Export limit exceeded: 52964 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 44683 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (44683 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-16682 | 1 Url Redirect Project | 1 Url Redirect | 2024-11-21 | 7.3 High |
| The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection. | ||||
| CVE-2019-16651 | 1 Virginmedia | 2 Super Hub 3, Super Hub 3 Firmware | 2024-11-21 | 5.3 Medium |
| An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is possible to use JavaScript and DNS rebinding to leak the WAN IP address of a user (if they are using certain VPN implementations, this would decloak them). | ||||
| CVE-2019-16644 | 1 Tuzicms | 1 Tuzicms | 2024-11-21 | 9.8 Critical |
| App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring. | ||||
| CVE-2019-16642 | 1 Yejiao | 1 Tuzicms | 2024-11-21 | 9.8 Critical |
| App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring. | ||||
| CVE-2019-16576 | 1 Jenkins | 1 Alauda Kubernetes Support | 2024-11-21 | 6.5 Medium |
| A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins. | ||||
| CVE-2019-16574 | 1 Jenkins | 1 Alauda Devops Pipeline | 2024-11-21 | 6.5 Medium |
| A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2019-16571 | 1 Jenkins | 1 Rapiddeploy | 2024-11-21 | 4.3 Medium |
| A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server. | ||||
| CVE-2019-16567 | 1 Jenkins | 1 Team Concert | 2024-11-21 | 4.3 Medium |
| A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. | ||||
| CVE-2019-16566 | 1 Jenkins | 1 Team Concert | 2024-11-21 | 6.5 Medium |
| A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2019-16547 | 1 Jenkins | 1 Google Compute Engine | 2024-11-21 | 4.3 Medium |
| Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. | ||||
| CVE-2019-16538 | 2 Jenkins, Redhat | 2 Script Security, Openshift | 2024-11-21 | 8.8 High |
| A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts. | ||||
| CVE-2019-16413 | 1 Linux | 1 Linux Kernel | 2024-11-21 | 7.5 High |
| An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loop and denial of service on SMP systems. | ||||
| CVE-2019-16404 | 1 Open-emr | 1 Openemr | 2024-11-21 | 8.8 High |
| Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter. | ||||
| CVE-2019-16383 | 1 Ipswitch | 1 Moveit Transfer | 2024-11-21 | 9.4 Critical |
| MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or may be able to alter the database via the REST API, aka SQL Injection. | ||||
| CVE-2019-16319 | 3 Debian, Opensuse, Wireshark | 3 Debian Linux, Leap, Wireshark | 2024-11-21 | 7.5 High |
| In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-gryphon.c by checking for a message length of zero. | ||||
| CVE-2019-16309 | 1 Flamecms Project | 1 Flamecms | 2024-11-21 | 9.8 Critical |
| FlameCMS 3.3.5 has SQL injection in account/login.php via accountName. | ||||
| CVE-2019-16264 | 1 Egpp | 1 Sistema Integrado De Gestion Academica | 2024-11-21 | 9.8 Critical |
| In Escuela de Gestion Publica Plurinacional (EGPP) Sistema Integrado de Gestion Academica (GESAC) v1, the username parameter of the authentication form is vulnerable to SQL injection, allowing attackers to access the database. | ||||
| CVE-2019-16236 | 4 Canonical, Debian, Dino and 1 more | 4 Ubuntu Linux, Debian Linux, Dino and 1 more | 2024-11-21 | 7.5 High |
| Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala. | ||||
| CVE-2019-16194 | 1 Centreon | 1 Centreon | 2024-11-21 | 9.8 Critical |
| SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php. | ||||
| CVE-2019-16125 | 1 Jobberbase | 1 Jobberbase | 2024-11-21 | 9.8 Critical |
| In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL injection. | ||||