CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
701 CVE-2018-13357 79 XSS 2018-11-27 2018-12-19
3.5
None Remote Medium Single system None Partial None
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names.
702 CVE-2018-13351 79 XSS 2018-11-27 2018-12-19
3.5
None Remote Medium Single system None Partial None
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form.
703 CVE-2018-13335 79 XSS 2018-11-27 2018-12-19
3.5
None Remote Medium Single system None Partial None
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions.
704 CVE-2018-13293 79 XSS 2019-04-01 2019-04-03
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter.
705 CVE-2018-13137 79 XSS 2019-04-12 2019-04-15
3.5
None Remote Medium Single system None Partial None
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
706 CVE-2018-13106 79 XSS 2018-07-03 2018-08-31
3.5
None Remote Medium Single system None Partial None
ClipperCMS 1.3.3 has stored XSS via the "Tools -> Configuration" screen of the manager/ URI.
707 CVE-2018-13002 79 Exec Code XSS 2018-06-29 2018-08-20
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point is located in the Project `Title` and the execution point occurs in the `Inhaltsprojekte` output listing section. Remote attackers with privileged user accounts are able to inject their own malicious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected web-application module output context. The request method to inject is POST.
708 CVE-2018-13000 79 Exec Code XSS 2018-06-29 2018-08-20
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to inject malicious script code payloads as a private message (aka pmbody). The injection point is the editor ftp link element and the execution point occurs in the message body context on arrival. The request method to inject is POST with restricted user privileges.
709 CVE-2018-12992 79 XSS 2018-06-29 2018-08-20
3.5
None Remote Medium Single system None Partial None
An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface.
710 CVE-2018-12981 79 Exec Code XSS 2018-07-12 2018-09-07
3.5
None Remote Medium Single system None Partial None
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be rendered and/or executed in the browser of the user's browser.
711 CVE-2018-12903 79 XSS 2018-06-26 2018-08-30
3.5
None Remote Medium Single system None Partial None
In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on the create token screen, the VfManager.asmx SelectAccounts->DisplayName screen, a user's groups in ConfigurationPage, the Dialog Title field, and App Group Name in the Application Group Wizard.
712 CVE-2018-12716 200 +Info 2018-06-24 2018-08-24
3.3
None Local Network Low Not required Partial None None
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its local network, extracting the scan_results bssid fields, and sending these fields in a geolocation/v1/geolocate Google Maps Geolocation API request.
713 CVE-2018-12672 79 XSS 2018-10-19 2019-01-11
3.5
None Remote Medium Single system None Partial None
The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B) does not perform proper validation on user-supplied input and is vulnerable to cross-site scripting attacks. If proper authorization was implemented, this vulnerability could be leveraged to perform actions on behalf of another user or the administrator.
714 CVE-2018-12607 79 XSS 2018-08-03 2018-10-03
3.5
None Remote Medium Single system None Partial None
An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding.
715 CVE-2018-12606 79 XSS 2018-08-03 2018-10-03
3.5
None Remote Medium Single system None Partial None
An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature.
716 CVE-2018-12605 79 XSS 2018-08-03 2018-10-03
3.5
None Remote Medium Single system None Partial None
An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'url_for' contained a XSS issue due to it allowing arbitrary protocols as a parameter.
717 CVE-2018-12446 287 Bypass 2018-06-20 2018-08-23
3.3
None Local Medium Not required Partial Partial None
** DISPUTED ** An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred.
718 CVE-2018-12445 287 Bypass 2018-06-20 2018-08-23
3.3
None Local Medium Not required Partial Partial None
** DISPUTED ** An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null, because the fingerprint API in conjunction with the Android keyGenerator class is not implemented. In other words, an attacker could authenticate with an arbitrary fingerprint. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred.
719 CVE-2018-12431 79 XSS 2018-06-14 2018-08-02
3.5
None Remote Medium Single system None Partial None
SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin_config.php page (aka a system management page).
720 CVE-2018-12429 79 XSS 2018-07-18 2018-09-14
3.5
None Remote Medium Single system None Partial None
JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie.
721 CVE-2018-12339 79 XSS 2018-06-13 2018-08-02
3.5
None Remote Medium Single system None Partial None
ArticleCMS through 2017-02-19 has XSS via an "add an article" action.
722 CVE-2018-12311 79 XSS 2018-12-04 2018-12-20
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename.
723 CVE-2018-12310 79 XSS 2018-12-04 2018-12-20
3.5
None Remote Medium Single system None Partial None
Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature.
724 CVE-2018-12303 79 XSS 2019-05-13 2019-05-13
3.5
None Remote Medium Single system None Partial None
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names.
725 CVE-2018-12299 79 XSS 2019-05-13 2019-05-13
3.5
None Remote Medium Single system None Partial None
Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names.
726 CVE-2018-12181 119 DoS Overflow 2019-03-27 2019-04-10
3.6
None Local Low Not required None Partial Partial
Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access.
