Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (44404 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-10383 3 Jenkins, Oracle, Redhat 4 Jenkins, Communications Cloud Native Core Automated Test Suite, Openshift and 1 more 2024-11-21 4.8 Medium
A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.
CVE-2019-10376 1 Jenkins 1 Wall Display 2024-11-21 6.1 Medium
A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
CVE-2019-10374 1 Jenkins 1 Pegdown Formatter 2024-11-21 5.4 Medium
A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.
CVE-2019-10373 1 Jenkins 1 Build Pipeline 2024-11-21 5.4 Medium
A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipeline description to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
CVE-2019-10360 1 Jenkins 1 M2 Release 2024-11-21 5.4 Medium
A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
CVE-2019-10349 1 Jenkins 1 Dependency Graph Viewer 2024-11-21 5.4 Medium
A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
CVE-2019-10346 1 Jenkins 1 Embeddable Build Status 2024-11-21 6.1 Medium
A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.
CVE-2019-10336 1 Jenkins 1 Electricflow 2024-11-21 N/A
A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.
CVE-2019-10335 1 Jenkins 1 Electricflow 2024-11-21 N/A
A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in the plugin-provided output on build status pages.
CVE-2019-10325 1 Jenkins 1 Warnings Next Generation 2024-11-21 N/A
A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages.
CVE-2019-10263 1 Ahsay 1 Cloud Backup Suite 2024-11-21 N/A
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to inject XSS in the Alias field, allowing the attacker to retrieve the admin's cookie and take over the account.
CVE-2019-10261 1 Centos-webpanel 1 Centos Web Panel 2024-11-21 N/A
CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action.
CVE-2019-10260 1 Totaljs 1 Total.js Cms 2024-11-21 N/A
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
CVE-2019-10254 1 Misp 1 Misp 2024-11-21 N/A
In MISP before 2.4.105, the app/View/Layouts/default.ctp default layout template has a Reflected XSS vulnerability.
CVE-2019-10241 5 Apache, Debian, Eclipse and 2 more 9 Activemq, Drill, Debian Linux and 6 more 2024-11-21 6.1 Medium
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
CVE-2019-10238 1 Sitemagic 1 Sitemagic 2024-11-21 N/A
Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.
CVE-2019-10227 1 It-novum 1 Openitcockpit 2024-11-21 6.1 Medium
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
CVE-2019-10226 1 Fatfreecrm 1 Fat Free Crm 2024-11-21 N/A
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.
CVE-2019-10221 2 Dogtagpki, Redhat 3 Dogtagpki, Enterprise Linux, Rhel Eus 2024-11-21 4.3 Medium
A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.
CVE-2019-10215 2 Bootstrap-3-typeahead Project, Redhat 2 Bootstrap-3-typeahead, Openshift 2024-11-21 6.1 Medium
Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser.