CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
751 CVE-2018-14964 79 XSS 2018-08-06 2018-10-04
3.5
None Remote Medium Single system None Partial None
An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page.
752 CVE-2018-14962 79 XSS 2018-08-06 2018-10-04
3.5
None Remote Medium Single system None Partial None
zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.
753 CVE-2018-14937 79 XSS 2018-08-04 2018-09-27
3.5
None Remote Medium Single system None Partial None
The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field.
754 CVE-2018-14936 79 XSS 2018-08-04 2018-09-27
3.5
None Remote Medium Single system None Partial None
The Add page option in my little forum 2.4.12 allows XSS via the Title field.
755 CVE-2018-14934 284 2018-11-15 2018-12-19
3.3
None Local Network Low Not required Partial None None
The Bluetooth subsystem on Polycom Trio devices with software before 5.5.4 has Incorrect Access Control. An attacker can connect without authentication and subsequently record audio from the device microphone.
756 CVE-2018-14890 79 XSS 2018-09-21 2018-11-07
3.5
None Remote Medium Single system None Partial None
Vectra Networks Cognito Brain and Sensor before 4.2 contains a cross-site scripting (XSS) vulnerability in the Web Management Console.
757 CVE-2018-14877 79 XSS 2018-08-02 2018-09-27
3.5
None Remote Medium Single system None Partial None
An issue was discovered in WeaselCMS v0.3.5. XSS exists via Site Language, Site Title, Site Description, and Site Keywords on the SETTINGS page.
758 CVE-2018-14875 79 XSS 2019-04-30 2019-05-03
3.5
None Remote Medium Single system None Partial None
An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the Customerid, formName, FrameId, or MODE parameter.
759 CVE-2018-14873 79 XSS 2018-08-02 2018-09-27
3.5
None Remote Medium Single system None Partial None
An issue was discovered in Rincewind 0.1. There is a cross-site scripting (XSS) vulnerability involving a p=account request to index.php and another file named commonPages.php.
760 CVE-2018-14869 79 XSS 2018-08-06 2018-10-04
3.5
None Remote Medium Single system None Partial None
PHP Template Store Script 3.0.6 allows XSS via the Address line 1, Address Line 2, Bank name, or A/C Holder name field in a profile.
761 CVE-2018-14853 476 Exec Code 2018-12-17 2019-01-08
3.3
None Local Network Low Not required None None Partial
A NULL pointer dereference in dhd_prot_txdata_write_flush in drivers/net/wireless/bcmdhd4358/dhd_msgbuf.c in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 allows an attacker (who has obtained code execution on the Wi-Fi chip) to cause the device to reboot. The Samsung ID is SVE-2018-11783.
762 CVE-2018-14850 79 +Priv XSS 2018-08-13 2018-10-10
3.5
None Remote Medium Single system None Partial None
Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image.
763 CVE-2018-14849 79 XSS 2018-08-13 2018-10-10
3.5
None Remote Medium Single system None Partial None
Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php.
764 CVE-2018-14846 79 XSS 2018-12-20 2019-01-24
3.5
None Remote Medium Single system None Partial None
The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.
765 CVE-2018-14837 79 XSS 2018-08-10 2018-10-05
3.5
None Remote Medium Single system None Partial None
Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI.
766 CVE-2018-14835 79 XSS 2018-08-01 2018-09-28
3.5
None Remote Medium Single system None Partial None
Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.
767 CVE-2018-14777 79 XSS 2018-08-01 2018-10-02
3.5
None Remote Medium Single system None Partial None
An issue was discovered in DataLife Engine (DLE) through 13.0. An attacker can use XSS (related to the /addnews.html and /index.php?do=addnews URIs) to send a malicious script to unsuspecting Admins or users.
768 CVE-2018-14776 79 XSS 2018-08-01 2018-09-27
3.5
None Remote Medium Single system None Partial None
Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document.
769 CVE-2018-14664 79 Exec Code XSS 2018-10-12 2019-05-14
3.5
None Remote Medium Single system None Partial None
A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side.
770 CVE-2018-14636 284 2018-09-10 2018-12-07
3.5
None Remote Medium Single system Partial None None
Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.
771 CVE-2018-14606 79 XSS 2018-07-26 2018-09-18
3.5
None Remote Medium Single system None Partial None
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur via a Milestone name during a promotion.
772 CVE-2018-14605 79 XSS 2018-07-26 2018-09-18
3.5
None Remote Medium Single system None Partial None
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2. XSS can occur in the branch name during a Web IDE file commit.
