| CVE-2019-1215 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. Assigned by microsoft | Sep 11, 2019 |
| CVE-2019-1214 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Priv… Assigned by microsoft | Sep 11, 2019 |
| CVE-2019-1253 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on th… Assigned by microsoft | Sep 11, 2019 |
| CVE-2019-1297 Known exploited | High 8.8 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. Assigned by microsoft | Sep 11, 2019 |
| CVE-2019-16256 Known exploited | Critical 9.8 | Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or exe… Assigned by mitre | Sep 12, 2019 |
| CVE-2019-16057 Known exploited | Critical 9.8 | The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. Assigned by mitre | Sep 16, 2019 |
| CVE-2019-1367 Known exploited | High 7.5 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft | Sep 23, 2019 |
| CVE-2019-16759 Known exploited | Critical 9.8 | vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. Assigned by mitre | Sep 24, 2019 |
| CVE-2019-16920 Known exploited | Critical 9.8 | Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. Assigned by mitre | Sep 27, 2019 |
| CVE-2019-16928 Known exploited | Critical 9.8 | Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Assigned by mitre | Sep 27, 2019 |
| CVE-2019-1315 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. Assigned by microsoft | Oct 10, 2019 |
| CVE-2019-1322 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. Assigned by microsoft | Oct 10, 2019 |
| CVE-2019-2215 Known exploited | High 7.8 | A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. Assigned by google_android | Oct 11, 2019 |
| CVE-2019-16278 Known exploited | Critical 9.8 | Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request. Assigned by mitre | Oct 14, 2019 |
| CVE-2019-3010 Known exploited | High 8.8 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). Assigned by oracle | Oct 16, 2019 |
| CVE-2019-11043 Known exploited | High 8.7 | Underflow in PHP-FPM can lead to RCE Assigned by php | Oct 28, 2019 |
| CVE-2019-18187 Known exploited | High 8.8 | Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on… Assigned by trendmicro | Oct 28, 2019 |
| CVE-2019-1388 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerabilit… Assigned by microsoft | Nov 12, 2019 |
| CVE-2019-1385 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability,… Assigned by microsoft | Nov 12, 2019 |
| CVE-2019-1405 Known exploited | High 7.8 | An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerab… Assigned by microsoft | Nov 12, 2019 |
| CVE-2019-1429 Known exploited | High 7.5 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. Assigned by microsoft | Nov 12, 2019 |
| CVE-2019-6693 Known exploited | Medium 6.5 | Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge… Assigned by fortinet | Nov 21, 2019 |
| CVE-2019-19006 Known exploited | Critical 9.8 | Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. Assigned by mitre | Nov 21, 2019 |
| CVE-2019-13720 Known exploited | High 8.8 | Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Nov 25, 2019 |
| CVE-2019-5825 Known exploited | Medium 6.5 | Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Nov 25, 2019 |
| CVE-2019-15271 Known exploited | High 8.8 | Cisco Small Business RV016, RV042, RV042G, and RV082 Routers Arbitrary Command Execution Vulnerability Assigned by cisco | Nov 26, 2019 |
| CVE-2019-7192 Known exploited | Critical 9.8 | This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. Assigned by qnap | Dec 5, 2019 |
| CVE-2019-7193 Known exploited | Critical 9.8 | This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Assigned by qnap | Dec 5, 2019 |
| CVE-2019-7194 Known exploited | Critical 9.8 | This external control of file name or path vulnerability allows remote attackers to access or modify system files. Assigned by qnap | Dec 5, 2019 |
| CVE-2019-7195 Known exploited | Critical 9.8 | This external control of file name or path vulnerability allows remote attackers to access or modify system files. Assigned by qnap | Dec 5, 2019 |
| CVE-2019-5544 Known exploited | Critical 9.8 | OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. Assigned by vmware | Dec 6, 2019 |
| CVE-2019-1458 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. Assigned by microsoft | Dec 10, 2019 |
| CVE-2019-18935 Known exploited | Critical 9.8 | Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. Assigned by mitre | Dec 11, 2019 |
| CVE-2019-7481 Known exploited | High 7.5 | Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. Assigned by sonicwall | Dec 17, 2019 |
| CVE-2019-4716 Known exploited | Critical 10.0 | IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scriptin… Assigned by ibm | Dec 18, 2019 |
| CVE-2019-7287 Known exploited | High 7.8 | A memory corruption issue was addressed with improved input validation. Assigned by apple | Dec 18, 2019 |
| CVE-2019-8526 Known exploited | High 7.8 | A use after free issue was addressed with improved memory management. Assigned by apple | Dec 18, 2019 |
| CVE-2019-8506 Known exploited | High 8.8 | A type confusion issue was addressed with improved memory handling. Assigned by apple | Dec 18, 2019 |
| CVE-2019-7286 Known exploited | High 7.8 | A memory corruption issue was addressed with improved input validation. Assigned by apple | Dec 18, 2019 |
| CVE-2019-8605 Known exploited | High 7.8 | A use after free issue was addressed with improved memory management. Assigned by apple | Dec 18, 2019 |
| CVE-2019-7483 Known exploited | High 7.5 | In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server. Assigned by sonicwall | Dec 19, 2019 |
| CVE-2019-10758 Known exploited | Critical 9.9 | mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. Assigned by snyk | Dec 24, 2019 |
| CVE-2019-19781 Known exploited | Critical 9.8 | An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Assigned by mitre | Dec 27, 2019 |
| CVE-2019-20085 Known exploited | High 7.5 | TVT NVMS-1000 devices allow GET /.. Assigned by mitre | Dec 30, 2019 |
| CVE-2019-17621 Known exploited | Critical 9.8 | The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted… Assigned by mitre | Dec 30, 2019 |
| CVE-2019-17558 Known exploited | High 7.5 | Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. Assigned by apache | Dec 30, 2019 |
| CVE-2020-0601 Known exploited | High 8.1 | A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code… Assigned by microsoft | Jan 14, 2020 |
| CVE-2020-0638 Known exploited | High 7.8 | An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim sys… Assigned by microsoft | Jan 14, 2020 |
| CVE-2020-0646 Known exploited | Critical 9.8 | A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'. Assigned by microsoft | Jan 14, 2020 |
| CVE-2020-2555 Known exploited Healthcare | Critical 9.8 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Assigned by oracle | Jan 15, 2020 |
