Export limit exceeded: 20555 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 87727 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (87727 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-10850 | 1 Computrols | 1 Computrols Building Automation Software | 2024-11-21 | N/A |
| Computrols CBAS 18.0.0 has Default Credentials. | ||||
| CVE-2019-10846 | 1 Computrols | 1 Computrols Building Automation System | 2024-11-21 | 6.1 Medium |
| Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter. | ||||
| CVE-2019-10807 | 1 Blamer Project | 1 Blamer | 2024-11-21 | 9.8 Critical |
| Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer. | ||||
| CVE-2019-10804 | 1 Serial-number Project | 1 Serial-number | 2024-11-21 | 9.8 Critical |
| serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation. | ||||
| CVE-2019-10803 | 1 Push-dir Project | 1 Push-dir | 2024-11-21 | 9.8 Critical |
| push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided to the "git" command within "index.js#L139". This could be abused by an attacker to inject arbitrary commands. | ||||
| CVE-2019-10802 | 1 Mangoraft | 1 Giting | 2024-11-21 | 9.8 Critical |
| giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull()" is executed by the package without any validation. | ||||
| CVE-2019-10801 | 1 Enpeem Project | 1 Enpeem | 2024-11-21 | 9.8 Critical |
| enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanitization. | ||||
| CVE-2019-10799 | 1 Compile-sass Project | 1 Compile-sass | 2024-11-21 | 8.2 High |
| compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" command without any sanitization. | ||||
| CVE-2019-10796 | 1 Rpi Project | 1 Rpi | 2024-11-21 | 9.8 Critical |
| rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization. | ||||
| CVE-2019-10795 | 1 Undefsafe Project | 1 Undefsafe | 2024-11-21 | 6.3 Medium |
| undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. | ||||
| CVE-2019-10794 | 1 Component-flatten Project | 1 Component-flatten | 2024-11-21 | 6.3 Medium |
| All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. | ||||
| CVE-2019-10793 | 1 Dot-object Project | 1 Dot-object | 2024-11-21 | 6.3 Medium |
| dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. | ||||
| CVE-2019-10792 | 1 Bodymen Project | 1 Bodymen | 2024-11-21 | 6.3 Medium |
| bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. | ||||
| CVE-2019-10791 | 1 Promise-probe Project | 1 Promise-probe | 2024-11-21 | 9.8 Critical |
| promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization. | ||||
| CVE-2019-10789 | 1 Curling Project | 1 Curling | 2024-11-21 | 9.8 Critical |
| All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization. | ||||
| CVE-2019-10788 | 1 Dnt | 1 Im-metadata | 2024-11-21 | 9.8 Critical |
| im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function. | ||||
| CVE-2019-10787 | 1 Dnt | 1 Im-resize | 2024-11-21 | 9.8 Critical |
| im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization. | ||||
| CVE-2019-10786 | 1 Network-manager Project | 1 Network-manager | 2024-11-21 | 9.8 Critical |
| network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument. | ||||
| CVE-2019-10785 | 2 Debian, Linuxfoundation | 2 Debian Linux, Dojox | 2024-11-21 | 6.1 Medium |
| dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them. | ||||
| CVE-2019-10783 | 1 Isof Project | 1 Isof | 2024-11-21 | 9.8 Critical |
| All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input. | ||||