CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
601 CVE-2018-16607 79 XSS 2018-09-19 2018-11-07
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field.
602 CVE-2018-16605 79 XSS 2018-09-12 2018-10-30
3.5
None Remote Medium Single system None Partial None
D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.
603 CVE-2018-16595 119 Overflow 2019-06-19 2019-06-24
3.3
None Local Network Low Not required None None Partial
The Photo Sharing Plus component on Sony Bravia TV through 8.587 devices has a Buffer Overflow.
604 CVE-2018-16551 79 XSS 2018-09-05 2018-10-25
3.5
None Remote Medium Single system None Partial None
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.
605 CVE-2018-16468 79 XSS 2018-10-30 2019-01-10
3.5
None Remote Medium Single system None Partial None
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
606 CVE-2018-16464 287 2018-10-30 2019-01-17
3.5
None Remote Medium Single system Partial None None
A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.
607 CVE-2018-16463 384 2018-10-30 2019-01-17
3.6
None Remote High Single system Partial Partial None
A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares.
608 CVE-2018-16379 79 XSS 2018-09-02 2018-11-09
3.5
None Remote Medium Single system None Partial None
Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field on the "Theme/Theme Options" screen.
609 CVE-2018-16374 79 XSS 2018-09-02 2018-10-24
3.5
None Remote Medium Single system None Partial None
Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.
610 CVE-2018-16363 79 XSS 2018-09-07 2018-11-06
3.5
None Remote Medium Single system None Partial None
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
611 CVE-2018-16358 79 XSS 2018-09-02 2018-10-24
3.5
None Remote Medium Single system None Partial None
A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.
612 CVE-2018-16348 79 XSS 2018-09-02 2018-10-25
3.5
None Remote Medium Single system None Partial None
SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.
613 CVE-2018-16346 79 XSS 2018-09-02 2018-11-09
3.5
None Remote Medium Single system None Partial None
ChemCMS 1.0.6 has XSS via the "setting -> website information" field.
614 CVE-2018-16342 79 XSS 2018-09-02 2018-10-24
3.5
None Remote Medium Single system None Partial None
ShowDoc v1.8.0 has XSS via a new page.
615 CVE-2018-16327 79 XSS 2018-09-01 2018-11-09
3.5
None Remote Medium Single system None Partial None
There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.
616 CVE-2018-16316 79 XSS 2018-09-01 2018-11-09
3.5
None Remote Medium Single system None Partial None
A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.
617 CVE-2018-16277 79 XSS 2018-09-27 2018-11-15
3.5
None Remote Medium Single system None Partial None
The Image Import function in XWiki through 10.7 has XSS.
618 CVE-2018-16250 79 XSS 2019-06-20 2019-06-21
3.5
None Remote Medium Single system None Partial None
The "utilisateur" menu in Creatiwity wityCMS 0.6.2 modifies the presence of XSS at two input points for user information, with the "first name" and "last name" parameters.
619 CVE-2018-16249 79 XSS 2019-06-20 2019-06-21
3.5
None Remote Medium Single system None Partial None
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.
620 CVE-2018-16247 79 XSS 2019-06-20 2019-06-20
3.5
None Remote Medium Single system None Partial None
YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter.
621 CVE-2018-16219 287 2019-04-25 2019-04-26
3.3
None Local Network Low Not required None Partial None
A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the same network as the device) to change the admin password without authentication via a POST request.
622 CVE-2018-16205 79 XSS 2019-01-09 2019-01-16
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal.
623 CVE-2018-16204 79 XSS 2019-01-09 2019-01-16
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
624 CVE-2018-16193 79 XSS 2019-01-09 2019-01-17
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
625 CVE-2018-16192 200 +Info 2019-01-09 2019-01-17
3.3
None Local Network Low Not required Partial None None
Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same network segment to obtain information registered on the device via unspecified vectors.
626 CVE-2018-16164 79 XSS 2019-01-09 2019-01-16
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
627 CVE-2018-16138 79 XSS 2019-05-13 2019-05-15
3.5
None Remote Medium Single system None Partial None
An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities.
628 CVE-2018-15917 79 XSS 2018-09-05 2018-10-24
3.5
None Remote Medium Single system None Partial None
Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.
629 CVE-2018-15903 79 XSS 2018-10-08 2018-11-26
3.5
None Remote Medium Single system None Partial None
The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS). An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies from high privilege accounts and hijack these, enabling them to hijack the elevated session and perform actions in their security context.
630 CVE-2018-15896 79 XSS 2018-08-28 2018-10-31
3.5
None Remote Medium Single system None Partial None
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.
631 CVE-2018-15891 79 XSS 2019-06-20 2019-06-27
3.5
None Remote Medium Single system None Partial None
An issue was discovered in FreePBX core before 3.0.122.43, 14.0.18.34, and 5.0.1beta4. By crafting a request for adding Asterisk modules, an attacker is able to store JavaScript commands in a module name.
632 CVE-2018-15880 79 XSS 2018-08-28 2018-11-02
3.5
None Remote Medium Single system None Partial None
An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack.
633 CVE-2018-15843 79 XSS 2018-08-25 2018-10-17
3.5
None Remote Medium Single system None Partial None
GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.
634 CVE-2018-15842 79 XSS 2018-08-25 2018-10-17
3.5
None Remote Medium Single system None Partial None
WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter.
635 CVE-2018-15800 200 +Info 2018-12-10 2019-04-01
3.5
None Remote Medium Single system Partial None None
Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage.
636 CVE-2018-15713 79 XSS 2018-11-14 2018-12-06
3.5
None Remote Medium Single system None Partial None
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.
637 CVE-2018-15707 79 XSS 2018-10-31 2018-12-12
3.5
None Remote Medium Single system None Partial None
Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things.
638 CVE-2018-15701 20 DoS 2018-10-01 2018-11-27
3.3
None Local Network Low Not required None None Partial
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header containing an unexpected Cookie field.
639 CVE-2018-15693 285 Bypass 2018-11-16 2018-12-19
3.5
None Remote Medium Single system None Partial None
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object reference.
640 CVE-2018-15692 285 Bypass 2018-11-16 2018-12-19
3.5
None Remote Medium Single system None Partial None
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain functions.
641 CVE-2018-15570 79 XSS 2018-08-19 2018-10-19
3.5
None Remote Medium Single system None Partial None
In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.
642 CVE-2018-15451 79 Exec Code XSS 2018-11-08 2018-11-20
3.5
None Remote Medium Single system None Partial None
A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.
643 CVE-2018-15426 79 Exec Code XSS 2018-10-05 2018-11-26
3.5
None Remote Medium Single system None Partial None
A vulnerability in the web-based interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the web-based interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
644 CVE-2018-15392 399 DoS 2018-10-05 2019-01-11
3.3
None Local Network Low Not required None None Partial
A vulnerability in the DHCP service of Cisco Industrial Network Director could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper handling of DHCP lease requests. An attacker could exploit this vulnerability by sending malicious DHCP lease requests to an affected application. A successful exploit could allow the attacker to cause the DHCP service to terminate, resulting in a DoS condition.
645 CVE-2018-15365 79 XSS Bypass CSRF 2018-09-28 2018-11-16
3.5
None Remote Medium Single system None Partial None
A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability.
646 CVE-2018-15199 79 XSS 2018-08-07 2018-10-04
3.5
None Remote Medium Single system None Partial None
AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.
647 CVE-2018-15190 79 XSS 2018-08-10 2018-10-06
3.5
None Remote Medium Single system None Partial None
PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field.
648 CVE-2018-15189 79 XSS 2018-08-10 2018-10-05
3.5
None Remote Medium Single system None Partial None
PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.
649 CVE-2018-15184 79 XSS 2018-08-09 2018-10-09
3.5
None Remote Medium Single system None Partial None
PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795.
650 CVE-2018-15182 79 XSS 2018-08-09 2018-10-05
3.5
None Remote Medium Single system None Partial None
PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields.
Total number of vulnerabilities : 4305   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 (This Page)14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.