Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (322949 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-12567 1 Open Tftp Server Project 1 Open Tftp Server 2024-11-21 9.8 Critical
Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via a long TFTP error packet, a different vulnerability than CVE-2018-10387 and CVE-2019-12568.
CVE-2019-12566 1 Veronalabs 1 Wp Statistics 2024-11-21 N/A
The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user.
CVE-2019-12564 1 Douco 1 Douphp 2024-11-21 N/A
In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sql filenames.
CVE-2019-12562 1 Dnnsoftware 1 Dotnetnuke 2024-11-21 6.1 Medium
Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting.
CVE-2019-12555 1 Sweetscape 1 010 Editor 2024-11-21 N/A
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the SubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.
CVE-2019-12554 1 Sweetscape 1 010 Editor 2024-11-21 N/A
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the WSubStr function (provided by the scripting engine) allows an attacker to cause a denial of service by crashing the application.
CVE-2019-12553 1 Sweetscape 1 010 Editor 2024-11-21 N/A
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the StrCat function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
CVE-2019-12552 1 Sweetscape 1 010 Editor 2024-11-21 N/A
In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service.
CVE-2019-12551 1 Sweetscape 1 010 Editor 2024-11-21 N/A
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
CVE-2019-12550 1 Wago 6 852-1305, 852-1305 Firmware, 852-1505 and 3 more 2024-11-21 N/A
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TELNET.
CVE-2019-12549 1 Wago 6 852-1305, 852-1305 Firmware, 852-1505 and 3 more 2024-11-21 N/A
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches the embedded private key.
CVE-2019-12548 1 Bludit 1 Bludit 2024-11-21 N/A
Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo.
CVE-2019-12543 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.
CVE-2019-12542 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.
CVE-2019-12541 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter.
CVE-2019-12540 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.
CVE-2019-12539 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 6.1 Medium
An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field, a different vulnerability than CVE-2019-12189.
CVE-2019-12538 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 N/A
An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field.
CVE-2019-12537 1 Zohocorp 1 Manageengine Assetexplorer 2024-11-21 6.1 Medium
An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.
CVE-2019-12532 1 Insyde 6 H2oelv, H2offt, H2ooae and 3 more 2024-11-21 7.8 High
Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08.