Export limit exceeded: 417710 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 93886 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (93886 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-10787 | 1 Dnt | 1 Im-resize | 2024-11-21 | 9.8 Critical |
| im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization. | ||||
| CVE-2019-10786 | 1 Network-manager Project | 1 Network-manager | 2024-11-21 | 9.8 Critical |
| network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument. | ||||
| CVE-2019-10785 | 2 Debian, Linuxfoundation | 2 Debian Linux, Dojox | 2024-11-21 | 6.1 Medium |
| dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them. | ||||
| CVE-2019-10783 | 1 Isof Project | 1 Isof | 2024-11-21 | 9.8 Critical |
| All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input. | ||||
| CVE-2019-10780 | 1 Bibtex-ruby Project | 1 Bibtex-ruby | 2024-11-21 | 9.8 Critical |
| BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open. | ||||
| CVE-2019-10779 | 1 Gchq | 1 Stroom | 2024-11-21 | 6.1 Medium |
| All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe, the attacker site can issue commands to the Stroom UI via an XSS vulnerability to take full control of the Stroom UI on behalf of the logged-in user. | ||||
| CVE-2019-10778 | 1 Devcert-sanscache Project | 1 Devcert-sanscache | 2024-11-21 | 9.8 Critical |
| devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization. | ||||
| CVE-2019-10777 | 1 Amazon | 1 Aws Lambda | 2024-11-21 | 9.8 Critical |
| In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName". | ||||
| CVE-2019-10776 | 1 Git-diff-apply Project | 1 Git-diff-apply | 2024-11-21 | 9.8 Critical |
| In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2. | ||||
| CVE-2019-10774 | 1 Php-shellcommand Project | 1 Php-shellcommand | 2024-11-21 | 9.8 Critical |
| php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. | ||||
| CVE-2019-10772 | 1 Svg-sanitizer Project | 1 Svg-sanitizer | 2024-11-21 | 6.1 Medium |
| It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer. | ||||
| CVE-2019-10771 | 1 Iobroker | 1 Iobroker.web | 2024-11-21 | 6.1 Medium |
| Characters in the GET url path are not properly escaped and can be reflected in the server response. | ||||
| CVE-2019-10770 | 1 Ratpack | 1 Ratpack | 2024-11-21 | 6.1 Medium |
| All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects the development mode error handler when an exception message contains untrusted data. Note the production mode error handler is not vulnerable - so for this to be utilized in production it would require users to not disable development mode. | ||||
| CVE-2019-10756 | 1 Nodered | 1 Node-red-dashboard | 2024-11-21 | 5.4 Medium |
| It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default. | ||||
| CVE-2019-10742 | 1 Axios | 1 Axios | 2024-11-21 | N/A |
| Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded. | ||||
| CVE-2019-10723 | 1 Podofo Project | 1 Podofo | 2024-11-21 | N/A |
| An issue was discovered in PoDoFo 0.9.6. The PdfPagesTreeCache class in doc/PdfPagesTreeCache.cpp has an attempted excessive memory allocation because nInitialSize is not validated. | ||||
| CVE-2019-10715 | 1 Verodin | 1 Director | 2024-11-21 | 5.4 Medium |
| There is Stored XSS in Verodin Director 3.5.3.0 and earlier via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages. | ||||
| CVE-2019-10712 | 1 Wago | 32 750-330, 750-330 Firmware, 750-352 and 29 more | 2024-11-21 | N/A |
| The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and Series 750-87x (750-830, 750-849, 750-871, 750-872, 750-873) devices has undocumented service access. | ||||
| CVE-2019-10710 | 1 Hisilicon | 2 Hi3510, Hi3510 Firmware | 2024-11-21 | N/A |
| Insecure permissions in the Web management portal on all IP cameras based on Hisilicon Hi3510 firmware allow authenticated attackers to receive a network's cleartext WiFi credentials via a specific HTTP request. This affects certain devices labeled as HI3510, HI3518, LOOSAFE, LEVCOECAM, Sywstoda, BESDER, WUSONGLUSAN, GADINAN, Unitoptek, ESCAM, etc. | ||||
| CVE-2019-10694 | 1 Puppet | 1 Puppet Enterprise | 2024-11-21 | 9.8 Critical |
| The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1.9. | ||||