Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323605 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-18432 1 Destoon 1 Destoon B2b 2024-11-21 N/A
An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request.
CVE-2018-18431 1 Destoon 1 Destoon B2b 2024-11-21 N/A
An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI.
CVE-2018-18430 1 Destoon 1 Destoon B2b 2024-11-21 N/A
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI.
CVE-2018-18428 1 Tp-link 2 Tl-sc3130, Tl-sc3130 Firmware 2024-11-21 N/A
TP-Link TL-SC3130 1.6.18P12_121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI.
CVE-2018-18427 1 S-cms 1 S-cms 2024-11-21 N/A
s-cms 3.0 allows SQL Injection via the member/post.php 0_id parameter or the POST data to member/member_login.php.
CVE-2018-18426 1 S-cms 1 S-cms 2024-11-21 N/A
s-cms 3.0 allows remote attackers to execute arbitrary PHP code by placing this code in a crafted User-agent Disallow value in the robots.php txt parameter.
CVE-2018-18425 1 Primeo Project 1 Primeo 2024-11-21 N/A
The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.)
CVE-2018-18422 1 Usualtool 1 Usualtoolcms 2024-11-21 N/A
UsualToolCMS 8.0 allows CSRF for adding a user account via the cmsadmin/a_adminx.php?x=a URI.
CVE-2018-18420 1 Tribalsystems 1 Zenario 2024-11-21 N/A
Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent URI.
CVE-2018-18419 1 Ardawan 1 User Management 2024-11-21 N/A
Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1, as demonstrated by a .jpg filename to the /account URI.
CVE-2018-18417 1 Creativeitem 1 Ekushey Project Manager 2024-11-21 N/A
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI.
CVE-2018-18416 1 Pokkho 1 Lango 2024-11-21 N/A
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name parameter to the admin/settings/update URI.
CVE-2018-18409 3 Canonical, Digitalcorpora, Fedoraproject 3 Ubuntu Linux, Tcpflow, Fedora 2024-11-21 N/A
A stack-based buffer over-read exists in setbit() at iptree.h of TCPFLOW 1.5.0, due to received incorrect values causing incorrect computation, leading to denial of service during an address_histogram call or a get_histogram call.
CVE-2018-18408 2 Broadcom, Fedoraproject 2 Tcpreplay, Fedora 2024-11-21 N/A
A use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0 beta1. The issue gets triggered in the function post_args() at tcpbridge.c, causing a denial of service or possibly unspecified other impact.
CVE-2018-18407 2 Broadcom, Fedoraproject 2 Tcpreplay, Fedora 2024-11-21 N/A
A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1, during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h, causing a denial of service.
CVE-2018-18406 1 Tufin 2 Securetrack, Tufinos 2024-11-21 N/A
An issue was discovered in Tufin SecureTrack 18.1 with TufinOS 2.16 build 1179(Final). The Audit Report module is affected by a blind XXE vulnerability when a new Best Practices Report is saved using a special payload inside the xml input field. The XXE vulnerability is blind since the response doesn't directly display a requested file, but rather returns it inside the name data field when the report is saved. An attacker is able to view restricted operating system files. This issue affects all types of users: administrators or normal users.
CVE-2018-18405 1 Jquery 1 Jquery 2024-11-21 6.1 Medium
jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry
CVE-2018-18399 1 Jco 1 Karma 2024-11-21 N/A
SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter.
CVE-2018-18398 1 Xfce 2 Thunar, Xfce 2024-11-21 N/A
Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out-of-bounds read and SEGV. This could potentially be exploited by an arbitrary local user who creates files in /tmp before the victim uses this input method.
CVE-2018-18397 3 Canonical, Linux, Redhat 12 Ubuntu Linux, Linux Kernel, Enterprise Linux and 9 more 2024-11-21 N/A
The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.