Export limit exceeded: 373393 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373393 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-12745 | 1 Seeddms | 1 Seeddms | 2024-11-21 | N/A |
| out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field. | ||||
| CVE-2019-12744 | 1 Seeddms | 1 Seeddms | 2024-11-21 | N/A |
| SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940. | ||||
| CVE-2019-12743 | 1 Humhub | 1 Social Network Kit | 2024-11-21 | N/A |
| HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (including self-hosted ones) by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure. | ||||
| CVE-2019-12742 | 1 Bludit | 1 Bludit | 2024-11-21 | N/A |
| Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter). | ||||
| CVE-2019-12741 | 1 Fhir | 1 Hapi Fhir | 2024-11-21 | N/A |
| XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.) | ||||
| CVE-2019-12739 | 1 Nextcloud | 1 Extract | 2024-11-21 | N/A |
| lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters). | ||||
| CVE-2019-12737 | 1 Jetbrains | 1 Ktor | 2024-11-21 | 5.3 Medium |
| UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials. | ||||
| CVE-2019-12736 | 1 Jetbrains | 1 Ktor | 2024-11-21 | 9.8 Critical |
| JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection. | ||||
| CVE-2019-12734 | 1 Sitevision | 1 Sitevision | 2024-11-21 | 8.8 High |
| SiteVision 4 has Incorrect Access Control. | ||||
| CVE-2019-12733 | 1 Sitevision | 1 Sitevision | 2024-11-21 | 8.8 High |
| SiteVision 4 allows Remote Code Execution. | ||||
| CVE-2019-12732 | 1 Chartkick Project | 1 Chartkick | 2024-11-21 | N/A |
| The Chartkick gem through 3.1.0 for Ruby allows XSS. | ||||
| CVE-2019-12731 | 2 Microsoft, Mikogo | 2 Windows, Mikogo | 2024-11-21 | N/A |
| The Windows versions of Snapview Mikogo, versions before 5.10.2 are affected by insecure implementations which allow local attackers to escalate privileges. | ||||
| CVE-2019-12730 | 1 Ffmpeg | 1 Ffmpeg | 2024-11-21 | N/A |
| aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables. | ||||
| CVE-2019-12728 | 1 Grails | 1 Grails | 2024-11-21 | 8.1 High |
| Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP. | ||||
| CVE-2019-12727 | 1 Ui | 2 Aircam, Aircam Firmware | 2024-11-21 | N/A |
| On Ubiquiti airCam 3.1.4 devices, a Denial of Service vulnerability exists in the RTSP Service provided by the ubnt-streamer binary. The issue can be triggered via malformed RTSP requests that lead to an invalid memory read. To exploit the vulnerability, an attacker must craft an RTSP request with a large number of headers. | ||||
| CVE-2019-12725 | 1 Zeroshell | 1 Zeroshell | 2024-11-21 | N/A |
| Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. | ||||
| CVE-2019-12724 | 1 Teclib-edition | 1 News | 2024-11-21 | 6.1 Medium |
| An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS attack via the $_POST['name'] parameter. | ||||
| CVE-2019-12723 | 1 Teclib-edition | 1 Fields | 2024-11-21 | N/A |
| An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via container_id and old_order parameters to ajax/reorder.php by an unauthenticated user. | ||||
| CVE-2019-12720 | 1 Auo | 1 Sunveillance Monitoring System \& Data Recorder | 2024-11-21 | 7.5 High |
| AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvc_send_mail.aspx (MailAdd parameter) SQL Injection. An Attacker can carry a SQL Injection payload to the server, allowing the attacker to read privileged data. This also affects the picture_manage_mvc.aspx plant_no parameter, the swapdl_mvc.aspx plant_no parameter, and the account_management.aspx Text_Postal_Code and Text_Dis_Code parameters. | ||||
| CVE-2019-12719 | 1 Auo | 1 Sunveillance Monitoring System \& Data Recorder | 2024-11-21 | 9.8 Critical |
| An issue was discovered in Picture_Manage_mvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e. There is an incorrect access control vulnerability that can allow an unauthenticated user to upload files via a modified authority parameter. | ||||