Export limit exceeded: 46831 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46831 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-16744 | 1 Ebrigade | 1 Ebrigade | 2024-11-21 | 8.8 High |
| eBrigade before 5.0 has evenements.php cid SQL Injection. | ||||
| CVE-2019-16743 | 1 Ebrigade | 1 Ebrigade | 2024-11-21 | 8.8 High |
| eBrigade before 5.0 has evenement_ical.php evenement SQL Injection. | ||||
| CVE-2019-16698 | 1 Dkd | 1 Direct Mail | 2024-11-21 | 4.3 Medium |
| The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter. | ||||
| CVE-2019-16696 | 1 Phpipam | 1 Phpipam | 2024-11-21 | 9.8 Critical |
| phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used. | ||||
| CVE-2019-16695 | 1 Phpipam | 1 Phpipam | 2024-11-21 | 9.8 Critical |
| phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used. | ||||
| CVE-2019-16694 | 1 Phpipam | 1 Phpipam | 2024-11-21 | 9.8 Critical |
| phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used. | ||||
| CVE-2019-16692 | 1 Phpipam | 1 Phpipam | 2024-11-21 | 9.8 Critical |
| phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used. | ||||
| CVE-2019-16682 | 1 Url Redirect Project | 1 Url Redirect | 2024-11-21 | 7.3 High |
| The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection. | ||||
| CVE-2019-16651 | 1 Virginmedia | 2 Super Hub 3, Super Hub 3 Firmware | 2024-11-21 | 5.3 Medium |
| An issue was discovered on Virgin Media Super Hub 3 (based on ARRIS TG2492) devices. Because their SNMP commands have insufficient protection mechanisms, it is possible to use JavaScript and DNS rebinding to leak the WAN IP address of a user (if they are using certain VPN implementations, this would decloak them). | ||||
| CVE-2019-16644 | 1 Tuzicms | 1 Tuzicms | 2024-11-21 | 9.8 Critical |
| App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring. | ||||
| CVE-2019-16642 | 1 Yejiao | 1 Tuzicms | 2024-11-21 | 9.8 Critical |
| App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring. | ||||
| CVE-2019-16576 | 1 Jenkins | 1 Alauda Kubernetes Support | 2024-11-21 | 6.5 Medium |
| A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins. | ||||
| CVE-2019-16574 | 1 Jenkins | 1 Alauda Devops Pipeline | 2024-11-21 | 6.5 Medium |
| A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2019-16571 | 1 Jenkins | 1 Rapiddeploy | 2024-11-21 | 4.3 Medium |
| A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server. | ||||
| CVE-2019-16567 | 1 Jenkins | 1 Team Concert | 2024-11-21 | 4.3 Medium |
| A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. | ||||
| CVE-2019-16566 | 1 Jenkins | 1 Team Concert | 2024-11-21 | 6.5 Medium |
| A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2019-16547 | 1 Jenkins | 1 Google Compute Engine | 2024-11-21 | 4.3 Medium |
| Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. | ||||
| CVE-2019-16538 | 2 Jenkins, Redhat | 2 Script Security, Openshift | 2024-11-21 | 8.8 High |
| A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts. | ||||
| CVE-2019-16413 | 1 Linux | 1 Linux Kernel | 2024-11-21 | 7.5 High |
| An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loop and denial of service on SMP systems. | ||||
| CVE-2019-16404 | 1 Open-emr | 1 Openemr | 2024-11-21 | 8.8 High |
| Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter. | ||||