CVE Vulnerability Database
Search and browse 394,729 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
17,305 records from 2019Clear filters
- CVE-2013-4665Medium 6.5Dec 27, 2019SPBAS Business Automation Software 2012 has CSRF.
- CVE-2013-4664Medium 6.1Dec 27, 2019SPBAS Business Automation Software 2012 has XSS.
- CVE-2016-1000029Medium 4.8Dec 27, 2019Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact other admins (Tenable IDs 5218 and 5269).
- CVE-2016-1000028Medium 4.8Dec 27, 2019Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. (Tenable ID 5198).
- CVE-2019-19781Critical 9.8KEVDec 27, 2019An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
- CVE-2014-4559Medium 6.1Dec 27, 2019Multiple cross-site scripting (XSS) vulnerabilities in test-plugin.php in the Swipe Checkout for WP e-Commerce plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) api_key, (2) payment_page_url, (3) merchant_id, (4) api_url, or (5) currency parameter.
- CVE-2014-4525Medium 6.1Dec 27, 2019Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.
- CVE-2014-4523Medium 6.1Dec 27, 2019Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- CVE-2019-20043Medium 4.3Dec 27, 2019In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
- CVE-2019-20042Medium 6.1Dec 27, 2019In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
- CVE-2019-20041Critical 9.8Dec 27, 2019wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.
- CVE-2019-20024Medium 6.5Dec 27, 2019A heap-based buffer overflow was discovered in image_buffer_resize in fromsixel.c in libsixel before 1.8.4.
- CVE-2019-20023Medium 6.5Dec 27, 2019A memory leak was discovered in image_buffer_resize in fromsixel.c in libsixel 1.8.4.
- CVE-2019-20022Medium 6.5Dec 27, 2019An invalid memory address dereference was discovered in load_pnm in frompnm.c in libsixel before 1.8.3.
- CVE-2019-20021Medium 5.5Dec 27, 2019A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.
- CVE-2019-20020Medium 6.5Dec 27, 2019A stack-based buffer over-read was discovered in ReadNextStructField in mat5.c in matio 1.5.17.
- CVE-2019-20019Medium 6.5Dec 27, 2019An attempted excessive memory allocation was discovered in Mat_VarRead5 in mat5.c in matio 1.5.17.
- CVE-2019-20018Medium 6.5Dec 27, 2019A stack-based buffer over-read was discovered in ReadNextCell in mat5.c in matio 1.5.17.
- CVE-2019-20017Medium 6.5Dec 27, 2019A stack-based buffer over-read was discovered in Mat_VarReadNextInfo5 in mat5.c in matio 1.5.17.
- CVE-2019-20016Medium 6.5Dec 27, 2019libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c. NOTE: a download of v0.9 after 2019-12-06 should fully remediate this issue.
- CVE-2019-20015Medium 6.5Dec 27, 2019An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in dwg.spec.
- CVE-2019-20014High 8.8Dec 27, 2019An issue was discovered in GNU LibreDWG before 0.93. There is a double-free in dwg_free in free.c.
- CVE-2019-20013Medium 6.5Dec 27, 2019An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to an attempted excessive memory allocation in decode_3dsolid in dwg.spec.
- CVE-2019-20012Medium 6.5Dec 27, 2019An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwg_decode_HATCH_private in dwg.spec.
- CVE-2019-20011High 8.8Dec 27, 2019An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer over-read in decode_R13_R2000 in decode.c.