Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (94580 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-15894 1 Espressif 1 Esp-idf 2024-11-21 6.8 Medium
An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. An attacker who uses fault injection to physically disrupt the ESP32 CPU can bypass the Secure Boot digest verification at startup, and boot unverified code from flash. The fault injection attack does not disable the Flash Encryption feature, so if the ESP32 is configured with the recommended combination of Secure Boot and Flash Encryption, then the impact is minimized. If the ESP32 is configured without Flash Encryption then successful fault injection allows arbitrary code execution. To protect devices with Flash Encryption and Secure Boot enabled against this attack, a firmware change must be made to permanently enable Flash Encryption in the field if it is not already permanently enabled.
CVE-2019-15879 1 Freebsd 1 Freebsd 2024-11-21 7.4 High
In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in the cryptodev module permitted a data structure in the kernel to be used after it was freed, allowing an unprivileged process can overwrite arbitrary kernel memory.
CVE-2019-15869 1 Jobcareer Project 1 Jobcareer 2024-11-21 N/A
The JobCareer theme before 2.5.1 for WordPress has stored XSS.
CVE-2019-15867 1 Omaksolutions 1 Slick-popup 2024-11-21 N/A
The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX action.
CVE-2019-15864 1 Holest 1 Breadcrumbs By Menu 2024-11-21 N/A
The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.
CVE-2019-15848 1 Jetbrains 1 Teamcity 2024-11-21 N/A
JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.
CVE-2019-15846 2 Debian, Exim 2 Debian Linux, Exim 2024-11-21 N/A
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
CVE-2019-15842 1 Easy Pdf Restaurant Menu Upload Project 1 Easy Pdf Restaurant Menu Upload 2024-11-21 N/A
The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.
CVE-2019-15838 1 Kunalnagar 1 Custom 404 Pro 2024-11-21 N/A
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.
CVE-2019-15837 1 Bitwise-it 1 Webp Express 2024-11-21 N/A
The webp-express plugin before 0.14.8 for WordPress has stored XSS.
CVE-2019-15836 1 Bootstrapped 1 Wp Ultimate Recipe 2024-11-21 N/A
The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.
CVE-2019-15833 1 Simple Mail Address Encoder Project 1 Simple Mail Address Encoder 2024-11-21 6.1 Medium
The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.
CVE-2019-15830 1 Icegram 1 Icegram Engage 2024-11-21 N/A
The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.
CVE-2019-15829 1 Greentreelabs 1 Gallery Photoblocks 2024-11-21 N/A
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.
CVE-2019-15827 1 Onesignal 1 Onesignal-free-web-push-notifications 2024-11-21 N/A
The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.
CVE-2019-15817 1 Realestateconnected 1 Easy Property Listings 2024-11-21 N/A
The easy-property-listings plugin before 3.4 for WordPress has XSS.
CVE-2019-15816 1 Wpexpertdeveloper 1 Wp Private Content Plus 2024-11-21 N/A
The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.
CVE-2019-15814 1 Sentrifugo 1 Sentrifugo 2024-11-21 N/A
Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML.
CVE-2019-15811 1 Domainmod 1 Domainmod 2024-11-21 N/A
In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.
CVE-2019-15810 1 Netdisco 1 Netdisco 2024-11-21 6.1 Medium
Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter.