Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (40232 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-10897 2 Fedoraproject, Wireshark 2 Fedora, Wireshark 2024-11-21 N/A
In Wireshark 3.0.0, the IEEE 802.11 dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-ieee80211.c by detecting cases in which the bit offset does not advance.
CVE-2019-10868 2 Debian, Tryton 2 Debian Linux, Trytond 2024-11-21 6.5 Medium
In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.
CVE-2019-10866 1 10web 1 Form Maker 2024-11-21 N/A
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
CVE-2019-10852 1 Computrols 1 Computrols Building Automation Software 2024-11-21 N/A
Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=start_pulling&id= substring.
CVE-2019-10849 1 Computrols 1 Computrols Building Automation Software 2024-11-21 N/A
Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.
CVE-2019-10800 1 Codecov 1 Codecov-python 2024-11-21 6.5 Medium
This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method.
CVE-2019-10766 1 Pixie Project 1 Pixie 2024-11-21 9.8 Critical
Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
CVE-2019-10763 1 Pimcore 1 Pimcore 2024-11-21 6.5 Medium
pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.
CVE-2019-10762 1 Medoo 1 Medoo 2024-11-21 9.8 Critical
columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
CVE-2019-10757 1 Knexjs 1 Knex 2024-11-21 9.8 Critical
knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.
CVE-2019-10752 1 Sequelizejs 1 Sequelize 2024-11-21 9.8 Critical
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
CVE-2019-10749 1 Sequelizejs 1 Sequelize 2024-11-21 9.8 Critical
sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
CVE-2019-10748 1 Sequelizejs 1 Sequelize 2024-11-21 9.8 Critical
Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
CVE-2019-10746 4 Fedoraproject, Mixin-deep Project, Oracle and 1 more 5 Fedora, Mixin-deep, Communications Cloud Native Core Network Function Cloud Native Environment and 2 more 2024-11-21 9.8 Critical
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
CVE-2019-10708 1 S-cms 1 S-cms 2024-11-21 N/A
S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter.
CVE-2019-10707 1 Mkcms Project 1 Mkcms 2024-11-21 N/A
MKCMS V5.0 has SQL injection via the bplay.php play parameter.
CVE-2019-10692 1 Codecabin 1 Wp Go Maps 2024-11-21 9.8 Critical
In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.
CVE-2019-10687 1 Kbpublisher 1 Kbpublisher 2024-11-21 N/A
KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request.
CVE-2019-10671 1 Librenms 1 Librenms 2024-11-21 8.8 High
An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter.
CVE-2019-10666 1 Librenms 1 Librenms 2024-11-21 8.1 High
An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input without sanitizing the values by calling basename() or a similar function. An attacker can leverage this to execute PHP code from the included file. Exploitation of these scripts is made difficult by additional text being appended (typically .inc.php), which means an attacker would need to be able to control both a filename and its content on the server. However, exploitation can be achieved as demonstrated by the csv.php?report=../ substring.