Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (91074 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-11923 1 Facebook 1 Mcrouter 2024-11-21 7.5 High
In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for resource exhaustion or denial of service.
CVE-2019-11921 1 Facebook 1 Proxygen 2024-11-21 N/A
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00.
CVE-2019-11898 1 Bosch 1 Access 2024-11-21 9.9 Critical
Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Access Professional Edition (APE) 3.8.
CVE-2019-11877 1 Pix-link 2 Lv-wr09, Lv-wr09 Firmware 2024-11-21 N/A
XSS on the PIX-Link Repeater/Router LV-WR09 with firmware v28K.MiniRouter.20180616 allows attackers to steal credentials without being connected to the network. The attack vector is a crafted ESSID.
CVE-2019-11876 2 Drupal, Prestashop 2 Drupal, Prestashop 2024-11-21 N/A
In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link.
CVE-2019-11873 1 Wolfssl 1 Wolfssl 2024-11-21 9.8 Critical
wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. An attacker sends a crafted hello client packet over the network to a TLSv1.3 wolfSSL server. The length fields of the packet: record length, client hello length, total extensions length, PSK extension length, total identity length, and identity length contain their maximum value which is 2^16. The identity data field of the PSK extension of the packet contains the attack data, to be stored in the undefined memory (RAM) of the server. The size of the data is about 65 kB. Possibly the attacker can perform a remote code execution attack.
CVE-2019-11871 1 Custom Field Suite Project 1 Custom Field Suite 2024-11-21 N/A
The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.
CVE-2019-11870 1 S9y 1 Serendipity 2024-11-21 N/A
Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.
CVE-2019-11869 1 Yuzopro 1 Yuzo 2024-11-21 N/A
The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.
CVE-2019-11868 1 Softether 1 See.sys 2024-11-21 7.8 High
See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying any kernel address to which arbitrary bytes are written to.
CVE-2019-11853 1 Sierrawireless 9 Airlink Es450, Airlink Gx450, Airlink Lx40 and 6 more 2024-11-21 3.9 Low
Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0, and 4.9.4.
CVE-2019-11850 1 Sierrawireless 7 Airlink Lx40, Airlink Lx60, Airlink Mp70 and 4 more 2024-11-21 6.3 Medium
A stack overflow vulnerabiltity exist in the AT command interface of ALEOS before 4.11.0. The vulnerability may allow code execution
CVE-2019-11849 1 Sierrawireless 7 Airlink Lx40, Airlink Lx60, Airlink Mp70 and 4 more 2024-11-21 6.3 Medium
A stack overflow vulnerabiltity exists in the AT command APIs of ALEOS before 4.11.0. The vulnerability may allow code execution.
CVE-2019-11848 1 Sierrawireless 13 Airlink Es440, Airlink Es450, Airlink Gx400 and 10 more 2024-11-21 4.1 Medium
An API abuse vulnerability exists in the AT command API of ALEOS before 4.13.0, 4.9.5, 4.4.9 due to lack of length checking when handling certain user-provided values.
CVE-2019-11846 1 Dotcms 1 Dotcms 2024-11-21 N/A
/servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection.
CVE-2019-11845 1 Ricoh 2 Sp 4510dn, Sp 4510dn Firmware 2024-11-21 N/A
An HTML Injection vulnerability has been discovered on the RICOH SP 4510DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn parameter.
CVE-2019-11844 1 Ricoh 2 Sp 4520dn, Sp 4520dn Firmware 2024-11-21 N/A
An HTML Injection vulnerability has been discovered on the RICOH SP 4520DN via the /web/entry/en/address/adrsSetUserWizard.cgi entryNameIn or entryDisplayNameIn parameter.
CVE-2019-11839 1 F5 1 Njs 2024-11-21 N/A
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.push after a resize, related to njs_array_prototype_push in njs/njs_array.c, because of njs_array_expand size mishandling.
CVE-2019-11838 1 F5 1 Njs 2024-11-21 N/A
njs through 0.3.1, used in NGINX, has a heap-based buffer overflow in Array.prototype.splice after a resize, related to njs_array_prototype_splice in njs/njs_array.c, because of njs_array_expand size mishandling.
CVE-2019-11829 1 Synology 1 Calendar 2024-11-21 7.3 High
OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header.