Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (322297 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-15330 1 Webp Express Project 1 Webp Express 2024-11-21 N/A
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.
CVE-2019-15329 1 Codection 1 Import Users From Csv With Meta 2024-11-21 N/A
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
CVE-2019-15328 1 Codection 1 Import Users From Csv With Meta 2024-11-21 N/A
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
CVE-2019-15327 1 Codection 1 Import Users From Csv With Meta 2024-11-21 N/A
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
CVE-2019-15326 1 Codection 1 Import Users From Csv With Meta 2024-11-21 N/A
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
CVE-2019-15325 1 Galliumos 1 Galliumos 2024-11-21 N/A
In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, which might increase risk because of the appearance that a protection mechanism is present when actually it is not.
CVE-2019-15324 1 Ad Inserter Project 1 Ad Inserter 2024-11-21 N/A
The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.
CVE-2019-15323 1 Ad Inserter Project 1 Ad Inserter 2024-11-21 7.5 High
The ad-inserter plugin before 2.4.20 for WordPress has path traversal.
CVE-2019-15322 1 Wpmadeasy 1 Shortcode Factory 2024-11-21 N/A
The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.
CVE-2019-15321 1 Optiontree Project 1 Optiontree 2024-11-21 N/A
The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.
CVE-2019-15320 1 Optiontree Project 1 Optiontree 2024-11-21 N/A
The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.
CVE-2019-15319 1 Optiontree Project 1 Optiontree 2024-11-21 N/A
The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.
CVE-2019-15318 1 Yikesinc 1 Easy Forms For Mailchimp 2024-11-21 N/A
The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.
CVE-2019-15317 1 Givewp 1 Givewp 2024-11-21 N/A
The give plugin before 2.4.7 for WordPress has XSS via a donor name.
CVE-2019-15316 2 Microsoft, Valvesoftware 2 Windows, Steam Client 2024-11-21 N/A
Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.
CVE-2019-15315 2 Microsoft, Valvesoftware 2 Windows, Steam Client 2024-11-21 N/A
Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch.
CVE-2019-15314 1 Tiki 1 Tikiwiki Cms\/groupware 2024-11-21 N/A
tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI.
CVE-2019-15313 1 Zimbra 1 Collaboration Server 2024-11-21 6.1 Medium
In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability.
CVE-2019-15312 1 Linkplay 1 Linkplay 2024-11-21 8.8 High
An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is a Zolo Halo DNS rebinding attack. The device was found to be vulnerable to DNS rebinding. Combined with one of the many /httpapi.asp endpoint command-execution security issues, the DNS rebinding attack could allow an attacker to compromise the victim device from the Internet.
CVE-2019-15311 1 Linkplay 1 Linkplay 2024-11-21 9.8 Critical
An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command execution vulnerabilities.