Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (342055 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-16333 1 Get-simple 1 Getsimple Cms 2024-11-21 5.4 Medium
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
CVE-2019-16332 1 Api Bearer Auth Project 1 Api Bearer Auth 2024-11-21 6.1 Medium
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
CVE-2019-16330 1 Nchsoftware 1 Express Accounts Accounting 2024-11-21 5.4 Medium
In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript.
CVE-2019-16328 1 Rpyc Project 1 Rpyc 2024-11-21 7.5 High
In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
CVE-2019-16327 1 Dlink 2 Dir-601, Dir-601 Firmware 2024-11-21 9.8 Critical
D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. They do not check for authentication at the server side and rely on client-side validation, which is bypassable. NOTE: this is an end-of-life product.
CVE-2019-16326 1 Dlink 2 Dir-601, Dir-601 Firmware 2024-11-21 8.8 High
D-Link DIR-601 B1 2.00NA devices have CSRF because no anti-CSRF token is implemented. A remote attacker could exploit this in conjunction with CVE-2019-16327 to enable remote router management and device compromise. NOTE: this is an end-of-life product.
CVE-2019-16321 1 Scadabr 1 Scadabr 2024-11-21 6.1 Medium
ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO.
CVE-2019-16320 1 Cobham 22 Sailor 600 Vsat Ku, Sailor 600 Vsat Ku Firmware, Sailor 800 Vsat and 19 more 2024-11-21 5.3 Medium
Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude, via the public SNMP community.
CVE-2019-16319 3 Debian, Opensuse, Wireshark 3 Debian Linux, Leap, Wireshark 2024-11-21 7.5 High
In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-gryphon.c by checking for a message length of zero.
CVE-2019-16318 1 Pimcore 1 Pimcore 2024-11-21 8.8 High
In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
CVE-2019-16317 1 Pimcore 1 Pimcore 2024-11-21 8.8 High
In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.
CVE-2019-16314 1 Indexhibit 1 Indexhibit 2024-11-21 9.8 Critical
Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.
CVE-2019-16313 1 Ifw8 10 Fr5, Fr5-e, Fr5-e Firmware and 7 more 2024-11-21 7.5 High
ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.
CVE-2019-16312 1 S-cms 1 S-cms 2024-11-21 6.1 Medium
s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.
CVE-2019-16311 1 Niushop 1 Niushop 2024-11-21 8.8 High
NIUSHOP V1.11 has CSRF via search_info to index.php.
CVE-2019-16310 1 Niushop 1 Niushop 2024-11-21 5.4 Medium
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI.
CVE-2019-16309 1 Flamecms Project 1 Flamecms 2024-11-21 9.8 Critical
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.
CVE-2019-16307 1 Fujixerox 1 Docushare 2024-11-21 6.1 Medium
A Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp and deleteWebExMeetingCheck.jsp in Fuji Xerox DocuShare through 7.0.0.C1.609 allows remote attackers to inject arbitrary web script or HTML via the handle parameter (webExMeetingLogin.jsp) and meetingKey parameter (deleteWebExMeetingCheck.jsp).
CVE-2019-16305 2 Microsoft, Mobatek 2 Windows, Mobaxterm 2024-11-21 8.8 High
In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run MobaXterm to handle the link. If accepted, another popup appears asking for further confirmation. If this is also accepted, command execution is achieved, as demonstrated by the MobaXterm://`calc` URI.
CVE-2019-16303 1 Jhipster 2 Jhipster, Jhipster Kotlin 2024-11-21 9.8 Critical
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an insecure source of randomness (apache.commons.lang3 RandomStringUtils). This allows an attacker (if able to obtain their own password reset URL) to compute the value for all other password resets for other accounts, thus allowing privilege escalation or account takeover.