Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (36478 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-12470 2 Debian, Mediawiki 2 Debian Linux, Mediawiki 2024-11-21 N/A
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
CVE-2019-12469 2 Debian, Mediawiki 2 Debian Linux, Mediawiki 2024-11-21 N/A
MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
CVE-2019-12465 1 Librenms 1 Librenms 2024-11-21 8.1 High
An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajax_rulesuggest.php?debug=1&term= request.
CVE-2019-12419 3 Apache, Oracle, Redhat 8 Cxf, Commerce Guided Search, Enterprise Manager Base Platform and 5 more 2024-11-21 9.8 Critical
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
CVE-2019-12402 4 Apache, Fedoraproject, Oracle and 1 more 20 Commons Compress, Fedora, Banking Payments and 17 more 2024-11-21 7.5 High
The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
CVE-2019-12385 1 Ampache 1 Ampache 2024-11-21 N/A
An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality.
CVE-2019-12374 1 Ivanti 1 Landesk Management Suite 2024-11-21 N/A
A SQL Injection vulnerability exists in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 due to improper username sanitization in the Basic Authentication implementation in core/provisioning.secure/ProvisioningSecure.asmx in Provisioning.Secure.dll.
CVE-2019-12372 1 Petraware 1 Ptransformer Adc 2024-11-21 N/A
Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.
CVE-2019-12359 1 Zzcms 1 Zzcms 2024-11-21 7.2 High
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyan_sendmail.php (when the attacker has admin authority) via the id parameter.
CVE-2019-12358 1 Zzcms 1 Zzcms 2024-11-21 8.8 High
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendsms.php (when the attacker has dls_print authority) via a dlid cookie.
CVE-2019-12357 1 Zzcms 1 Zzcms 2024-11-21 7.2 High
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php (when the attacker has admin authority) via the id parameter.
CVE-2019-12356 1 Zzcms 1 Zzcms 2024-11-21 8.8 High
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_download.php (when the attacker has dls_download authority) via the id parameter.
CVE-2019-12355 1 Zzcms 1 Zzcms 2024-11-21 8.8 High
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_print.php (when the attacker has dls_print authority) via the id parameter.
CVE-2019-12354 1 Zzcms 1 Zzcms 2024-11-21 7.2 High
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php (when the attacker has admin authority) via the id parameter.
CVE-2019-12353 1 Zzcms 1 Zzcms 2024-11-21 7.2 High
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dl_sendmail.php (when the attacker has admin authority) via the id parameter.
CVE-2019-12352 1 Zzcms 1 Zzcms 2024-11-21 8.8 High
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendmail.php (when the attacker has dls_print authority) via a dlid cookie.
CVE-2019-12351 1 Zzcms 1 Zzcms 2024-11-21 9.8 Critical
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_print.php via an id parameter value with a trailing comma.
CVE-2019-12350 1 Zzcms 1 Zzcms 2024-11-21 9.8 Critical
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_download.php via an id parameter value with a trailing comma.
CVE-2019-12349 1 Zzcms 1 Zzcms 2024-11-21 9.8 Critical
An issue was discovered in zzcms 2019. SQL Injection exists in /admin/dl_sendsms.php via the id parameter.
CVE-2019-12348 1 Zzcms 1 Zzcms 2024-11-21 9.8 Critical
An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter.