Search

Expected end of text, found '/' (at char 45), (line:1, col:46)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (361517 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-12745 1 Seeddms 1 Seeddms 2024-11-21 N/A
out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.
CVE-2019-12744 1 Seeddms 1 Seeddms 2024-11-21 N/A
SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940.
CVE-2019-12743 1 Humhub 1 Social Network Kit 2024-11-21 N/A
HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (including self-hosted ones) by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure.
CVE-2019-12742 1 Bludit 1 Bludit 2024-11-21 N/A
Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter).
CVE-2019-12741 1 Fhir 1 Hapi Fhir 2024-11-21 N/A
XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)
CVE-2019-12739 1 Nextcloud 1 Extract 2024-11-21 N/A
lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters).
CVE-2019-12737 1 Jetbrains 1 Ktor 2024-11-21 5.3 Medium
UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.
CVE-2019-12736 1 Jetbrains 1 Ktor 2024-11-21 9.8 Critical
JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection.
CVE-2019-12734 1 Sitevision 1 Sitevision 2024-11-21 8.8 High
SiteVision 4 has Incorrect Access Control.
CVE-2019-12733 1 Sitevision 1 Sitevision 2024-11-21 8.8 High
SiteVision 4 allows Remote Code Execution.
CVE-2019-12732 1 Chartkick Project 1 Chartkick 2024-11-21 N/A
The Chartkick gem through 3.1.0 for Ruby allows XSS.
CVE-2019-12731 2 Microsoft, Mikogo 2 Windows, Mikogo 2024-11-21 N/A
The Windows versions of Snapview Mikogo, versions before 5.10.2 are affected by insecure implementations which allow local attackers to escalate privileges.
CVE-2019-12730 1 Ffmpeg 1 Ffmpeg 2024-11-21 N/A
aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables.
CVE-2019-12728 1 Grails 1 Grails 2024-11-21 8.1 High
Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP.
CVE-2019-12727 1 Ui 2 Aircam, Aircam Firmware 2024-11-21 N/A
On Ubiquiti airCam 3.1.4 devices, a Denial of Service vulnerability exists in the RTSP Service provided by the ubnt-streamer binary. The issue can be triggered via malformed RTSP requests that lead to an invalid memory read. To exploit the vulnerability, an attacker must craft an RTSP request with a large number of headers.
CVE-2019-12725 1 Zeroshell 1 Zeroshell 2024-11-21 N/A
Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.
CVE-2019-12724 1 Teclib-edition 1 News 2024-11-21 6.1 Medium
An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS attack via the $_POST['name'] parameter.
CVE-2019-12723 1 Teclib-edition 1 Fields 2024-11-21 N/A
An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user.
CVE-2019-12720 1 Auo 1 Sunveillance Monitoring System \& Data Recorder 2024-11-21 7.5 High
AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvc_send_mail.aspx (MailAdd parameter) SQL Injection. An Attacker can carry a SQL Injection payload to the server, allowing the attacker to read privileged data. This also affects the picture_manage_mvc.aspx plant_no parameter, the swapdl_mvc.aspx plant_no parameter, and the account_management.aspx Text_Postal_Code and Text_Dis_Code parameters.
CVE-2019-12719 1 Auo 1 Sunveillance Monitoring System \& Data Recorder 2024-11-21 9.8 Critical
An issue was discovered in Picture_Manage_mvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e. There is an incorrect access control vulnerability that can allow an unauthenticated user to upload files via a modified authority parameter.