Export limit exceeded: 11697 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11697 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11697 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11697 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-7302 | 1 Tiki | 1 Tiki | 2024-11-21 | N/A |
| Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS. | ||||
| CVE-2018-7289 | 1 Teclib-edition | 1 Armadito Antivirus | 2024-11-21 | N/A |
| An issue was discovered in armadito-windows-driver/src/communication.c in Armadito 0.12.7.2. Malware with filenames containing pure UTF-16 characters can bypass detection. The user-mode service will fail to open the file for scanning after the conversion is done from Unicode to ANSI. This happens because characters that cannot be converted from Unicode are replaced with '?' characters. | ||||
| CVE-2018-7281 | 1 Cactusvpn | 1 Cactusvpn | 2024-11-21 | N/A |
| CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme. The binary takes a single command line argument and passes this argument to a system() call, thus allowing low privileged users to execute commands as root. | ||||
| CVE-2018-7280 | 1 Ninjaforms | 1 Ninja Forms | 2024-11-21 | N/A |
| The Ninja Forms plugin before 3.2.14 for WordPress has XSS. | ||||
| CVE-2018-7278 | 1 Rletech | 4 Fds-pc, Fds-pc-dp, Fds-pc-dp Firmware and 1 more | 2024-11-21 | N/A |
| An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP. | ||||
| CVE-2018-7277 | 1 Rletech | 4 Fds-wi, Fds-wi Firmware, Wi-mgr and 1 more | 2024-11-21 | N/A |
| An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP. | ||||
| CVE-2018-7276 | 1 Lutron | 2 Quantum Bacnet Integration, Quantum Bacnet Integration Firmware | 2024-11-21 | N/A |
| An issue was discovered on Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) devices. Remote attackers can obtain potentially sensitive information via a /DbXmlInfo.xml request, as demonstrated by the Latitude/Longitude of the device. | ||||
| CVE-2018-7274 | 1 Quarx Cms Project | 1 Quarx Cms | 2024-11-21 | 6.1 Medium |
| Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog (Title), FAQ (Question), Pages (Title), Widgets (Name), and Menus (Name). | ||||
| CVE-2018-7273 | 1 Linux | 1 Linux Kernel | 2024-11-21 | N/A |
| In the Linux kernel through 4.15.4, the floppy driver reveals the addresses of kernel functions and global variables using printk calls within the function show_floppy in drivers/block/floppy.c. An attacker can read this information from dmesg and use the addresses to find the locations of kernel code and data and bypass kernel security protections such as KASLR. | ||||
| CVE-2018-7272 | 1 Forgerock | 1 Access Management | 2024-11-21 | N/A |
| The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file. | ||||
| CVE-2018-7271 | 1 Metinfo | 1 Metinfo | 2024-11-21 | N/A |
| An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php configuration file filtering is not rigorous: one can insert malicious code in the installation process to execute arbitrary commands or obtain a web shell. | ||||
| CVE-2018-7265 | 1 Shimmie2 Project | 1 Shimmie2 | 2024-11-21 | N/A |
| Shimmie 2 2.6.0 allows an attacker to upload a crafted SVG file that enables stored XSS. | ||||
| CVE-2018-7263 | 2 Redhat, Underbit | 2 Enterprise Linux, Libmad | 2024-11-21 | N/A |
| The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows remote attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552. | ||||
| CVE-2018-7261 | 1 Radiantcms | 1 Radiant Cms | 2024-11-21 | N/A |
| There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and Configuration (Site Title, Dev Site Domain, Page Parts, and Page Fields). | ||||
| CVE-2018-7260 | 1 Phpmyadmin | 1 Phpmyadmin | 2024-11-21 | N/A |
| Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. | ||||
| CVE-2018-7259 | 1 Flightsimlabs | 1 A320-x | 2024-11-21 | N/A |
| The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs.com/LogHandler3.ashx if a pirated serial number has been entered, which allows remote attackers to obtain sensitive information, e.g., by sniffing the network for cleartext HTTP traffic. This behavior was removed in 2.0.1.232. | ||||
| CVE-2018-6941 | 1 Nat32 | 1 Nat32 | 2024-11-21 | N/A |
| A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS. | ||||
| CVE-2018-6940 | 1 Nat32 | 1 Nat32 | 2024-11-21 | N/A |
| A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF. | ||||
| CVE-2018-6936 | 2 D-link, Dlink | 2 Dir-600m C1 Firmware, Dir-600m C1 | 2024-11-21 | N/A |
| Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account. | ||||
| CVE-2018-6487 | 1 Microfocus | 1 Universal Cmdb Foundation Software | 2024-11-21 | N/A |
| Remote Disclosure of Information in Micro Focus Universal CMDB Foundation Software, version numbers 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 4.10, 4.11. This vulnerability could be remotely exploited to allow disclosure of information. | ||||