Export limit exceeded: 87707 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (87707 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-10017 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-11-21 | N/A |
| CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker. | ||||
| CVE-2019-10016 | 1 Gforge | 1 Advanced Server | 2024-11-21 | N/A |
| GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring. | ||||
| CVE-2019-10011 | 1 Jenzabar | 1 Internet Campus Solution | 2024-11-21 | N/A |
| ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of accounts with a password of 1234. | ||||
| CVE-2019-10010 | 1 Thephpleague | 1 Commonmark | 2024-11-21 | N/A |
| Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583. | ||||
| CVE-2019-1020019 | 1 Inveniosoftware | 1 Invenio-previewer | 2024-11-21 | N/A |
| invenio-previewer before 1.0.0a12 allows XSS. | ||||
| CVE-2019-1020010 | 1 Misskey | 1 Misskey | 2024-11-21 | N/A |
| Misskey before 10.102.4 allows hijacking a user's token. | ||||
| CVE-2019-1020008 | 1 Stacktable.js Project | 1 Stacktable.js | 2024-11-21 | N/A |
| stacktable.js before 1.0.4 allows XSS. | ||||
| CVE-2019-1020007 | 1 Owasp | 1 Dependency-track | 2024-11-21 | N/A |
| Dependency-Track before 3.5.1 allows XSS. | ||||
| CVE-2019-1020006 | 1 Inveniosoftware | 1 Invenio-app | 2024-11-21 | N/A |
| invenio-app before 1.1.1 allows host header injection. | ||||
| CVE-2019-1020005 | 1 Inveniosoftware | 1 Invenio-communities | 2024-11-21 | N/A |
| invenio-communities before 1.0.0a20 allows XSS. | ||||
| CVE-2019-1020004 | 1 Tridactyl Project | 1 Tridactyl | 2024-11-21 | N/A |
| Tridactyl before 1.16.0 allows fake key events. | ||||
| CVE-2019-1020003 | 1 Inveniosoftware | 1 Invenio-records | 2024-11-21 | N/A |
| invenio-records before 1.2.2 allows XSS. | ||||
| CVE-2019-1010314 | 1 Gitea | 1 Gitea | 2024-11-21 | N/A |
| Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page. | ||||
| CVE-2019-1010310 | 1 Glpi-project | 1 Glpi | 2024-11-21 | N/A |
| GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools > Reminder > Description .. Set the description to any iframe/form tags and apply. The attack vector is: The attacker puts a login form, the user fills it and clicks on submit .. the request is sent to the attacker domain saving the data. The fixed version is: 9.4.1. | ||||
| CVE-2019-1010307 | 1 Glpi-project | 1 Glpi | 2024-11-21 | N/A |
| GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and executes it. | ||||
| CVE-2019-1010301 | 3 Debian, Fedoraproject, Jhead Project | 3 Debian Linux, Fedora, Jhead | 2024-11-21 | 5.5 Medium |
| jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG file. | ||||
| CVE-2019-1010287 | 1 Timesheet Next Gen Project | 1 Timesheet Next Gen | 2024-11-21 | N/A |
| Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url. | ||||
| CVE-2019-1010266 | 2 Lodash, Redhat | 2 Lodash, Quay | 2024-11-21 | 6.5 Medium |
| lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11. | ||||
| CVE-2019-1010261 | 1 Gitea | 1 Gitea | 2024-11-21 | N/A |
| Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later. | ||||
| CVE-2019-1010258 | 1 Nanosvg Project | 1 Nanosvg | 2024-11-21 | N/A |
| nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function nsvg__parseColorRGB in src/nanosvg.h / line 1227. The attack vector is: It depends library usage. If input is passed from the network, then network connectivity is enough. Most likely an attack will require opening a specially crafted .svg file. | ||||