Export limit exceeded: 43050 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (43050 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-11121 | 2 Intel, Microsoft | 2 Media Sdk, Windows | 2024-11-21 | 7.8 High |
| Improper file permissions in the installer for the Intel(R) Media SDK for Windows before version 2019 R1 may allow an authenticated user to potentially enable escalation of privilege via local access. | ||||
| CVE-2019-11090 | 1 Intel | 3 Platform Trust Technology Firmware, Server Platform Services Firmware, Trusted Execution Engine Firmware | 2024-11-21 | 5.9 Medium |
| Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) SPS before versions SPS_E5_04.01.04.305.0, SPS_SoC-X_04.00.04.108.0, SPS_SoC-A_04.00.04.191.0, SPS_E3_04.01.04.086.0, SPS_E3_04.08.04.047.0 may allow an unauthenticated user to potentially enable information disclosure via network access. | ||||
| CVE-2019-11071 | 2 Debian, Spip | 2 Debian Linux, Spip | 2024-11-21 | N/A |
| SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled. | ||||
| CVE-2019-11049 | 5 Debian, Fedoraproject, Microsoft and 2 more | 5 Debian Linux, Fedora, Windows and 2 more | 2024-11-21 | 6.5 Medium |
| In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations. | ||||
| CVE-2019-11017 | 1 Dlink | 2 Di-524, Di-524 Firmware | 2024-11-21 | 4.8 Medium |
| On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/smap, as demonstrated by the cgi-bin/smap RC parameter. | ||||
| CVE-2019-10969 | 1 Moxa | 2 Edr-810, Edr-810 Firmware | 2024-11-21 | 7.2 High |
| Moxa EDR 810, all versions 5.1 and prior, allows an authenticated attacker to abuse the ping feature to execute unauthorized commands on the router, which may allow an attacker to perform remote code execution. | ||||
| CVE-2019-10963 | 1 Moxa | 2 Edr-810, Edr-810 Firmware | 2024-11-21 | 4.3 Medium |
| Moxa EDR 810, all versions 5.1 and prior, allows an unauthenticated attacker to be able to retrieve some log files from the device, which may allow sensitive information disclosure. Log files must have previously been exported by a legitimate user. | ||||
| CVE-2019-10906 | 5 Canonical, Fedoraproject, Opensuse and 2 more | 9 Ubuntu Linux, Fedora, Leap and 6 more | 2024-11-21 | 8.6 High |
| In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape. | ||||
| CVE-2019-10893 | 1 Centos-webpanel | 1 Centos Web Panel | 2024-11-21 | N/A |
| CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute. | ||||
| CVE-2019-10868 | 2 Debian, Tryton | 2 Debian Linux, Trytond | 2024-11-21 | 6.5 Medium |
| In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values. | ||||
| CVE-2019-10682 | 1 Django-nopassword Project | 1 Django-nopassword | 2024-11-21 | 7.5 High |
| django-nopassword before 5.0.0 stores cleartext secrets in the database. | ||||
| CVE-2019-10324 | 1 Jfrog | 1 Artifactory | 2024-11-21 | N/A |
| A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, GradleReleaseApiAction#doStaging, MavenReleaseApiAction#doStaging, and UnifiedPromoteBuildAction#doSubmit allowed attackers to schedule a release build, perform release staging for Gradle and Maven projects, and promote previously staged builds, respectively. | ||||
| CVE-2019-10321 | 1 Jfrog | 1 Artifactory | 2024-11-21 | N/A |
| A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ArtifactoryBuilder.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2019-10306 | 1 Jenkins | 1 Ontrack | 2024-11-21 | 9.9 Critical |
| A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM. | ||||
| CVE-2019-10305 | 1 Jenkins | 1 Xebialabs Xl Deploy | 2024-11-21 | 6.5 Medium |
| A missing permission check in Jenkins XebiaLabs XL Deploy Plugin in the Credential#doValidateUserNamePassword form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server. | ||||
| CVE-2019-10303 | 1 Jenkins | 1 Azure Publishersettings Credentials | 2024-11-21 | 8.8 High |
| Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system. | ||||
| CVE-2019-10302 | 1 Jenkins | 1 Jira-ext | 2024-11-21 | 8.8 High |
| Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system. | ||||
| CVE-2019-10301 | 1 Jenkins | 1 Gitlab | 2024-11-21 | 8.8 High |
| A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2019-10300 | 1 Jenkins | 1 Gitlab | 2024-11-21 | N/A |
| A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | ||||
| CVE-2019-10231 | 1 Teclib-edition | 1 Gestionnaire Libre De Parc Informatique | 2024-11-21 | N/A |
| Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPassword() (inc/auth.class.php). | ||||