Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323598 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-16250 1 Creatiwity 1 Witycms 2024-11-21 N/A
The "utilisateur" menu in Creatiwity wityCMS 0.6.2 modifies the presence of XSS at two input points for user information, with the "first name" and "last name" parameters.
CVE-2018-16249 1 B3log 1 Symphony 2024-11-21 N/A
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
CVE-2018-16248 1 B3log 1 Solo 2024-11-21 N/A
b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request.
CVE-2018-16247 1 Yzmcms 1 Yzmcms 2024-11-21 N/A
YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter.
CVE-2018-16243 1 Solarwinds 1 Database Performance Analyzer 2024-11-21 5.4 Medium
SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen.
CVE-2018-16242 1 O.bike 3 Obike-stationless Bike Sharing, Smart Locker, Smart Locker Firmware 2024-11-21 N/A
oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Low Energy (BLE) to replay ciphertext based on a predictable nonce used in the locking protocol.
CVE-2018-16239 1 Damicms 1 Damicms 2024-11-21 N/A
An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.
CVE-2018-16238 1 Damicms 1 Damicms 2024-11-21 N/A
An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file.
CVE-2018-16237 1 Damicms 1 Damicms 2024-11-21 N/A
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI.
CVE-2018-16236 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering.
CVE-2018-16235 1 Telligent 1 Community 2024-11-21 N/A
Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget.
CVE-2018-16234 1 Morningstarsecurity 1 Whatweb 2024-11-21 N/A
MorningStar WhatWeb 0.4.9 has XSS via JSON report files.
CVE-2018-16233 1 1234n 1 Minicms 2024-11-21 N/A
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
CVE-2018-16232 1 Ipfire 1 Ipfire 2024-11-21 8.8 High
An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authenticated user with privileges for the affected page to execute arbitrary commands.
CVE-2018-16231 1 Michael-roth-software 1 Pftp 2024-11-21 N/A
Michael Roth Software Personal FTP Server (PFTP) through 8.4f allows remote attackers to cause a denial of service (daemon crash) via an unspecified sequence of FTP commands.
CVE-2018-16229 7 Apple, Debian, F5 and 4 more 7 Mac Os X, Debian Linux, Traffix Signaling Delivery Controller and 4 more 2024-11-21 7.5 High
The DCCP parser in tcpdump before 4.9.3 has a buffer over-read in print-dccp.c:dccp_print_option().
CVE-2018-16227 6 Apple, Debian, Fedoraproject and 3 more 6 Mac Os X, Debian Linux, Fedora and 3 more 2024-11-21 7.5 High
The IEEE 802.11 parser in tcpdump before 4.9.3 has a buffer over-read in print-802_11.c for the Mesh Flags subfield.
CVE-2018-16226 1 Mitel 1 Mivoice Office 400 2024-11-21 N/A
A vulnerability in the web admin component of Mitel MiVoice Office 400, versions R5.0 HF3 (v8839a1) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack, due to insufficient validation for the start.asp page. A successful exploit could allow the attacker to execute arbitrary scripts to access sensitive browser-based information.
CVE-2018-16225 2 Qbeecam, Swisscom 4 Qbee Multi-sensor Camera, Qbee Multi-sensor Camera Firmware, Qbeecam and 1 more 2024-11-21 N/A
The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android), which results in an attacker being able to reuse cookies to bypass authentication and disable the camera.
CVE-2018-16224 1 Ismartalarm 2 Cubeone, Cubeone Firmware 2024-11-21 N/A
Incorrect access control for the diagnostic files of the iSmartAlarm Cube One through 2.2.4.10 allows an attacker to retrieve them via a specifically crafted TCP request to port 12345 and 22306, and access sensitive information from the device.