Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (328797 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-12323 1 Hostingcontroller 1 Hc10 2024-11-21 N/A
The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS.
CVE-2019-12315 1 Samsung 2 Scx-824, Scx-824 Firmware 2024-11-21 N/A
Samsung SCX-824 printers allow a reflected Cross-Site-Scripting (XSS) vulnerability that can be triggered by using the "print from file" feature, as demonstrated by the sws/swsAlert.sws?popupid=successMsg msg parameter.
CVE-2019-12314 1 Deltek 1 Maconomy 2024-11-21 N/A
Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI.
CVE-2019-12313 1 Dollarshaveclub 1 Shave 2024-11-21 N/A
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
CVE-2019-12312 2 Libreswan, Redhat 2 Libreswan, Enterprise Linux 2024-11-21 N/A
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.
CVE-2019-12311 1 Sandline 1 Centraleyezer 2024-11-21 6.1 Medium
Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template, the script is loaded.
CVE-2019-12310 1 Exagrid 2 Backup Appliance, Backup Appliance Firmware 2024-11-21 N/A
ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remote attackers to view and retrieve verbose logging information. Files within this directory were observed to contain sensitive run-time information, including Base64 encoded 'support' credentials, leading to administrative access of the device.
CVE-2019-12309 1 Dotcms 1 Dotcms 2024-11-21 N/A
dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction of a ZIP archive.
CVE-2019-12308 1 Djangoproject 1 Django 2024-11-21 N/A
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
CVE-2019-12305 1 Actions-micro 2 Ezcast Pro Ii, Ezcast Pro Ii Firmware 2024-11-21 6.5 Medium
In EZCast Pro II, the administrator password md5 hash is provided upon a web request. This hash can be cracked to access the administration panel of the device.
CVE-2019-12303 1 Suse 1 Rancher 2024-11-21 N/A
In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.
CVE-2019-12301 1 Percona 1 Percona Server 2024-11-21 N/A
The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffered an issue where the server would reset the root password to a blank value upon an upgrade. This was fixed in 5.6.44-85.0-2.
CVE-2019-12300 1 Buildbot 1 Buildbot 2024-11-21 N/A
Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.
CVE-2019-12299 1 Sandline 1 Centraleyezer 2024-11-21 6.1 Medium
Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section.
CVE-2019-12298 1 Leanify Project 1 Leanify 2024-11-21 N/A
Leanify 0.4.3 allows remote attackers to trigger an out-of-bounds write (1024 bytes) via a modified input file.
CVE-2019-12297 1 Motorola 4 Cx2, Cx2 Firmware, M2 and 1 more 2024-11-21 N/A
An issue was discovered in scopd on Motorola routers CX2 1.01 and M2 1.01. There is a Use of an Externally Controlled Format String, reachable via TCP port 8010 or UDP port 8080.
CVE-2019-12295 4 Canonical, Debian, F5 and 1 more 16 Ubuntu Linux, Debian Linux, Big-ip Access Policy Manager and 13 more 2024-11-21 7.5 High
In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14, the dissection engine could crash. This was addressed in epan/packet.c by restricting the number of layers and consequently limiting recursion.
CVE-2019-12293 2 Freedesktop, Redhat 2 Poppler, Enterprise Linux 2024-11-21 N/A
In Poppler through 0.76.1, there is a heap-based buffer over-read in JPXStream::init in JPEG2000Stream.cc via data with inconsistent heights or widths.
CVE-2019-12292 1 Citrix 1 Appdna 2024-11-21 N/A
Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control.
CVE-2019-12291 1 Hashicorp 1 Consul 2024-11-21 N/A
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.