Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,818

Export CSV
CVE-2019-16769

Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Verizon
Products
Openshift Service Mesh Serialize-javascript
CVE-2019-16746

kernel: buffer-overflow hardening in WiFi beacon validation code.

An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of variable elements in a beacon head, leading to a buffer overflow.

CVSS 3.1 · 9.8 Critical EPSS 12.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2019-16680

file-roller: path traversal vulnerability via a specially crafted filename contained in malicious archive

An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.

CVSS 3.1 · 4.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Gnome and 1 more
Products
Ubuntu Linux Debian Linux File-roller and 1 more
CVE-2019-16541

jenkins-jira-plugin: plugin information disclosure

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.

CVSS 3.1 · 9.9 Critical EPSS 1.7% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jira Openshift
CVE-2019-16538

jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed scripts

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Jenkins Redhat
Products
Script Security Openshift
CVE-2019-16276

golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 3 more
Products
Debian Linux Fedora Go and 8 more
CVE-2019-16255

ruby: Code injection via command argument of Shell#test / Shell#[]

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.

CVSS 3.1 · 8.1 High EPSS 4.2% KEV · Not listed
Vendors
Debian Opensuse Oracle and 2 more
Products
Debian Linux Leap Graalvm and 5 more
CVE-2019-16254

ruby: HTTP response splitting in WEBrick

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.

CVSS 3.1 · 5.3 Medium EPSS 4.6% KEV · Not listed
Vendors
Debian Redhat Ruby-lang
Products
Debian Linux Enterprise Linux Rhel E4s and 3 more
CVE-2019-16234

kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c

drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Opensuse and 1 more
Products
Ubuntu Linux Linux Kernel Leap and 1 more
CVE-2019-16233

kernel: null pointer dereference in drivers/scsi/qla2xxx/qla_os.c

drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Opensuse and 1 more
Products
Ubuntu Linux Linux Kernel Leap and 2 more
CVE-2019-16231

kernel: null-pointer dereference in drivers/net/fjes/fjes_main.c

drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Opensuse and 1 more
Products
Ubuntu Linux Linux Kernel Leap and 2 more
CVE-2019-16229

kernel: null pointer dereference in drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c

drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: The security community disputes this issues as not being serious enough to be deserving a CVE id

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux
CVE-2019-16201

ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.

CVSS 3.1 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Debian Redhat Ruby-lang
Products
Debian Linux Enterprise Linux Rhel E4s and 3 more