Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (328240 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-11585 1 Atlassian 2 Jira, Jira Server 2024-11-21 N/A
The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.
CVE-2019-11584 1 Atlassian 1 Jira 2024-11-21 N/A
The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority.
CVE-2019-11583 1 Atlassian 1 Jira 2024-11-21 N/A
The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue search when ordering by "Epic Name".
CVE-2019-11582 1 Atlassian 1 Sourcetree 2024-11-21 N/A
An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote code execution through the use of a crafted URI.
CVE-2019-11579 2 Debian, Dhcpcd Project 2 Debian Linux, Dhcpcd 2024-11-21 5.3 Medium
dhcp.c in dhcpcd before 7.2.1 contains a 1-byte read overflow with DHO_OPTSOVERLOADED.
CVE-2019-11578 1 Dhcpcd Project 1 Dhcpcd 2024-11-21 5.9 Medium
auth.c in dhcpcd before 7.2.1 allowed attackers to infer secrets by performing latency attacks.
CVE-2019-11577 1 Dhcpcd Project 1 Dhcpcd 2024-11-21 N/A
dhcpcd before 7.2.1 contains a buffer overflow in dhcp6_findna in dhcp6.c when reading NA/TA addresses.
CVE-2019-11576 1 Gitea 1 Gitea 2024-11-21 N/A
Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment. If a user's credentials are known, then an attacker could send them to the API without requiring the 2FA one-time password.
CVE-2019-11574 1 Simplemachines 1 Simple Machine Forum 2024-11-21 9.8 Critical
An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls.
CVE-2019-11569 1 Veeam 1 One Reporter 2024-11-21 N/A
Veeam ONE Reporter 9.5.0.3201 allows CSRF.
CVE-2019-11568 1 Aikcms 1 Aikcms 2024-11-21 N/A
An issue was discovered in AikCms v2.0. There is a File upload vulnerability, as demonstrated by an admin/page/system/nav.php request with PHP code in a .php file with the application/octet-stream content type.
CVE-2019-11567 1 Aikcms 1 Aikcms 2024-11-21 N/A
An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $_GET['del'], as demonstrated by an admin/page/system/nav.php?del= URI.
CVE-2019-11565 1 Print My Blog Project 1 Print My Blog 2024-11-21 N/A
Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter.
CVE-2019-11564 1 Humhub 1 Humhub 2024-11-21 N/A
A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/codeception/tests/data/app/view/index.php POST request.
CVE-2019-11561 1 Chuango 20 A11, A11 Firmware, A8 and 17 more 2024-11-21 N/A
The Chuango 433 MHz burglar-alarm product line is vulnerable to a Denial of Service attack. When the condition is triggered, the OV2 base station is unable to process sensor states and effectively prevents the alarm from setting off, as demonstrated by Chuango branded products, and non-Chuango branded products such as the Eminent EM8617 OV2 Wifi Alarm System.
CVE-2019-11560 1 Hisilicon 2 Hi3516, Hi3516 Firmware 2024-11-21 N/A
A buffer overflow vulnerability in the streaming server provided by hisilicon in HI3516 models allows an unauthenticated attacker to remotely run arbitrary code by sending a special RTSP over HTTP packet. The vulnerability was found in many cameras using hisilicon's hardware and software, as demonstrated by TENVIS cameras 1.3.3.3, 1.2.7.2, 1.2.1.4, 7.1.20.1.2, and 13.1.1.1.7.2; FDT FD7902 11.3.14.1.3 and 10.3.14.1.3; FOSCAM cameras 3.2.1.1.1_0815 and 3.2.2.2.1_0815; and Dericam cameras V11.3.8.1.12.
CVE-2019-11559 1 Hrworks 1 Hrworks 2024-11-21 6.1 Medium
A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component.
CVE-2019-11557 1 Web-dorado 1 Wp Form Builder 2024-11-21 8.8 High
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
CVE-2019-11556 2 Opensuse, Redhat 3 Backports Sle, Leap, Pagure 2024-11-21 6.1 Medium
Pagure before 5.6 allows XSS via the templates/blame.html blame view.
CVE-2019-11555 1 W1.fi 2 Hostapd, Wpa Supplicant 2024-11-21 N/A
The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference (denial of service). This affects eap_server/eap_server_pwd.c and eap_peer/eap_pwd.c.