Export limit exceeded: 404425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17034 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-19999 1 Halo 1 Halo 2024-11-21 7.2 High
Halo before 1.2.0-beta.1 allows Server Side Template Injection (SSTI) because TemplateClassResolver.SAFER_RESOLVER is not used in the FreeMarker configuration.
CVE-2019-19947 4 Canonical, Debian, Linux and 1 more 13 Ubuntu Linux, Debian Linux, Linux Kernel and 10 more 2024-11-21 4.6 Medium
In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c.
CVE-2019-19909 1 Sfu 1 Open Journal System 2024-11-21 8.8 High
An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.
CVE-2019-19835 1 Ruckuswireless 17 C110, E510, H320 and 14 more 2024-11-21 7.5 High
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.
CVE-2019-19766 1 Bitwarden 1 Server 2024-11-21 7.5 High
The Bitwarden server through 1.32.0 has a potentially unwanted KDF.
CVE-2019-19735 1 Mfscripts 1 Yetishare 2024-11-21 9.1 Critical
class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to guess the hash and set the password within a few hours by bruteforcing.
CVE-2019-19561 1 Harman 1 Hermes 2024-11-21 2.4 Low
A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
CVE-2019-19557 1 Harman 1 Hermes 2024-11-21 2.4 Low
A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
CVE-2019-19553 4 Debian, Opensuse, Oracle and 1 more 5 Debian Linux, Leap, Solaris and 2 more 2024-11-21 7.5 High
In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/asn1/cms/packet-cms-template.c by ensuring that an object identifier is set to NULL after a ContentInfo dissection.
CVE-2019-19536 3 Debian, Linux, Opensuse 3 Debian Linux, Linux Kernel, Leap 2024-11-21 4.6 Medium
In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_pro.c driver, aka CID-ead16e53c2f0.
CVE-2019-19535 4 Debian, Linux, Opensuse and 1 more 4 Debian Linux, Linux Kernel, Leap and 1 more 2024-11-21 4.6 Medium
In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042.
CVE-2019-19534 4 Canonical, Debian, Linux and 1 more 5 Ubuntu Linux, Debian Linux, Linux Kernel and 2 more 2024-11-21 2.4 Low
In the Linux kernel before 5.3.11, there is an info-leak bug that can be caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver, aka CID-f7a1337f0d29.
CVE-2019-19502 1 Maleck 1 Image Uploader And Browser For Ckeditor 2024-11-21 9.8 Critical
Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated users to execute arbitrary PHP code.
CVE-2019-19450 3 Debian, Redhat, Reportlab 7 Debian Linux, Enterprise Linux, Rhel Aus and 4 more 2024-11-21 9.8 Critical
paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.
CVE-2019-19261 1 Gitlab 1 Gitlab 2024-11-21 8.8 High
GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF.
CVE-2019-19240 1 Embedthis 1 Goahead 2024-11-21 5.3 Medium
Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak uninitialized data in a response.
CVE-2019-19208 1 Codiad 1 Codiad 2024-11-21 9.8 Critical
Codiad Web IDE through 2.8.4 allows PHP Code injection.
CVE-2019-19089 1 Hitachienergy 1 Esoms 2024-11-21 6.1 Medium
For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted and displayed as different content type other than declared. A possible attack scenario would be unauthorized code execution via text interpreted as JavaScript.
CVE-2019-19010 2 Fedoraproject, Limnoria Project 2 Fedora, Limnoria 2024-11-21 9.8 Critical
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
CVE-2019-18889 2 Fedoraproject, Sensiolabs 2 Fedora, Symfony 2024-11-21 9.8 Critical
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.