Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16941 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-20060 1 Mfscripts 1 Yetishare 2024-11-21 7.5 High
MFScripts YetiShare v3.5.2 through v4.5.4 places sensitive information in the Referer header. If this leaks, then third parties may discover password-reset hashes, file-delete links, or other sensitive information.
CVE-2019-20055 1 Liquidpixels 1 Liquifire Os 2024-11-21 6.5 Medium
LuquidPixels LiquiFire OS 4.8.0 allows SSRF via the call%3Durl substring followed by a URL in square brackets.
CVE-2019-1872 1 Cisco 1 Telepresence Video Communication Server 2024-11-21 N/A
A vulnerability in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Series software could allow an unauthenticated, remote attacker to cause an affected system to send arbitrary network requests. The vulnerability is due to improper restrictions on network services in the affected software. An attacker could exploit this vulnerability by sending malicious requests to the affected system. A successful exploit could allow the attacker to send arbitrary network requests sourced from the affected system.
CVE-2019-1577 1 Paloaltonetworks 1 Traps 2024-11-21 N/A
Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML.
CVE-2019-1462 1 Microsoft 3 Office, Office 365 Proplus, Powerpoint 2024-11-21 7.8 High
A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft PowerPoint Remote Code Execution Vulnerability'.
CVE-2019-1254 1 Microsoft 3 Windows 10, Windows Server 2016, Windows Server 2019 2024-11-21 5.5 Medium
An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information Disclosure Vulnerability'.
CVE-2019-19999 1 Halo 1 Halo 2024-11-21 7.2 High
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
CVE-2019-19947 4 Canonical, Debian, Linux and 1 more 13 Ubuntu Linux, Debian Linux, Linux Kernel and 10 more 2024-11-21 4.6 Medium
In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c.
CVE-2019-19909 1 Sfu 1 Open Journal System 2024-11-21 8.8 High
An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.
CVE-2019-19835 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 7.5 High
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.
CVE-2019-19766 1 Bitwarden 1 Server 2024-11-21 7.5 High
The Bitwarden server through 1.32.0 has a potentially unwanted KDF.
CVE-2019-19735 1 Mfscripts 1 Yetishare 2024-11-21 9.1 Critical
class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to guess the hash and set the password within a few hours by bruteforcing.
CVE-2019-19561 1 Harman 1 Hermes 2024-11-21 2.4 Low
A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
CVE-2019-19557 1 Harman 1 Hermes 2024-11-21 2.4 Low
A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
CVE-2019-19553 4 Debian, Opensuse, Oracle and 1 more 5 Debian Linux, Leap, Solaris and 2 more 2024-11-21 7.5 High
In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object identifier is set to NULL after a ContentInfo dissection.
CVE-2019-19536 3 Debian, Linux, Opensuse 3 Debian Linux, Linux Kernel, Leap 2024-11-21 4.6 Medium
In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver, aka CID-ead16e53c2f0.
CVE-2019-19535 4 Debian, Linux, Opensuse and 1 more 4 Debian Linux, Linux Kernel, Leap and 1 more 2024-11-21 4.6 Medium
In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042.
CVE-2019-19534 4 Canonical, Debian, Linux and 1 more 5 Ubuntu Linux, Debian Linux, Linux Kernel and 2 more 2024-11-21 2.4 Low
In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29.
CVE-2019-19502 1 Maleck 1 Image Uploader And Browser For Ckeditor 2024-11-21 9.8 Critical
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.
CVE-2019-19450 3 Debian, Redhat, Reportlab 7 Debian Linux, Enterprise Linux, Rhel Aus and 4 more 2024-11-21 9.8 Critical
paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.