Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323565 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-19848 1 Typo3 1 Typo3 2024-11-21 7.2 High
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
CVE-2019-19847 1 Libspiro Project 1 Libspiro 2024-11-21 8.1 High
Libspiro through 20190731 has a stack-based buffer overflow in the spiro_to_bpath0() function in spiro.c.
CVE-2019-19846 1 Joomla 1 Joomla\! 2024-11-21 9.8 Critical
In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors.
CVE-2019-19845 1 Joomla 1 Joomla\! 2024-11-21 5.3 Medium
In Joomla! before 3.9.14, a missing access check in framework files could lead to a path disclosure.
CVE-2019-19844 2 Canonical, Djangoproject 2 Ubuntu Linux, Django 2024-11-21 9.8 Critical
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
CVE-2019-19843 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 9.8 Critical
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.
CVE-2019-19842 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 9.8 Critical
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-analysis to admin/_cmdstat.jsp via the mac attribute.
CVE-2019-19841 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 9.8 Critical
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to admin/_cmdstat.jsp via the mac attribute.
CVE-2019-19840 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 9.8 Critical
A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via an unauthenticated HTTP request.
CVE-2019-19839 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 9.8 Critical
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/_cmdstat.jsp via the uploadFile attribute.
CVE-2019-19838 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 9.8 Critical
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/_cmdstat.jsp via the uploadFile attribute.
CVE-2019-19837 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 5.3 Medium
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.
CVE-2019-19836 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 9.8 Critical
AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp to write to a specified filename.
CVE-2019-19835 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 7.5 High
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.
CVE-2019-19834 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 7.2 High
Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via enable->debug->script->exec with ../../../bin/sh as the parameter.
CVE-2019-19833 1 Tautulli 1 Tautulli 2024-11-21 6.5 Medium
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).
CVE-2019-19832 1 Xerox 2 Altalink C8035, Altalink C8035 Firmware 2024-11-21 8.8 High
Xerox AltaLink C8035 printers allow CSRF. A request to add users is made in the Device User Database form field to the xerox.set URI. (The frmUserName value must have a unique name.)
CVE-2019-19830 3 Canonical, Debian, Spip 3 Ubuntu Linux, Debian Linux, Spip 2024-11-21 6.5 Medium
_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database.
CVE-2019-19829 1 Solarwinds 1 Serv-u Ftp Server 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability than CVE-2018-19934 and CVE-2019-13182.
CVE-2019-19826 1 Drupal 1 Views Dynamic Field 2024-11-21 9.8 Critical
The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demonstrated by PHP object injection, involving a field_names object and an Archive_Tar object, for file deletion. Code execution might also be possible.