Search

Expected end of text, found '.' (at char 12), (line:1, col:13)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (352837 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-13991 1 Arduino 2 Arduino, Arduino Firmware 2024-11-21 N/A
Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO pins) via a laser, because of LED photosensitivity.
CVE-2019-13990 6 Apache, Atlassian, Netapp and 3 more 35 Tomee, Jira Service Management, Active Iq Unified Manager and 32 more 2024-11-21 9.8 Critical
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
CVE-2019-13989 1 Dpic Project 1 Dpic 2024-11-21 7.8 High
dpic 2019.06.20 has a Stack-based Buffer Overflow in the wfloat() function in main.c.
CVE-2019-13984 1 Rangerstudio 1 Directus 7 Api 2024-11-21 N/A
Directus 7 API before 2.3.0 does not validate uploaded files. Regardless of the file extension or MIME type, there is a direct link to each uploaded file, accessible by unauthenticated users, as demonstrated by the EICAR Anti-Virus Test File.
CVE-2019-13983 1 Rangerstudio 1 Directus 7 Api 2024-11-21 N/A
Directus 7 API before 2.2.2 has insufficient anti-automation, as demonstrated by lack of a CAPTCHA in core/Directus/Services/AuthService.php and endpoints/Auth.php.
CVE-2019-13982 1 Rangerstudio 1 Directus 7 2024-11-21 N/A
interfaces/markdown/input.vue in Directus 7 Application before 7.7.0 does not sanitize Markdown text before rendering a preview.
CVE-2019-13981 1 Rangerstudio 1 Directus 7 Api 2024-11-21 N/A
In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is related to a configuration option in which the file collection can be non-public, but this option does not apply to the thumbnailer.
CVE-2019-13980 1 Rangerstudio 1 Directus 7 Api 2024-11-21 N/A
In Directus 7 API through 2.3.0, uploading of PHP files is blocked only when the Apache HTTP Server is used, leading to uploads/_/originals remote code execution with nginx.
CVE-2019-13979 1 Rangerstudio 1 Directus 7 Api 2024-11-21 N/A
In Directus 7 API before 2.2.1, uploading of PHP files is not blocked, leading to uploads/_/originals remote code execution.
CVE-2019-13978 1 Ovidentia 1 Ovidentia 2024-11-21 N/A
Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request.
CVE-2019-13977 1 Ovidentia 1 Ovidentia 2024-11-21 N/A
index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, tg=admdir&idx=mdb&id=1, tg=notes&idx=Create, tg=admfaqs&idx=Add, or tg=admoc&idx=addoc&item=.
CVE-2019-13976 1 Egain 1 Chat 2024-11-21 N/A
eGain Chat 15.0.3 allows unrestricted file upload.
CVE-2019-13975 1 Egain 1 Chat 2024-11-21 N/A
eGain Chat 15.0.3 allows HTML Injection.
CVE-2019-13974 1 Layerbb 1 Layerbb 2024-11-21 N/A
LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.
CVE-2019-13973 1 Layerbb 1 Layerbb 2024-11-21 N/A
LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used.
CVE-2019-13972 1 Layerbb 1 Layerbb 2024-11-21 N/A
LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.
CVE-2019-13971 1 Otcms 1 Otcms 2024-11-21 N/A
OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.
CVE-2019-13970 1 Antsword Project 1 Antsword 2024-11-21 N/A
In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via modules/database/asp/index.js, modules/database/custom/index.js, modules/database/index.js, or modules/database/php/index.js.
CVE-2019-13969 1 Metinfo 1 Metinfo 2024-11-21 N/A
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=ui_set&m=admin&c=index&a=doget_text_content&table=lang&field=1 request.
CVE-2019-13967 1 Combodo 1 Itop 2024-11-21 7.5 High
iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service (application outage) via many requests to launch a compile operation. The requests use the pages/exec.php?exec_env=production&exec_module=itop-hub-connector&exec_page=ajax.php&operation=compile URI. This only affects the community version.