Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (324453 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-5306 1 Sonatype 1 Nexus Repository Manager 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the repoId or (2) format parameter to service/siesta/healthcheck/healthCheckFileDetail/.../index.html; (3) the filename in the "File Upload" functionality of the Staging Upload; (4) the username when creating a new user; or (5) the IQ Server URL field in the IQ Server Connection functionality.
CVE-2018-5304 1 Impinj 2 R420 Rfid Reader, R420 Rfid Reader Firmware 2024-11-21 N/A
An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The affected web interface is vulnerable to ClickJacking or UI Redressing: it is possible to access the web application in an iframe, and clicking on the iframe will redirect to a third-party application or perform other malicious actions.
CVE-2018-5303 1 Impinj 2 R420 Rfid Reader, R420 Rfid Reader Firmware 2024-11-21 N/A
An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The license key parameter of the web application is vulnerable to Cross Site Scripting; this vulnerability allows an attacker to send malicious code to another user.
CVE-2018-5301 1 Magento 1 Magento 2024-11-21 N/A
Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.
CVE-2018-5299 1 Pulsesecure 2 Pulse Connect Secure, Pulse Policy Secure 2024-11-21 N/A
A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Policy Secure (PPS) before 5.4R4, leading to memory corruption and possibly remote code execution.
CVE-2018-5298 1 Pg 1 Oral-b App 2024-11-21 N/A
In the Procter & Gamble "Oral-B App" (aka com.pg.oralb.oralbapp) application 5.0.0 for Android, AES encryption with static parameters is used to secure the locally stored shared preferences. An attacker can gain access to locally stored user data more easily by leveraging access to the preferences XML file.
CVE-2018-5296 1 Podofo Project 1 Podofo 2024-11-21 N/A
In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PdfParser::ReadXRefSubsection function (base/PdfParser.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.
CVE-2018-5295 1 Podofo Project 1 Podofo 2024-11-21 N/A
In PoDoFo 0.9.5, there is an integer overflow in the PdfXRefStreamParserObject::ParseStream function (base/PdfXRefStreamParserObject.cpp). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted pdf file.
CVE-2018-5294 2 Debian, Libming 2 Debian Linux, Libming 2024-11-21 N/A
In libming 0.4.8, there is an integer overflow (caused by an out-of-range left shift) in the readUInt32 function (util/read.c). Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted swf file.
CVE-2018-5293 1 Gd Rating System Project 1 Gd Rating System 2024-11-21 N/A
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
CVE-2018-5292 1 Gd Rating System Project 1 Gd Rating System 2024-11-21 N/A
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
CVE-2018-5291 1 Gd Rating System Project 1 Gd Rating System 2024-11-21 N/A
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
CVE-2018-5290 1 Gd Rating System Project 1 Gd Rating System 2024-11-21 N/A
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
CVE-2018-5289 1 Gd Rating System Project 1 Gd Rating System 2024-11-21 N/A
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
CVE-2018-5288 1 Gd Rating System Project 1 Gd Rating System 2024-11-21 N/A
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
CVE-2018-5287 1 Gd Rating System Project 1 Gd Rating System 2024-11-21 N/A
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
CVE-2018-5286 1 Gd Rating System Project 1 Gd Rating System 2024-11-21 N/A
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
CVE-2018-5285 1 Wpscoop 1 Imageinject 2024-11-21 N/A
The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.
CVE-2018-5284 1 Wpscoop 1 Imageinject 2024-11-21 N/A
The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.
CVE-2018-5283 1 Photos In Wifi Project 1 Photos In Wifi 2024-11-21 N/A
The Photos in Wifi application 1.0.1 for iOS has directory traversal via the ext parameter to assets-library://asset/asset.php.