Search

Expected end of text, found '/' (at char 24), (line:1, col:25)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (29317 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-7261 1 Radiantcms 1 Radiant Cms 2024-11-21 N/A
There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and Configuration (Site Title, Dev Site Domain, Page Parts, and Page Fields).
CVE-2018-7260 1 Phpmyadmin 1 Phpmyadmin 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVE-2018-7259 1 Flightsimlabs 1 A320-x 2024-11-21 N/A
The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs.com/LogHandler3.ashx if a pirated serial number has been entered, which allows remote attackers to obtain sensitive information, e.g., by sniffing the network for cleartext HTTP traffic. This behavior was removed in 2.0.1.232.
CVE-2018-7196 1 Osticket 1 Osticket 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter.
CVE-2018-7195 1 Osticket 1 Osticket 2024-11-21 N/A
Enhancesoft osTicket before 1.10.2 allows remote attackers to reset arbitrary passwords (when an associated e-mail address is known) by leveraging guest access and guessing a 6-digit number.
CVE-2018-7194 1 Osticket 1 Osticket 2024-11-21 N/A
Integer format vulnerability in the ticket number generator in Enhancesoft osTicket before 1.10.2 allows remote attackers to cause a denial-of-service (preventing the creation of new tickets) via a large number of digits in the ticket number format setting.
CVE-2018-7193 1 Osticket 1 Osticket 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter.
CVE-2018-7192 1 Osticket 1 Osticket 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in /ajax.php/form/help-topic in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "message" parameter.
CVE-2018-7158 1 Nodejs 1 Node.js 2024-11-21 7.5 High
The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.
CVE-2018-6941 1 Nat32 1 Nat32 2024-11-21 N/A
A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS.
CVE-2018-6940 1 Nat32 1 Nat32 2024-11-21 N/A
A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF.
CVE-2018-6936 2 D-link, Dlink 2 Dir-600m C1 Firmware, Dir-600m C1 2024-11-21 N/A
Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.
CVE-2018-6890 1 Wolfcms 1 Wolf Cms 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/page/edit/3.
CVE-2018-6883 1 Piwigo 1 Piwigo 2024-11-21 N/A
Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator.
CVE-2018-6868 1 Groupon Clone Script Project 1 Groupon Clone Script 2024-11-21 N/A
Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.
CVE-2018-6866 1 Learning And Examination Management System Script Project 1 Learning And Examination Management System Script 2024-11-21 N/A
Cross Site Scripting (XSS) exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message.
CVE-2018-6859 1 Schools Alert Management Script Project 1 Schools Alert Management Script 2024-11-21 N/A
SQL Injection exists in PHP Scripts Mall Schools Alert Management Script 2.0.2 via the Login Parameter.
CVE-2018-6764 3 Canonical, Debian, Redhat 8 Ubuntu Linux, Debian Linux, Enterprise Linux and 5 more 2024-11-21 N/A
util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.
CVE-2018-6608 1 Opera 1 Opera Browser 2024-11-21 N/A
In the WebRTC component in Opera 51.0.2830.55, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.
CVE-2018-6588 1 Ca 1 Api Developer Portal 2024-11-21 6.1 Medium
CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer.