Export limit exceeded: 24682 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 17845 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 94065 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94065 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-15327 | 1 Codection | 1 Import Users From Csv With Meta | 2024-11-21 | N/A |
| The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data. | ||||
| CVE-2019-15317 | 1 Givewp | 1 Givewp | 2024-11-21 | N/A |
| The give plugin before 2.4.7 for WordPress has XSS via a donor name. | ||||
| CVE-2019-15316 | 2 Microsoft, Valvesoftware | 2 Windows, Steam Client | 2024-11-21 | N/A |
| Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition. | ||||
| CVE-2019-15315 | 2 Microsoft, Valvesoftware | 2 Windows, Steam Client | 2024-11-21 | N/A |
| Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch. | ||||
| CVE-2019-15314 | 1 Tiki | 1 Tikiwiki Cms\/groupware | 2024-11-21 | N/A |
| tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI. | ||||
| CVE-2019-15313 | 1 Zimbra | 1 Collaboration Server | 2024-11-21 | 6.1 Medium |
| In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. | ||||
| CVE-2019-15311 | 1 Linkplay | 1 Linkplay | 2024-11-21 | 9.8 Critical |
| An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command execution vulnerabilities. | ||||
| CVE-2019-15310 | 1 Linkplay | 1 Linkplay | 2024-11-21 | 9.8 Critical |
| An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user interaction. An attacker could retrieve the AWS key from the firmware and obtain full control over Linkplay's AWS estate, including S3 buckets containing device firmware. When combined with an OS command injection vulnerability within the XML Parsing logic of the firmware update process, an attacker would be able to gain code execution on any device that attempted to update. Note that by default all devices tested had automatic updates enabled. | ||||
| CVE-2019-15298 | 1 Centreon | 1 Centreon Web | 2024-11-21 | 8.8 High |
| A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/formMibs.php. This page is called from the Centreon administration interface. This is the mibs management feature that contains a file filing form. At the time of submission of a file, the mnftr parameter is sent to the page and is not filtered properly. This allows one to inject Linux commands directly. | ||||
| CVE-2019-15278 | 1 Cisco | 2 Finesse, Unified Contact Center Express | 2024-11-21 | 6.1 Medium |
| A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to bypass authorization and access sensitive information related to the device. The vulnerability exists because the software fails to sanitize URLs before it handles requests. An attacker could exploit this vulnerability by submitting a crafted URL. A successful exploit could allow the attacker to gain unauthorized access to sensitive information. | ||||
| CVE-2019-15277 | 1 Cisco | 1 Telepresence Collaboration Endpoint | 2024-11-21 | 6.7 Medium |
| A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute code with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating as the remote support user and sending malicious traffic to a listener who is internal to the device. A successful exploit could allow the attacker to execute commands with root privileges. | ||||
| CVE-2019-15275 | 1 Cisco | 1 Telepresence Collaboration Endpoint | 2024-11-21 | 6.7 Medium |
| A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating as the remote support user and submitting malicious input to a specific command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system (OS) with root privileges. | ||||
| CVE-2019-15274 | 1 Cisco | 1 Telepresence Collaboration Endpoint | 2024-11-21 | 6.7 Medium |
| A vulnerability in the CLI of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, local attacker to perform command injections. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating as an administrative level user within the restricted shell and submitting malicious input to a specific command. A successful exploit could allow the attacker to execute previously staged code from the underlying filesystem. | ||||
| CVE-2019-15234 | 1 Ushareit | 1 Shareit | 2024-11-21 | 7.5 High |
| SHAREit through 4.0.6.177 does not check the full message length from the received packet header (which is used to allocate memory for the next set of data). This could lead to a system denial of service due to uncontrolled memory allocation. This is different from CVE-2019-14941. | ||||
| CVE-2019-15233 | 1 Oldstreetsolutions | 1 Live Input Macros | 2024-11-21 | 6.1 Medium |
| The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS, leading to theft of the Administrator Session Cookie. | ||||
| CVE-2019-15230 | 1 Librenms | 1 Librenms | 2024-11-21 | N/A |
| LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account. | ||||
| CVE-2019-15228 | 1 Thedaylightstudio | 1 Fuel Cms | 2024-11-21 | N/A |
| FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors. | ||||
| CVE-2019-15227 | 1 Getflightpath | 1 Flightpath | 2024-11-21 | N/A |
| FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions. | ||||
| CVE-2019-15225 | 2 Envoyproxy, Redhat | 2 Envoy, Service Mesh | 2024-11-21 | N/A |
| In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993. | ||||
| CVE-2019-15160 | 1 Kbrw | 1 Sweet Xml | 2024-11-21 | N/A |
| The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD. | ||||