Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (330161 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-14957 1 Jetbrains 1 Vim 2024-11-21 5.3 Medium
The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository.
CVE-2019-14956 1 Jetbrains 1 Youtrack 2024-11-21 4.3 Medium
JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.
CVE-2019-14955 1 Jetbrains 1 Hub 2024-11-21 5.3 Medium
In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.
CVE-2019-14954 1 Jetbrains 1 Intellij Idea 2024-11-21 5.9 Medium
JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.
CVE-2019-14953 2 Jetbrains, Mozilla 2 Youtrack, Firefox 2024-11-21 6.1 Medium
JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.
CVE-2019-14952 1 Jetbrains 1 Youtrack 2024-11-21 6.1 Medium
JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.
CVE-2019-14951 1 Telenav 1 Scout Gps Link 2024-11-21 N/A
The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as demonstrated by a DrivingRestriction method call to uma/jsonrpc/mobile.
CVE-2019-14950 1 3cx 1 Live Chat 2024-11-21 N/A
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
CVE-2019-14949 1 Wpseeds 1 Wp Database Backup 2024-11-21 6.1 Medium
The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
CVE-2019-14948 1 Najeebmedia 1 Ppom For Woocommerce 2024-11-21 5.4 Medium
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
CVE-2019-14947 1 Ultimatemember 1 Ultimate Member 2024-11-21 N/A
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.
CVE-2019-14946 1 Ultimatemember 1 Ultimate Member 2024-11-21 N/A
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
CVE-2019-14945 1 Ultimatemember 1 Ultimate Member 2024-11-21 N/A
The ultimate-member plugin before 2.0.54 for WordPress has XSS.
CVE-2019-14943 1 Gitlab 1 Gitlab 2024-11-21 N/A
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials.
CVE-2019-14941 1 Ushareit 1 Shareit 2024-11-21 7.5 High
SHAREit through 4.0.6.177 does not check the body length from the received packet header (which is used to allocate memory for the next set of data). This could lead to a system denial of service due to uncontrolled memory allocation.
CVE-2019-14940 1 Spdk 1 Storage Performance Development Kit 2024-11-21 N/A
In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent invalid input.
CVE-2019-14939 1 Mysql Project 1 Mysql 2024-11-21 N/A
An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.
CVE-2019-14937 1 Vanderbilt 1 Redcap 2024-11-21 N/A
REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data.
CVE-2019-14936 1 Easyappointments 1 Easy\!appointments 2024-11-21 5.3 Medium
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).
CVE-2019-14935 2 3cx, Microsoft 2 3cx, Windows 2024-11-21 N/A
3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for Everyone, and leading to privilege escalation because of a StartUp link.