Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (336640 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-7669 1 Sitecore 1 Sitecore.net 2024-11-21 N/A
An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file= URI. Validation is performed to ensure that the text passed to the 'file' parameter correlates to the correct log file directory. This filter can be bypassed by including a valid log filename and then appending a traditional 'dot dot' style attack.
CVE-2018-7668 1 Testlink 1 Testlink 2024-11-21 N/A
TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload.php.
CVE-2018-7667 1 Adminer 1 Adminer 2024-11-21 N/A
Adminer through 4.3.1 has SSRF via the server parameter.
CVE-2018-7666 1 Clip-bucket 1 Clipbucket 2024-11-21 N/A
An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL injection vulnerabilities exist in the actions/vote_channel.php channelId parameter, the ajax/commonAjax.php email parameter, and the ajax/commonAjax.php username parameter.
CVE-2018-7665 1 Clip-bucket 1 Clipbucket 2024-11-21 N/A
An issue was discovered in ClipBucket before 4.0.0 Release 4902. A malicious file can be uploaded via the name parameter to actions/beats_uploader.php or actions/photo_uploader.php, or the coverPhoto parameter to edit_account.php.
CVE-2018-7664 1 Clip-bucket 1 Clipbucket 2024-11-21 N/A
An issue was discovered in ClipBucket before 4.0.0 Release 4902. Any OS commands can be injected via shell metacharacters in the file_name parameter to /api/file_uploader.php or /actions/file_downloader.php.
CVE-2018-7663 1 Voten 1 Voten 2024-11-21 N/A
An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio field of a user profile (resources/views/layouts/app.blade.php) allows for server-side template injection of arbitrary JavaScript.
CVE-2018-7662 1 Couchcms 1 Couch 2024-11-21 N/A
Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.
CVE-2018-7661 1 Babyphonemobile 1 Wifi Baby Monitor 2024-11-21 N/A
Papenmeier WiFi Baby Monitor Free & Lite before 2.02.2 allows remote attackers to obtain audio data via certain requests to TCP ports 8258 and 8257.
CVE-2018-7660 1 Opentext 1 Documentum D2 2024-11-21 N/A
In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Reflected Cross-Site Scripting Vulnerability could potentially be exploited by malicious users to compromise the affected system via the servlet/Download _docbase or _username parameter.
CVE-2018-7659 1 Opentext 1 Documentum D2 2024-11-21 N/A
In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Stored Cross-Site Scripting Vulnerability could potentially be exploited by malicious users to compromise the affected system via a filename of an uploaded image file.
CVE-2018-7658 1 Softros 1 Network Time System 2024-11-21 N/A
NTSServerSvc.exe in the server in Softros Network Time System 2.3.4 allows remote attackers to cause a denial of service (daemon crash) by sending exactly 11 bytes.
CVE-2018-7654 1 3cx 1 3cx 2024-11-21 N/A
On 3CX 15.5.6354.2 devices, the parameter "file" in the request "/api/RecordingList/download?file=" allows full access to files on the server via path traversal.
CVE-2018-7653 1 Yzmcms 1 Yzmcms 2024-11-21 N/A
In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.
CVE-2018-7652 1 Zonemaster 1 Zonemaster Web Gui 2024-11-21 6.1 Medium
lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS.
CVE-2018-7651 1 Ssri Project 1 Ssri 2024-11-21 N/A
index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long base64 hash string.
CVE-2018-7650 1 Hot Scripts Clone Project 1 Hot Scripts Clone 2024-11-21 N/A
PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a Management User. Within the "Add New" section, the application does not sanitize user supplied input to the name parameter, and renders injected JavaScript code to the user's browser. This is different from CVE-2018-6878.
CVE-2018-7649 1 Fibranet 1 Monitorix 2024-11-21 N/A
Monitorix before 3.10.1 allows XSS via CGI variables.
CVE-2018-7648 1 Uclouvain 1 Openjpeg 2024-11-21 9.8 Critical
An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buffer, when providing a prefix with 50 or more characters on the command line.
CVE-2018-7644 1 Simplesamlphp 1 Simplesamlphp 2024-11-21 N/A
The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue.