Search

Expected end of text, found '.' (at char 13), (line:1, col:14)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (349509 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-20028 1 Nec 8 Sl1100, Sl1100 Firmware, Sl2100 and 5 more 2024-11-21 7.5 High
Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access to voicemails, greetings, and voice response system content through a system's WebPro administration interface.
CVE-2019-20027 1 Nec 8 Sl1100, Sl1100 Firmware, Sl2100 and 5 more 2024-11-21 9.8 Critical
Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password combination to be entered as a valid, successfully authenticating account.
CVE-2019-20026 1 Nec 2 Sv9100, Sv9100 Firmware 2024-11-21 7.5 High
The WebPro interface in NEC SV9100 software releases 7.0 or higher allows unauthenticated remote attackers to reset all existing usernames and passwords to default values via a crafted request.
CVE-2019-20025 1 Nec 2 Sv9100, Sv9100 Firmware 2024-11-21 9.8 Critical
Certain builds of NEC SV9100 software could allow an unauthenticated, remote attacker to log into a device running an affected release with a hardcoded username and password, aka a Static Credential Vulnerability. The vulnerability is due to an undocumented user account with manufacturer privilege level. An attacker could exploit this vulnerability by using this account to remotely log into an affected device. A successful exploit could allow the attacker to log into the device with manufacturer level access. This vulnerability affects SV9100 PBXes that are running software release 6.0 or higher. This vulnerability does not affect SV9100 software releases prior to 6.0.
CVE-2019-20020 1 Matio Project 1 Matio 2024-11-21 6.5 Medium
A stack-based buffer over-read was discovered in ReadNextStructField in mat5.c in matio 1.5.17.
CVE-2019-20019 1 Matio Project 1 Matio 2024-11-21 6.5 Medium
An attempted excessive memory allocation was discovered in Mat_VarRead5 in mat5.c in matio 1.5.17.
CVE-2019-20018 1 Matio Project 1 Matio 2024-11-21 6.5 Medium
A stack-based buffer over-read was discovered in ReadNextCell in mat5.c in matio 1.5.17.
CVE-2019-20017 1 Matio Project 1 Matio 2024-11-21 6.5 Medium
A stack-based buffer over-read was discovered in Mat_VarReadNextInfo5 in mat5.c in matio 1.5.17.
CVE-2019-20016 1 Symonics 1 Libmysofa 2024-11-21 6.5 Medium
libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c. NOTE: a download of v0.9 after 2019-12-06 should fully remediate this issue.
CVE-2019-20015 2 Gnu, Opensuse 3 Libredwg, Backports Sle, Leap 2024-11-21 6.5 Medium
An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in dwg.spec.
CVE-2019-20014 2 Gnu, Opensuse 3 Libredwg, Backports Sle, Leap 2024-11-21 8.8 High
An issue was discovered in GNU LibreDWG before 0.93. There is a double-free in dwg_free in free.c.
CVE-2019-20013 2 Gnu, Opensuse 3 Libredwg, Backports Sle, Leap 2024-11-21 6.5 Medium
An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in decode_3dsolid in dwg.spec.
CVE-2019-20012 2 Gnu, Opensuse 3 Libredwg, Backports Sle, Leap 2024-11-21 6.5 Medium
An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_HATCH_private in dwg.spec.
CVE-2019-20011 2 Gnu, Opensuse 3 Libredwg, Backports Sle, Leap 2024-11-21 8.8 High
An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decode_R13_R2000 in decode.c.
CVE-2019-20010 2 Gnu, Opensuse 3 Libredwg, Backports Sle, Leap 2024-11-21 8.8 High
An issue was discovered in GNU LibreDWG 0.92. There is a use-after-free in resolve_objectref_vector in decode.c.
CVE-2019-20009 2 Gnu, Opensuse 3 Libredwg, Backports Sle, Leap 2024-11-21 6.5 Medium
An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_SPLINE_private in dwg.spec.
CVE-2019-20008 1 Archerysec 1 Archery 2024-11-21 5.4 Medium
In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will result in stored XSS on the vulnerability-scan scheduling page.
CVE-2019-20007 1 Ezxml Project 1 Ezxml 2024-11-21 6.5 Medium
An issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxml_str2utf8, while parsing a crafted XML file, performs zero-length reallocation in ezxml.c, leading to returning a NULL pointer (in some compilers). After this, the function ezxml_parse_str does not check whether the s variable is not NULL in ezxml.c, leading to a NULL pointer dereference and crash (segmentation fault).
CVE-2019-20006 1 Ezxml Project 1 Ezxml 2024-11-21 7.5 High
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content puts a pointer to the internal address of a larger block as xml->txt. This is later deallocated (using free), leading to a segmentation fault.
CVE-2019-20005 1 Ezxml Project 1 Ezxml 2024-11-21 6.5 Medium
An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading to a heap-based buffer over-read while running strchr() starting with a pointer after a '\0' character (where the processing of a string was finished).