Export limit exceeded: 333843 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 74992 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (74992 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-20329 | 1 Openlambda Project | 1 Openlambda | 2024-11-21 | 8.1 High |
| OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000. | ||||
| CVE-2019-20327 | 1 Centreon | 1 Centreon | 2024-11-21 | 7.8 High |
| Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is a setuid executable allowing execution of Perl scripts with root privileges.) | ||||
| CVE-2019-20326 | 3 Debian, Gnome, Linuxmint | 3 Debian Linux, Gthumb, Pix | 2024-11-21 | 7.8 High |
| A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file. | ||||
| CVE-2019-20224 | 1 Artica | 1 Pandora Fms | 2024-11-21 | 8.8 High |
| netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. This issue has been fixed in Pandora FMS 7.0 NG 742. | ||||
| CVE-2019-20219 | 1 Miniupnp Project | 1 Ngiflib | 2024-11-21 | 8.8 High |
| ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor in ngiflib.c. | ||||
| CVE-2019-20218 | 5 Canonical, Debian, Oracle and 2 more | 5 Ubuntu Linux, Debian Linux, Mysql Workbench and 2 more | 2024-11-21 | 7.5 High |
| selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error. | ||||
| CVE-2019-20213 | 1 Dlink | 28 Dir-818lx, Dir-818lx Firmware, Dir-822 and 25 more | 2024-11-21 | 7.5 High |
| D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrated by vpnconfig.php. | ||||
| CVE-2019-20209 | 1 Cththemes | 3 Citybook, Easybook, Townhub | 2024-11-21 | 7.5 High |
| The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing. | ||||
| CVE-2019-20205 | 1 Libsixel Project | 1 Libsixel | 2024-11-21 | 8.8 High |
| libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c. | ||||
| CVE-2019-20197 | 1 Nagios | 1 Nagios Xi | 2024-11-21 | 8.8 High |
| In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account. | ||||
| CVE-2019-20191 | 1 Sync | 3 Oxygen Xml Author, Oxygen Xml Developer, Oxygen Xml Editor | 2024-11-21 | 7.5 High |
| Oxygen XML Editor 21.1.1 allows XXE to read any file. | ||||
| CVE-2019-20184 | 1 Keepass | 1 Keepass | 2024-11-21 | 7.8 High |
| KeePass 2.4.1 allows CSV injection in the title field of a CSV export. | ||||
| CVE-2019-20183 | 1 Employee Records System Project | 1 Employee Records System | 2024-11-21 | 7.2 High |
| uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension. | ||||
| CVE-2019-20179 | 1 Soplanning | 1 Soplanning | 2024-11-21 | 8.8 High |
| SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter. | ||||
| CVE-2019-20176 | 2 Fedoraproject, Pureftpd | 2 Fedora, Pure-ftpd | 2024-11-21 | 7.5 High |
| In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c. | ||||
| CVE-2019-20175 | 1 Qemu | 1 Qemu | 2024-11-21 | 7.5 High |
| An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a multiple of 512 (the size of a sector). NOTE: a member of the QEMU security team disputes the significance of this issue because a "privileged guest user has many ways to cause similar DoS effect, without triggering this assert. | ||||
| CVE-2019-20172 | 1 Serenityos | 1 Serenityos | 2024-11-21 | 7.8 High |
| Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack. | ||||
| CVE-2019-20155 | 1 Determine | 1 Contract Lifecycle Management | 2024-11-21 | 8.8 High |
| An issue was discovered in report_edit.jsp in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server. | ||||
| CVE-2019-20149 | 2 Kind-of Project, Redhat | 2 Kind-of, Acm | 2024-11-21 | 7.5 High |
| ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result. | ||||
| CVE-2019-20140 | 1 Libsixel Project | 1 Libsixel | 2024-11-21 | 8.8 High |
| An issue was discovered in libsixel 1.8.4. There is a heap-based buffer overflow in the function gif_out_code at fromgif.c. | ||||