Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (326435 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-9132 2 Debian, Libming 2 Debian Linux, Libming 2024-11-21 N/A
libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted swf file.
CVE-2018-9130 1 Ibos 1 Ibos 2024-11-21 N/A
IBOS 4.4.3 has XSS via a company full name.
CVE-2018-9129 1 Zyxel 34 Usg 110, Usg 1100, Usg 1100 Firmware and 31 more 2024-11-21 N/A
ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN connections.
CVE-2018-9128 1 Dvd-x-player 1 Dvd X Player 2024-11-21 N/A
DVD X Player Standard 5.5.3.9 has a Buffer Overflow via a crafted .plf file, a related issue to CVE-2007-3068.
CVE-2018-9127 1 Botan Project 1 Botan 2024-11-21 N/A
Botan 2.2.0 - 2.4.0 (fixed in 2.5.0) improperly handled wildcard certificates and could accept certain certificates as valid for hostnames when, under RFC 6125 rules, they should not match. This only affects certificates issued to the same domain as the host, so to impersonate a host one must already have a wildcard certificate matching other hosts in the same domain. For example, b*.example.com would match some hostnames that do not begin with a 'b' character.
CVE-2018-9126 1 Zldnn 1 Dnnarticle 2024-11-21 N/A
The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.
CVE-2018-9123 1 Crea8social 1 Crea8social 2024-11-21 N/A
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile.
CVE-2018-9122 1 Crea8social 1 Crea8social 2024-11-21 N/A
In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.
CVE-2018-9121 1 Crea8social 1 Crea8social 2024-11-21 N/A
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.
CVE-2018-9120 1 Crea8social 1 Crea8social 2024-11-21 N/A
In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.
CVE-2018-9119 1 Brilliantts 3 Fuze Card, Fuze Card Ble Firmware, Fuze Card Mcu Firmware 2024-11-21 N/A
An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool.
CVE-2018-9118 1 99robots 1 Wp Background Takeover Advertisements 2024-11-21 N/A
exports/download.php in the 99 Robots WP Background Takeover Advertisements plugin before 4.1.5 for WordPress has Directory Traversal via a .. in the filename parameter.
CVE-2018-9117 1 Wiremock 1 Wiremock 2024-11-21 N/A
WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application directory via a specially crafted XML request, aka Directory Traversal.
CVE-2018-9116 1 Wiremock 1 Wiremock 2024-11-21 N/A
An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause a Denial of Service.
CVE-2018-9115 1 Systematicinc 1 Sitaware 2024-11-21 N/A
Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently. e.g., information utilizing the NVG interface. An attacker can freeze the Situational Layer, which means that the Situational Picture is no longer updated. Unfortunately, the user cannot notice until he tries to work with that layer.
CVE-2018-9113 1 Cdc 1 Microbetrace 2024-11-21 N/A
Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code, related to code injection via a crafted CSV file with an initial '><script type="text/javascript" src=' line. Fix released on 2018-03-29.
CVE-2018-9112 1 Foxconn 2 Ap-fc4064-t, Ap-fc4064-t Firmware 2024-11-21 N/A
A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges by modifying cookies.
CVE-2018-9111 1 Foxconn 2 Ap-fc4064-t, Ap-fc4064-t Firmware 2024-11-21 N/A
Cross Site Scripting (XSS) exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15 via the configuration of a user account. An attacker can execute arbitrary script on an unsuspecting user's browser.
CVE-2018-9110 1 Std42 1 Elfinder 2024-11-21 9.1 Critical
Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.
CVE-2018-9109 1 Std42 1 Elfinder 2024-11-21 9.1 Critical
Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.