Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (40256 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-13292 1 Weberp 1 Weberp 2024-11-21 N/A
A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this deserialized data goes directly into a SQL query, with no sanitizing checks.
CVE-2019-13275 1 Veronalabs 1 Wp Statistics 2024-11-21 N/A
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection.
CVE-2019-13191 1 Mapsolutions 1 Intramaps 2024-11-21 N/A
A SQL injection vulnerability in IntraMaps MapControl 8 allows attackers to execute arbitrary SQL commands via the /ApplicationEngine/Search/Refine/Set page.
CVE-2019-13086 1 Cszcms 1 Csz Cms 2024-11-21 N/A
core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_csz parameter.
CVE-2019-13079 1 Quest 1 Kace Systems Management Appliance 2024-11-21 8.8 High
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /adminui/history_log.php. The affected parameter is TYPE_NAME.
CVE-2019-13078 1 Quest 1 Kace Systems Management Appliance 2024-11-21 8.8 High
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /common/user_profile.php. The affected parameter is sort_column.
CVE-2019-13076 1 Quest 1 Kace Systems Management Appliance 2024-11-21 8.8 High
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticket_list.php, and affected parameters are order[0][column] and order[0][dir].
CVE-2019-13047 1 Toaruos Project 1 Toaruos 2024-11-21 N/A
kernel/sys/syscall.c in ToaruOS through 1.10.9 has incorrect access control in sys_sysfunc case 9 for TOARU_SYS_FUNC_SETHEAP, allowing arbitrary kernel pages to be mapped into user land, leading to root access.
CVE-2019-13027 1 Realization 1 Concerto Critical Chain Planner 2024-11-21 N/A
Realization Concerto Critical Chain Planner (aka CCPM) 5.10.8071 has SQL Injection in at least in the taskupdt/taskdetails.aspx webpage via the projectname parameter.
CVE-2019-13026 1 Oxid-esales 1 Eshop 2024-11-21 N/A
OXID eShop 6.0.x before 6.0.5 and 6.1.x before 6.1.4 allows SQL Injection via a crafted URL, leading to full access by an attacker. This includes all shopping cart options, customer data, and the database. No interaction between the attacker and the victim is necessary.
CVE-2019-13013 2 Apple, Obdev 2 Macos, Little Snitch 2024-11-21 5.5 Medium
Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. The privileged helper tool implements an XPC interface which is available to any process and allows directory listings and copying files as root.
CVE-2019-13001 1 Gitlab 1 Gitlab 2024-11-21 4.3 Medium
An issue was discovered in GitLab Community and Enterprise Edition 11.9 and later through 12.0.2. GitLab Snippets were vulnerable to an authorization issue that allowed unauthorized users to add comments to a private snippet. It allows authentication bypass.
CVE-2019-12973 5 Debian, Opensuse, Oracle and 2 more 6 Debian Linux, Leap, Database Server and 3 more 2024-11-21 5.5 Medium
In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
CVE-2019-12960 1 Livezilla 1 Livezilla 2024-11-21 N/A
LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter p_dt_s_d.
CVE-2019-12946 1 Elcom 1 Elcom Cms 2024-11-21 N/A
Elcom CMS before 10.7 has SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx.
CVE-2019-12944 1 Gluehome 2 Glue Smart Lock, Glue Smart Lock Firmware 2024-11-21 7.5 High
Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable.
CVE-2019-12942 1 Ttlock 1 Ttlock 2024-11-21 6.5 Medium
TTLock devices do not properly block guest access in certain situations where the network connection to the cloud is unavailable.
CVE-2019-12939 1 Livezilla 1 Livezilla 2024-11-21 N/A
LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter.
CVE-2019-12926 1 Mailenable 1 Mailenable 2024-11-21 N/A
MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it was possible to perform a number of actions, when logged in as a user, that that user should not have had permission to perform. It was also possible to gain access to areas within the application for which the accounts used were supposed to have insufficient access.
CVE-2019-12918 1 Quest 1 Kace Systems Management Appliance 2024-11-21 9.8 Critical
Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir].