter.
CVE-2019-19385 1 Fusionpbx 1 Fusionpbx 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in app/dialplans/dialplans.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the app_uuid parameter.
CVE-2019-19384 1 Fusionpbx 1 Fusionpbx 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in app/fax/fax_log_view.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the fax_uuid parameter.
CVE-2019-19383 1 Freeftpd 1 Freeftpd 2024-11-21 8.8 High
freeFTPd 1.0.8 has a Post-Authentication Buffer Overflow via a crafted SIZE command (this is exploitable even if logging is disabled).
CVE-2019-19382 1 Maxpcsecure 1 Anti Virus Plus 2024-11-21 7.8 High
Max Secure Anti Virus Plus 19.0.4.020 has Insecure Permissions on the installation directory. Local attackers can replace a .exe or .dll file to achieve privilege escalation.
CVE-2019-19381 1 Abacus 1 Abacus 2024-11-21 6.1 Medium
oauth/oauth2/v1/saml/ in Abacus OAuth Login 2019_01_r4_20191021_0000 before prior to R4 (20.11.2019 Hotfix) allows Reflected Cross Site Scripting (XSS) via an error message.
CVE-2019-19379 1 Misp 1 Misp 2024-11-21 5.3 Medium
In app/Controller/TagsController.php in MISP 2.4.118, users can bypass intended restrictions on tagging data.
CVE-2019-19378 1 Linux 1 Linux Kernel 2024-11-21 7.8 High
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image can lead to slab-out-of-bounds write access in index_rbio_pages in fs/btrfs/raid56.c.
CVE-2019-19377 2 Linux, Netapp 5 Linux Kernel, Active Iq Unified Manager, Cloud Backup and 2 more 2024-11-21 7.8 High
In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.
CVE-2019-19376 1 Octopus 1 Octopus Deploy 2024-11-21 6.5 Medium
In Octopus Deploy before 2019.10.6, an authenticated user with TeamEdit permission could send a malformed Team API request that bypasses input validation and causes an application level denial of service condition. (The fix for this was also backported to LTS 2019.9.8 and LTS 2019.6.14.)
CVE-2019-19375 1 Octopus 1 Octopus Deploy 2024-11-21 5.3 Medium
In Octopus Deploy before 2019.10.7, in a configuration where SSL offloading is enabled, the CSRF cookie was sometimes sent without the secure attribute. (The fix for this was backported to LTS versions 2019.6.14 and 2019.9.8.)