Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323536 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-13416 1 Search-guard 1 Search Guard 2024-11-21 6.5 Medium
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s).
CVE-2019-13415 1 Search-guard 1 Search Guard 2024-11-21 6.5 Medium
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see.
CVE-2019-13414 1 Boiteasite 1 Rencontre 2024-11-21 6.1 Medium
The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.
CVE-2019-13413 1 Boiteasite 1 Rencontre 2024-11-21 9.8 Critical
The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.
CVE-2019-13412 1 Hinet 2 Gpon, Gpon Firmware 2024-11-21 9.3 Critical
A service which is hosted on port 3097 in HiNet GPON firmware < I040GWR190731 allows an attacker to execute a specific command to read arbitrary files. CVSS 3.0 Base score 9.3. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L).
CVE-2019-13411 1 Hinet 2 Gpon, Gpon Firmware 2024-11-21 10 Critical
An “invalid command” handler issue was discovered in HiNet GPON firmware < I040GWR190731. It allows an attacker to execute arbitrary command through port 3097. CVSS 3.0 Base score 10.0. CVSS vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVE-2019-13410 1 Topmeeting 1 Topmeeting 2024-11-21 7.5 High
TOPMeeting before version 8.8 (2019/08/19) shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page.
CVE-2019-13409 1 Topmeeting 1 Topmeeting 2024-11-21 9.8 Critical
A SQL injection vulnerability was discovered in TOPMeeting before version 8.8 (2019/08/19). An attacker can use a union based injection query string though a search meeting room feature to get databases schema and username/password.
CVE-2019-13408 2 Androvideo, Geovision 6 Vd 1, Vd 1 Firmware, Gv-vd8700 and 3 more 2024-11-21 7.5 High
A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication.
CVE-2019-13407 2 Androvideo, Geovision 6 Vd 1, Vd 1 Firmware, Gv-vd8700 and 3 more 2024-11-21 N/A
A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.
CVE-2019-13406 1 Androvideo 2 Vd 1, Vd 1 Firmware 2024-11-21 N/A
A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication.
CVE-2019-13405 1 Androvideo 2 Vd 1, Vd 1 Firmware 2024-11-21 N/A
A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software.
CVE-2019-13404 2 Microsoft, Python 2 Windows, Python 2024-11-21 N/A
The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x
CVE-2019-13403 1 Temenos 1 Cwx 2024-11-21 N/A
Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information.
CVE-2019-13402 1 Fortinet 2 Fcm-mb40, Fcm-mb40 Firmware 2024-11-21 N/A
/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.
CVE-2019-13401 1 Fortinet 2 Fcm-mb40, Fcm-mb40 Firmware 2024-11-21 N/A
Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.
CVE-2019-13400 1 Fortinet 2 Fcm-mb40, Fcm-mb40 Firmware 2024-11-21 N/A
Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.
CVE-2019-13399 1 Fortinet 2 Fcm-mb40, Fcm-mb40 Firmware 2024-11-21 N/A
Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation.
CVE-2019-13398 1 Fortinet 2 Fcm-mb40, Fcm-mb40 Firmware 2024-11-21 N/A
Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.
CVE-2019-13397 1 Enhancesoft 1 Osticket 2024-11-21 N/A
Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket.