Export limit exceeded: 363331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (363331 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-25016 | 1 Opendoas Project | 1 Opendoas | 2024-11-21 | 8.8 High |
| In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue. | ||||
| CVE-2019-25015 | 1 Openwrt | 1 Openwrt | 2024-11-21 | 5.4 Medium |
| LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID. | ||||
| CVE-2019-25014 | 2 Istio, Redhat | 3 Istio, Openshift Service Mesh, Service Mesh | 2024-11-21 | 6.5 Medium |
| A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic (resulting in a denial of service to the istio-pilot application). | ||||
| CVE-2019-25012 | 1 Webform Report Project | 1 Webform Report | 2024-11-21 | 7.5 High |
| The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. NOTE: This project is not covered by Drupal's security advisory policy. | ||||
| CVE-2019-25011 | 1 Netbox | 1 Netbox | 2024-11-21 | 5.4 Medium |
| NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments. | ||||
| CVE-2019-25010 | 1 Failure Project | 1 Failure | 2024-11-21 | 9.8 Critical |
| An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden. | ||||
| CVE-2019-25009 | 1 Hyper | 1 Http | 2024-11-21 | 9.8 Critical |
| An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness. | ||||
| CVE-2019-25007 | 1 Streebog Project | 1 Streebog | 2024-11-21 | 7.5 High |
| An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic. | ||||
| CVE-2019-25006 | 1 Streebog Project | 1 Streebog | 2024-11-21 | 7.5 High |
| An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer. | ||||
| CVE-2019-25005 | 1 Chacha20 Project | 1 Chacha20 | 2024-11-21 | 7.5 High |
| An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext. | ||||
| CVE-2019-25004 | 1 Google | 1 Flatbuffers | 2024-11-21 | 9.8 Critical |
| An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness. | ||||
| CVE-2019-25003 | 1 Parity | 1 Libsecp256k1 | 2024-11-21 | 7.5 High |
| An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers can obtain sensitive information. | ||||
| CVE-2019-25002 | 1 Sodiumoxide Project | 1 Sodiumoxide | 2024-11-21 | 9.8 Critical |
| An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties. | ||||
| CVE-2019-25001 | 1 Serde Cbor Project | 1 Serde Cbor | 2024-11-21 | 7.5 High |
| An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags. | ||||
| CVE-2019-20934 | 2 Linux, Redhat | 6 Linux Kernel, Enterprise Linux, Rhel Aus and 3 more | 2024-11-21 | 5.3 Medium |
| An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c. | ||||
| CVE-2019-20933 | 2 Debian, Influxdata | 2 Debian Linux, Influxdb | 2024-11-21 | 9.8 Critical |
| InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret). | ||||
| CVE-2019-20925 | 1 Mongodb | 1 Mongodb | 2024-11-21 | 7.5 High |
| An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectly allocate memory. This issue affects MongoDB Server v4.2 versions prior to 4.2.1; MongoDB Server v4.0 versions prior to 4.0.13; MongoDB Server v3.6 versions prior to 3.6.15 and MongoDB Server v3.4 versions prior to 3.4.24. | ||||
| CVE-2019-20924 | 1 Mongodb | 1 Mongodb | 2024-11-21 | 6.5 Medium |
| A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects MongoDB Server v4.2 versions prior to 4.2.2. | ||||
| CVE-2019-20923 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2024-11-21 | 6.5 Medium |
| A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects MongoDB Server v4.0 versions prior to 4.0.7. | ||||
| CVE-2019-20922 | 2 Handlebarsjs, Redhat | 5 Handlebars, Jboss Enterprise Bpms Platform, Openshift and 2 more | 2024-11-21 | 7.5 High |
| Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources. | ||||