Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88023 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-20409 1 Atlassian 2 Jira, Jira Software Data Center 2024-11-21 9.8 Critical
The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.
CVE-2019-20389 1 Intelliants 1 Subrion 2024-11-21 6.1 Medium
An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the v[language_switch] parameter (within multipart/form-data), which is reflected back within a user's browser without proper output encoding.
CVE-2019-20382 5 Canonical, Debian, Opensuse and 2 more 7 Ubuntu Linux, Debian Linux, Leap and 4 more 2024-11-21 3.5 Low
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
CVE-2019-20381 1 Testlink 1 Testlink 2024-11-21 6.1 Medium
TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491.
CVE-2019-20379 1 Ganglia 1 Ganglia-web 2024-11-21 6.1 Medium
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.
CVE-2019-20378 1 Ganglia 1 Ganglia-web 2024-11-21 6.1 Medium
ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.
CVE-2019-20377 1 Tophub 1 Toplist 2024-11-21 6.1 Medium
TopList before 2019-09-03 allows XSS via a title.
CVE-2019-20376 1 Psi 1 Electronic Logbook 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG document to elogd.c.
CVE-2019-20375 1 Psi 1 Electronic Logbook 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value parameter in a localization (loc) command to elogd.c.
CVE-2019-20374 3 Apple, Linux, Typora 3 Macos, Linux Kernel, Typora 2024-11-21 9.6 Critical
A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.
CVE-2019-20366 1 Igniterealtime 1 Openfire 2024-11-21 6.1 Medium
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.
CVE-2019-20365 1 Igniterealtime 1 Openfire 2024-11-21 6.1 Medium
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.
CVE-2019-20364 1 Igniterealtime 1 Openfire 2024-11-21 6.1 Medium
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.
CVE-2019-20363 1 Igniterealtime 1 Openfire 2024-11-21 6.1 Medium
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.
CVE-2019-20358 2 Microsoft, Trendmicro 2 Windows, Anti-threat Toolkit 2024-11-21 7.8 High
Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed. Another attack vector similar to CVE-2019-9491 was idenitfied and resolved in version 1.62.0.1228 of the tool.
CVE-2019-20348 1 Okerthai 2 G232v1, G232v1 Firmware 2024-11-21 6.8 Medium
OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. This allows attackers with physical access to interrupt the boot sequence in order to execute arbitrary commands with root privileges and conduct further attacks.
CVE-2019-20336 1 Advanced Real Estate Script Project 1 Advanced Real Estate Script 2024-11-21 6.1 Medium
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS.
CVE-2019-20327 1 Centreon 1 Centreon 2024-11-21 7.8 High
Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is a setuid executable allowing execution of Perl scripts with root privileges.)
CVE-2019-20326 3 Debian, Gnome, Linuxmint 3 Debian Linux, Gthumb, Pix 2024-11-21 7.8 High
A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.
CVE-2019-20224 1 Artica 1 Pandora Fms 2024-11-21 8.8 High
netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. This issue has been fixed in Pandora FMS 7.0 NG 742.