Export limit exceeded: 40332 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 40332 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 40332 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 40332 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 33), (line:1, col:34)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (40332 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-6565 1 Moxa 8 Eds-405a, Eds-405a Firmware, Eds-408a and 5 more 2024-11-21 6.1 Medium
Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script.
CVE-2019-6563 1 Moxa 8 Eds-405a, Eds-405a Firmware, Eds-408a and 5 more 2024-11-21 9.8 Critical
Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of the device.
CVE-2019-6559 1 Moxa 8 Eds-405a, Eds-405a Firmware, Eds-408a and 5 more 2024-11-21 6.5 Medium
Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch to crash.
CVE-2019-6557 1 Moxa 8 Eds-405a, Eds-405a Firmware, Eds-408a and 5 more 2024-11-21 9.8 Critical
Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution.
CVE-2019-6526 1 Moxa 8 Eds-405a, Eds-405a Firmware, Eds-408a and 5 more 2024-11-21 9.8 Critical
Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and prior, and EDS-510A series Version 3.8 and prior use plaintext transmission of sensitive data, which may allow an attacker to capture sensitive data such as an administrative password.
CVE-2019-6525 1 Aveva 1 Wonderware System Platform 2024-11-21 8.8 High
AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications. A user with low privileges could make use of an API to obtain the credentials for this account.
CVE-2019-6524 1 Moxa 8 Eds-405a, Eds-405a Firmware, Eds-408a and 5 more 2024-11-21 9.8 Critical
Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via brute force attack.
CVE-2019-6522 1 Moxa 8 Eds-405a, Eds-405a Firmware, Eds-408a and 5 more 2024-11-21 9.1 Critical
Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allow an attacker to retrieve sensitive data or cause device reboot.
CVE-2019-6520 1 Moxa 8 Eds-405a, Eds-405a Firmware, Eds-408a and 5 more 2024-11-21 7.5 High
Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configuration changes.
CVE-2019-6518 1 Moxa 8 Eds-405a, Eds-405a Firmware, Eds-408a and 5 more 2024-11-21 7.5 High
Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device.
CVE-2019-6474 1 Isc 1 Kea 2024-11-21 5.7 Medium
A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2
CVE-2019-6473 1 Ics 1 Kea 2024-11-21 6.5 Medium
An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
CVE-2019-6472 1 Isc 1 Kea 2024-11-21 6.5 Medium
A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2.
CVE-2019-6462 1 Cairographics 1 Cairo 2024-11-21 6.5 Medium
An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.
CVE-2019-6461 1 Cairographics 1 Cairo 2024-11-21 6.5 Medium
An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
CVE-2019-6287 1 Suse 1 Rancher 2024-11-21 N/A
In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed from it.
CVE-2019-6116 6 Artifex, Canonical, Debian and 3 more 12 Ghostscript, Ubuntu Linux, Debian Linux and 9 more 2024-11-21 7.8 High
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.
CVE-2019-5953 2 Gnu, Redhat 6 Wget, Enterprise Linux, Rhel Aus and 3 more 2024-11-21 N/A
Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors.
CVE-2019-5885 2 Fedoraproject, Matrix 2 Fedora, Synapse 2024-11-21 N/A
Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
CVE-2019-5826 2 Google, Redhat 2 Chrome, Rhel Extras 2024-11-21 6.5 Medium
Use after free in IndexedDB in Google Chrome prior to 73.0.3683.86 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.