Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323565 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-14535 2 Debian, Videolan 2 Debian Linux, Vlc Media Player 2024-11-21 N/A
A divide-by-zero error exists in the SeekIndex function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted WMV file.
CVE-2019-14534 2 Debian, Videolan 2 Debian Linux, Vlc Media Player 2024-11-21 N/A
In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service attack.
CVE-2019-14533 2 Debian, Videolan 2 Debian Linux, Vlc Media Player 2024-11-21 N/A
The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
CVE-2019-14532 2 Fedoraproject, Sleuthkit 2 Fedora, The Sleuth Kit 2024-11-21 9.8 Critical
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
CVE-2019-14531 1 Sleuthkit 1 The Sleuth Kit 2024-11-21 N/A
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an out of bounds read on iso9660 while parsing System Use Sharing Protocol data in fs/iso9660.c.
CVE-2019-14530 1 Open-emr 1 Openemr 2024-11-21 8.8 High
An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
CVE-2019-14529 1 Open-emr 1 Openemr 2024-11-21 9.8 Critical
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.
CVE-2019-14528 1 Gnucobol Project 1 Gnucobol 2024-11-21 N/A
GnuCOBOL 2.2 has a heap-based buffer overflow in read_literal in cobc/scanner.l via crafted COBOL source code.
CVE-2019-14527 1 Netgear 2 Mr1100, Mr1100 Firmware 2024-11-21 N/A
An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, after authentication.
CVE-2019-14526 1 Netgear 2 Mr1100, Mr1100 Firmware 2024-11-21 N/A
An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entirely bypasses the intended security benefits of the use of a CSRF-protection token.
CVE-2019-14525 1 Octopus 2 Octopus Deploy, Octopus Server 2024-11-21 N/A
In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call.
CVE-2019-14524 2 Opensuse, Schismtracker 3 Backports, Leap, Schism Tracker 2024-11-21 7.8 High
An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt_mtm_load_song in fmt/mtm.c, a different vulnerability than CVE-2019-14465.
CVE-2019-14523 1 Schismtracker 1 Schism Tracker 2024-11-21 7.8 High
An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
CVE-2019-14521 1 Emca 1 Energy Logserver 2024-11-21 N/A
The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter.
CVE-2019-14518 1 Modx 1 Evolution Cms 2024-11-21 N/A
Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the "access policy in the administration panel.
CVE-2019-14517 1 Editor.md Project 1 Editor.md 2024-11-21 N/A
pandao Editor.md 1.5.0 allows XSS via the Javascript: string.
CVE-2019-14516 1 Uidai 1 Maadhaar 2024-11-21 N/A
The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs or Help.
CVE-2019-14514 1 Microvirt 1 Memu 2024-11-21 9.8 Critical
An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup (this is unrelated to Red Hat's systemd init program, and is a closed-source proprietary tool that seems to be developed by Microvirt). This program opens TCP port 21509, presumably to receive installation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated directly into a system() call, it is possible to execute arbitrary commands by supplying shell metacharacters.
CVE-2019-14513 3 Debian, Redhat, Thekelleys 3 Debian Linux, Enterprise Linux, Dnsmasq 2024-11-21 7.5 High
Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.
CVE-2019-14512 1 Limesurvey 1 Limesurvey 2024-11-21 6.1 Medium
LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.