727 CVE-2018-12103 284 2018-07-05 2018-09-04
3.3
None Local Network Low Not required None Partial None
An issue was discovered on D-Link DIR-890L A2 devices. Due to the predictability of the /docs/captcha_(number).jpeg URI, being local to the network, but unauthenticated to the administrator's panel, an attacker can disclose the CAPTCHAs used by the access point and can elect to load the CAPTCHA of their choosing, leading to unauthorized login attempts to the access point.
728 CVE-2018-12100 79 XSS 2018-06-11 2018-08-01
3.5
None Remote Medium Single system None Partial None
Sonatype Nexus Repository Manager before 3.12.0 has XSS in multiple areas in the Administration UI.
729 CVE-2018-12095 79 XSS 2018-06-11 2018-08-01
3.5
None Remote Medium Single system None Partial None
A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php.
730 CVE-2018-12094 79 XSS 2018-06-11 2018-08-01
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
731 CVE-2018-12089 200 +Info 2018-06-11 2018-08-02
3.5
None Remote Medium Single system Partial None None
In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is fixed in 2018.6.0.
732 CVE-2018-12030 79 XSS 2018-06-15 2018-08-01
3.5
None Remote Medium Single system None Partial None
Chevereto Free before 1.0.13 has XSS.
733 CVE-2018-11715 79 XSS 2018-06-04 2018-07-18
3.5
None Remote Medium Single system None Partial None
The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.
734 CVE-2018-11631 284 2018-05-31 2018-07-02
3.3
None Local Network Low Not required None Partial None
Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy (BLE) traffic.
735 CVE-2018-11588 79 XSS 2018-06-25 2018-08-28
3.5
None Remote Medium Single system None Partial None
Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php.
736 CVE-2018-11581 79 XSS 2018-06-01 2018-11-16
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html.
737 CVE-2018-11580 79 XSS 2018-05-30 2018-07-05
3.5
None Remote Medium Single system None Partial None
An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.
738 CVE-2018-11572 79 XSS 2018-05-30 2018-06-27
3.5
None Remote Medium Single system None Partial None
ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.
739 CVE-2018-11564 79 XSS 2018-06-01 2018-07-05
3.5
None Remote Medium Single system None Partial None
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/poc.svg" that will point to http://localhost/pagekit/storage/poc.svg. When a user comes along to click that link, it will trigger a XSS attack.
740 CVE-2018-11559 79 XSS 2018-05-30 2018-11-29
3.5
None Remote Medium Single system None Partial None
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_last_name parameter.
741 CVE-2018-11558 79 XSS 2018-05-30 2018-11-29
3.5
None Remote Medium Single system None Partial None
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" new_first_name parameter.
742 CVE-2018-11549 79 XSS 2018-05-29 2018-06-29
3.5
None Remote Medium Single system None Partial None
An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in "Account Settings -> Member Centre -> Chinese information -> Ordinary member" via a QQ number, as demonstrated by a form[qq_10]= substring.
743 CVE-2018-11512 79 XSS 2018-05-28 2018-06-29
3.5
None Remote Medium Single system None Partial None
Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.
744 CVE-2018-11477 200 +Info 2018-05-30 2018-07-05
3.3
None Local Network Low Not required Partial None None
An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are not encrypted. The combination of this vulnerability with the lack of wireless network protection exposes all transferred car data to the public.
745 CVE-2018-11471 79 XSS 2018-05-25 2018-06-25
3.5
None Remote Medium Single system None Partial None
Cockpit 0.5.5 has XSS via a collection, form, or region.
746 CVE-2018-11448 79 Exec Code XSS 2018-06-26 2018-08-24
3.5
None Remote Medium Single system None Partial None
A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a stored Cross-Site Scripting (XSS) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires that the attacker has access to the web interface of an affected device. The attacker must be authenticated as administrative user on the web interface. Afterwards, a legitimate user must access the web interface. A successful attack could allow an attacker to execute malicious code in the browser of a legitimate user. At the time of advisory publication no public exploitation of this security vulnerability was known.
747 CVE-2018-11430 79 XSS 2018-05-28 2018-06-28
3.5
None Remote Medium Single system None Partial None
An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. The XSS is located in the mod notes textarea.
748 CVE-2018-11403 79 XSS 2018-05-24 2018-06-25
3.5
None Remote Medium Single system None Partial None
DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.
749 CVE-2018-11348 79 XSS 2018-12-04 2018-12-27
3.5
None Remote Medium Single system None Partial None
Two XSS vulnerabilities are located in the profile edition page of the user panel of the YunoHost 2.7.2 through 2.7.14 web application. By injecting a JavaScript payload, these flaws could be used to manipulate a user's session.
750 CVE-2018-11343 79 XSS 2018-05-21 2018-08-16
3.5
None Remote Medium Single system None Partial None
A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attackers to store cross site scripting payloads via the 'playlist' POST parameter.
Total number of vulnerabilities : 4305   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 (This Page)16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.