Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (329540 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-13325 1 Boodskap 1 Growchain 2024-11-21 N/A
The _sell function of a smart contract implementation for GROWCHAIN (GROW), an Ethereum token, has an integer overflow.
CVE-2018-13324 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header.
CVE-2018-13323 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
Cross-site scripting in detail.html in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute JavaScript via the "username" cookie.
CVE-2018-13322 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
Directory traversal in list_folders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "path" parameter.
CVE-2018-13321 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter.
CVE-2018-13320 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters.
CVE-2018-13319 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request.
CVE-2018-13318 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter.
CVE-2018-13317 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm.
CVE-2018-13316 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter.
CVE-2018-13315 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request.
CVE-2018-13314 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter.
CVE-2018-13313 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 6.5 Medium
In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.
CVE-2018-13312 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field.
CVE-2018-13311 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter.
CVE-2018-13310 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username.
CVE-2018-13309 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password.
CVE-2018-13308 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field.
CVE-2018-13307 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST parameter. Certain payloads cause the device to become permanently inoperable.
CVE-2018-13306 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter.