Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (347467 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-9842 1 Miniblog Project 1 Miniblog 2024-11-21 N/A
madskristensen MiniBlog through 2018-05-18 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in app_code/handlers/PostHandler.cs writes a decoded base64 string to a file without validating the extension.
CVE-2019-9841 1 Vestacp 1 Control Panel 2024-11-21 N/A
Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.
CVE-2019-9839 1 Vfront 1 Vfront 2024-11-21 N/A
VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.
CVE-2019-9838 1 Vfront 1 Vfront 2024-11-21 N/A
VFront 0.99.5 has stored XSS via the admin/sync_reg_tab.php azzera parameter, which is mishandled during admin/error_log.php rendering.
CVE-2019-9837 1 Openid 1 Openid Connect 2024-11-21 N/A
Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.
CVE-2019-9836 2 Amd, Opensuse 16 Epyc 7251, Epyc 7261, Epyc 7281 and 13 more 2024-11-21 5.3 Medium
Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) Platform Security Processor (PSP; aka AMD Secure Processor or AMD-SP) 0.17 build 11 and earlier has an insecure cryptographic implementation.
CVE-2019-9835 1 Fujitsu 4 Gk900, Gk900 Firmware, Lx901 and 1 more 2024-11-21 N/A
The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. This occurs because it accepts unencrypted 2.4 GHz packets, even though all legitimate communication uses AES encryption.
CVE-2019-9834 1 Netdata 1 Netdata 2024-11-21 N/A
The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot
CVE-2019-9833 1 Screen Stream Project 1 Screen Stream 2024-11-21 N/A
The Screen Stream application through 3.0.15 for Android allows remote attackers to cause a denial of service via many simultaneous /start-stop requests.
CVE-2019-9832 1 Airdrop Project 1 Airdrop 2024-11-21 N/A
The AirDrop application through 2.0 for Android allows remote attackers to cause a denial of service via a client that makes many socket connections through a configured port.
CVE-2019-9831 1 Airmore 1 Airmore 2024-11-21 N/A
The AirMore application through 1.6.1 for Android allows remote attackers to cause a denial of service (system hang) via many simultaneous /?Key=PhoneRequestAuthorization requests.
CVE-2019-9829 1 Maccms 1 Maccms 2024-11-21 N/A
Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates.
CVE-2019-9827 2 Hawt, Redhat 4 Hawtio, Amq Broker, Jboss Amq and 1 more 2024-11-21 N/A
Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
CVE-2019-9826 1 Phpbb 1 Phpbb 2024-11-21 N/A
The fulltext search component in phpBB before 3.2.6 allows Denial of Service.
CVE-2019-9825 1 Feifeicms 1 Feifeicms 2024-11-21 N/A
FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file extensions, as demonstrated by adding php to the default jpg,gif,png,jpeg setting, and then using the "add article" feature.
CVE-2019-9824 2 Qemu, Redhat 4 Qemu, Enterprise Linux, Openstack and 1 more 2024-11-21 N/A
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.
CVE-2019-9823 1 Jetbrains 1 Intellij Idea 2024-11-21 N/A
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2018.3.5, 2018.2.8, 2018.1.8.
CVE-2019-9821 1 Mozilla 1 Firefox 2024-11-21 N/A
A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. This vulnerability affects Firefox < 67.
CVE-2019-9820 2 Mozilla, Redhat 4 Firefox, Firefox Esr, Thunderbird and 1 more 2024-11-21 N/A
A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVE-2019-9819 2 Mozilla, Redhat 4 Firefox, Firefox Esr, Thunderbird and 1 more 2024-11-21 N/A
A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.