Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (322292 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-16543 1 Jenkins 1 Spira Importer 2024-11-21 5.5 Medium
Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVE-2019-16542 1 Jenkins 1 Anchore Container Image Scanner 2024-11-21 6.5 Medium
Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVE-2019-16541 2 Jenkins, Redhat 2 Jira, Openshift 2024-11-21 9.9 Critical
Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.
CVE-2019-16540 1 Jenkins 1 Support Core 2024-11-21 6.5 Medium
A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master.
CVE-2019-16539 1 Jenkins 1 Support Core 2024-11-21 6.5 Medium
A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles.
CVE-2019-16538 2 Jenkins, Redhat 2 Script Security, Openshift 2024-11-21 8.8 High
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.
CVE-2019-16534 1 Draytek 8 Vigor2925 Firmware, Vigor2925ac, Vigor2925fn and 5 more 2024-11-21 6.1 Medium
On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product.
CVE-2019-16533 1 Draytek 8 Vigor2925 Firmware, Vigor2925ac, Vigor2925fn and 5 more 2024-11-21 6.1 Medium
On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to trigger XSS. NOTE: this is an end-of-life product.
CVE-2019-16532 1 Yzmcms 1 Yzmcms 2024-11-21 6.1 Medium
An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections.
CVE-2019-16531 1 Layerbb 1 Layerbb 2024-11-21 8.8 High
LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.
CVE-2019-16530 1 Sonatype 2 Nexus Iq Server, Nexus Repository Manager 2024-11-21 7.2 High
Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.
CVE-2019-16529 1 Mediawiki 1 Checkuser 2024-11-21 5.3 Medium
An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki. Oversighted edit summaries are still visible in CheckUser results in violation of MediaWiki's permissions model.
CVE-2019-16528 1 Mediawiki 1 Abusefilter 2024-11-21 7.5 High
An issue was discovered in the AbuseFilter extension for MediaWiki. includes/special/SpecialAbuseLog.php allows attackers to obtain sensitive information, such as deleted/suppressed usernames and summaries, from AbuseLog revision data. This affects REL1_32 and REL1_33.
CVE-2019-16525 1 Checklist 1 Checklist 2024-11-21 6.1 Medium
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.
CVE-2019-16524 1 Status301 1 Easy Fancybox 2024-11-21 4.8 Medium
The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.
CVE-2019-16523 1 Pixelite 1 Events Manager 2024-11-21 5.4 Medium
The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.
CVE-2019-16522 1 Eu Cookie Law Project 1 Eu Cookie Law 2024-11-21 4.8 Medium
The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the Disable Cookie text. An attacker with high privileges can attack other users.
CVE-2019-16521 1 Managewp 1 Broken Link Checker 2024-11-21 6.1 Medium
The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_filter GET parameter in a filter_id=search request. NOTE: this is an end-of-life product.
CVE-2019-16520 1 Semperplugins 1 All In One Seo Pack 2024-11-21 5.4 Medium
The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe placeholder replacement.
CVE-2019-16519 1 Eset 3 Cyber Security, Endpoint Antivirus, Endpoint Security 2024-11-21 7.8 High
ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an undocumented feature in scheduled tasks.