Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (40776 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-12398 2 Canonical, Mozilla 2 Ubuntu Linux, Firefox 2024-11-21 N/A
By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy (CSP). This vulnerability affects Firefox < 63.
CVE-2018-12355 1 Eng 1 Knowage 2024-11-21 6.1 Medium
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.
CVE-2018-12353 1 Knowage-suite 1 Knowage 2024-11-21 N/A
Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.
CVE-2018-12339 1 Articlecms Project 1 Articlecms 2024-11-21 N/A
ArticleCMS through 2017-02-19 has XSS via an "add an article" action.
CVE-2018-12323 1 Apollotechnologiesinc 2 Momentum Axel 720p, Momentum Axel 720p Firmware 2024-11-21 N/A
An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes it easier for physically proximate attackers to login at the console.
CVE-2018-12319 1 Asustor 2 As602t, Data Master 2024-11-21 N/A
Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title.
CVE-2018-12311 1 Asustor 2 As602t, Data Master 2024-11-21 N/A
Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename.
CVE-2018-12310 1 Asustor 2 As602t, Data Master 2024-11-21 N/A
Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature.
CVE-2018-12305 1 Asustor 1 Data Master 2024-11-21 N/A
Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript.
CVE-2018-12304 1 Seagate 1 Nas Os 2024-11-21 N/A
Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields: Short Description, Publisher Name, Publisher Contact, or Website URL.
CVE-2018-12303 1 Seagate 1 Nas Os 2024-11-21 N/A
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names.
CVE-2018-12302 1 Seagate 1 Nas Os 2024-11-21 N/A
Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting.
CVE-2018-12299 1 Seagate 1 Nas Os 2024-11-21 N/A
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names.
CVE-2018-12297 1 Seagate 1 Nas Os 2024-11-21 N/A
Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names.
CVE-2018-12290 1 Yii2-statemachine 1 Yii2-statemachine 2024-11-21 N/A
The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.
CVE-2018-12273 1 Ximdex 1 Ximdex 2024-11-21 N/A
The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter.
CVE-2018-12272 1 Ximdex 1 Ximdex 2024-11-21 N/A
xowl/request.php in Ximdex 4.0 has XSS via the content parameter.
CVE-2018-12266 1 Hongcms Project 1 Hongcms 2024-11-21 N/A
system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.
CVE-2018-12255 1 Invoiceplane 1 Invoiceplane 2024-11-21 N/A
An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field.
CVE-2018-12246 1 Symantec 1 Web Isolation 2024-11-21 N/A
Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious JavaScript code into the website's rendered copy running inside the end user's web browser. It does not allow injecting code into the real (isolated) copy of the website running on the WI Threat Isolation Engine.