Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323679 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-15778 1 Getwooplugins 1 Additional Variation Images For Woocommerce 2024-11-21 N/A
The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.
CVE-2019-15777 1 Shapepress 1 Wp Dsgvo Tools 2024-11-21 N/A
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.
CVE-2019-15776 1 Webcraftic 1 Simple 301 Redirects-addon-bulk Uploader 2024-11-21 N/A
The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.
CVE-2019-15775 1 Learning Courses Project 1 Learning Courses 2024-11-21 N/A
The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
CVE-2019-15774 1 Booking Project 1 Booking 2024-11-21 N/A
The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
CVE-2019-15773 1 Travel Management Project 1 Travel Management 2024-11-21 N/A
The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
CVE-2019-15772 1 Donations Project 1 Donations 2024-11-21 N/A
The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
CVE-2019-15771 1 Components For Wp Bakery Page Builder Project 1 Components For Wp Bakery Page Builder 2024-11-21 N/A
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
CVE-2019-15770 1 Hallme 1 Woocommerce Address Book 2024-11-21 N/A
The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.
CVE-2019-15769 1 Haktansuren 1 Handl Utm Grabber 2024-11-21 N/A
The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.
CVE-2019-15767 1 Gnu 1 Chess 2024-11-21 N/A
In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted chess position in an EPD file.
CVE-2019-15766 1 Kslabs 1 Ksweb 2024-11-21 8.8 High
The KSLABS KSWEB (aka ru.kslabs.ksweb) application 3.93 for Android allows authenticated remote code execution via a POST request to the AJAX handler with the configFile parameter set to the arbitrary file to be written to (and the config_text parameter set to the content of the file to be created). This can be a PHP file that is written to in the public web directory and subsequently executed. The attacker must have network connectivity to the PHP server that is running on the Android device.
CVE-2019-15759 1 Webassembly 1 Binaryen 2024-11-21 6.5 Medium
An issue was discovered in Binaryen 1.38.32. Two visitors in ir/ExpressionManipulator.cpp can lead to a NULL pointer dereference in wasm::LocalSet::finalize in wasm/wasm.cpp. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by wasm2js.
CVE-2019-15758 1 Webassembly 1 Binaryen 2024-11-21 6.5 Medium
An issue was discovered in Binaryen 1.38.32. Missing validation rules in asmjs/asmangle.cpp can lead to an Assertion Failure at wasm/wasm.cpp in wasm::asmangle. A crafted input can cause denial-of-service, as demonstrated by wasm2js.
CVE-2019-15757 1 Libmirage Project 1 Libmirage 2024-11-21 N/A
libMirage 3.2.2 in CDemu has a NULL pointer dereference in the NRG parser in parser.c.
CVE-2019-15753 1 Openstack 1 Os-vif 2024-11-21 N/A
In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethernet flooding of non-local destinations, which both impedes network performance and allows users to possibly view the content of packets for instances belonging to other tenants sharing the same network. Only deployments using the linuxbridge backend are affected. This occurs in PyRoute2.add() in internal/command/ip/linux/impl_pyroute2.py.
CVE-2019-15751 1 Sitos 1 Sitos Six 2024-11-21 9.8 Critical
An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. This allows an unauthenticated attacker to upload a malicious file (containing PHP code to execute operating system commands) to the web root of the application.
CVE-2019-15750 1 Sitos 1 Sitos Six 2024-11-21 6.1 Medium
A Cross-Site Scripting (XSS) vulnerability in the blog function in SITOS six Build v6.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVE-2019-15749 1 Sitos 1 Sitos Six 2024-11-21 6.5 Medium
SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account (e.g., via XSS or an unattended workstation) to change that password and address.
CVE-2019-15748 1 Sitos 1 Sitos Six 2024-11-21 9.8 Critical
SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functionality to import a malicious SCORM package that includes a PHP file, which could execute arbitrary PHP code.