Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323216 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-13495 1 Zyxel 2 Xgs2210-52hp, Xgs2210-52hp Firmware 2024-11-21 5.4 Medium
In firmware version 4.50 of Zyxel XGS2210-52HP, multiple stored cross-site scripting (XSS) issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field.
CVE-2019-13494 1 Castlerock 1 Simple Network Management Protocol Console 2024-11-21 N/A
nodeimp.exe in Castle Rock SNMPc before 9.0.12.1 and 10.x before 10.0.9 has a stack-based buffer overflow via a long variable string in a Map Objects text file.
CVE-2019-13493 1 Sitecore 1 Experience Platform 2024-11-21 N/A
In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.
CVE-2019-13489 1 Trape Project 1 Trape 2024-11-21 N/A
Trape through 2019-05-08 has SQL injection via the data[2] variable in core/db.py, as demonstrated by the /bs t parameter.
CVE-2019-13488 1 Trape Project 1 Trape 2024-11-21 N/A
A cross-site scripting (XSS) vulnerability in static/js/trape.js in Trape through 2019-05-08 allows remote attackers to inject arbitrary web script or HTML via the country, query, or refer parameter to the /register URI, because the jQuery prepend() method is used.
CVE-2019-13486 2 Debian, Xymon 2 Debian Linux, Xymon 2024-11-21 N/A
In Xymon through 4.3.28, a stack-based buffer overflow exists in the status-log viewer component because of   expansion in svcstatus.c.
CVE-2019-13485 2 Debian, Xymon 2 Debian Linux, Xymon 2024-11-21 N/A
In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the history viewer component via a long hostname or service parameter to history.c.
CVE-2019-13484 2 Debian, Xymon 2 Debian Linux, Xymon 2024-11-21 N/A
In Xymon through 4.3.28, a buffer overflow exists in the status-log viewer CGI because of   expansion in appfeed.c.
CVE-2019-13483 1 Auth0 1 Passport-sharepoint 2024-11-21 N/A
Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
CVE-2019-13482 1 Dlink 2 Dir-818lw, Dir-818lw Firmware 2024-11-21 8.8 High
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings.
CVE-2019-13481 1 Dlink 2 Dir-818lw, Dir-818lw Firmware 2024-11-21 8.8 High
An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MTU field to SetWanSettings.
CVE-2019-13478 1 Yoast 1 Yoast Seo 2024-11-21 9.8 Critical
The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.
CVE-2019-13477 1 Control-webpanel 1 Webpanel 2024-11-21 N/A
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account.
CVE-2019-13476 1 Control-webpanel 1 Webpanel 2024-11-21 N/A
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.
CVE-2019-13475 1 Mobatek 1 Mobaxterm 2024-11-21 N/A
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute arbitrary commands. The additional arguments -hideterm and -exitwhendone in the payload make the attack less visible.
CVE-2019-13474 1 Telestar 22 Bobs Rock Radio, Bobs Rock Radio Firmware, Dabman D10 and 19 more 2024-11-21 9.8 Critical
TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial i500-bt, and Imperial i600 TN81HH96-g102h-g102 devices have insufficient access control for the /set_dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands.
CVE-2019-13473 2 Auna, Telestar 24 Connect 100, Connect 100 Firmware, Bobs Rock Radio and 21 more 2024-11-21 9.8 Critical
TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial i500-bt, and Imperial i600 TN81HH96-g102h-g102 devices have an undocumented TELNET service within the BusyBox subsystem, leading to root access.
CVE-2019-13472 1 Phpwind 1 Phpwind 2024-11-21 N/A
PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file.
CVE-2019-13470 1 Matrixssl 1 Matrixssl 2024-11-21 N/A
MatrixSSL before 4.2.1 has an out-of-bounds read during ASN.1 handling.
CVE-2019-13467 2 Sandisk, Westerndigital 2 Ssd Dashboard, Ssd Dashboard 2024-11-21 5.9 Medium
Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute downloaded resources with arbitrary files.