773 CVE-2018-14541 79 XSS 2018-08-03 2018-09-27
3.5
None Remote Medium Single system None Partial None
PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.
774 CVE-2018-14526 320 2018-08-08 2019-05-08
3.3
None Local Network Low Not required Partial None None
An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, leading to a decryption oracle. An attacker within range of the Access Point and client can abuse the vulnerability to recover sensitive information.
775 CVE-2018-14497 79 XSS 2018-08-03 2018-09-28
3.5
None Remote Medium Single system None Partial None
Tenda D152 ADSL routers allow XSS via a crafted SSID.
776 CVE-2018-14432 200 Bypass +Info 2018-07-31 2018-10-12
3.5
None Remote Medium Single system Partial None None
In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.
777 CVE-2018-14419 79 XSS 2018-07-19 2018-09-14
3.5
None Remote Medium Single system None Partial None
MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.
778 CVE-2018-14397 79 XSS 2018-09-07 2018-10-31
3.5
None Remote Medium Single system None Partial None
An issue was discovered in Creme CRM 1.6.12. The organization creation page is affected by 9 stored cross-site scripting vulnerabilities involving the name, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters.
779 CVE-2018-14396 79 XSS 2018-09-07 2018-10-31
3.5
None Remote Medium Single system None Partial None
An issue was discovered in Creme CRM 1.6.12. The salesman creation page is affected by 10 stored cross-site scripting vulnerabilities involving the firstname, lastname, billing_address-address, billing_address-zipcode, billing_address-city, billing_address-department, shipping_address-address, shipping_address-zipcode, shipping_address-city, and shipping_address-department parameters.
780 CVE-2018-14388 79 XSS 2018-07-18 2018-09-12
3.5
None Remote Medium Single system None Partial None
joyplus-cms 1.6.0 has XSS via the manager/admin_ajax.php can_search_device array parameter.
781 CVE-2018-14329 362 2018-07-16 2019-09-18
3.3
None Local Medium Not required None Partial Partial
In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack.
782 CVE-2018-14082 79 XSS 2018-07-18 2018-09-14
3.5
None Remote Medium Single system None Partial None
PHP Scripts Mall JOB SITE (aka Job Portal) 3.0.1 has Cross-site Scripting (XSS) via the search bar.
783 CVE-2018-14059 79 XSS 2018-08-24 2018-11-01
3.5
None Remote Medium Single system None Partial None
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.
784 CVE-2018-14008 287 2019-08-15 2019-08-28
3.3
None Local Network Low Not required None None Partial
Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled.
785 CVE-2018-13999 79 XSS 2018-07-12 2018-09-04
3.5
None Remote Medium Single system None Partial None
Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator).
786 CVE-2018-13998 79 XSS 2018-07-12 2018-09-04
3.5
None Remote Medium Single system None Partial None
ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -> Manager Users or (2) Security -> Web Users.
787 CVE-2018-13879 79 XSS 2018-07-10 2018-09-05
3.5
None Remote Medium Single system None Partial None
A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via packages/rocketchat-ui-login/client/username/username.js in packages/rocketchat-ui-login/client/username/username.html.
788 CVE-2018-13832 79 XSS 2018-07-16 2018-09-13
3.5
None Remote Medium Single system None Partial None
Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plugin 4.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via Apple-Text, GIF-Text, ICO-Text, PNG-Text, or JPG-Text.
789 CVE-2018-13388 79 XSS 2018-07-10 2018-09-04
3.5
None Remote Medium Single system None Partial None
The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.
790 CVE-2018-13357 79 XSS 2018-11-27 2018-12-19
3.5
None Remote Medium Single system None Partial None
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names.
791 CVE-2018-13351 79 XSS 2018-11-27 2018-12-19
3.5
None Remote Medium Single system None Partial None
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the edit password form.
792 CVE-2018-13335 79 XSS 2018-11-27 2018-12-19
3.5
None Remote Medium Single system None Partial None
Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing shared folders via their descriptions.
793 CVE-2018-13293 79 XSS 2019-04-01 2019-04-03
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter.
794 CVE-2018-13137 79 XSS 2019-04-12 2019-08-23
3.5
None Remote Medium Single system None Partial None
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-manager-options URI.
795 CVE-2018-13106 79 XSS 2018-07-03 2018-08-31
3.5
None Remote Medium Single system None Partial None
ClipperCMS 1.3.3 has stored XSS via the "Tools -> Configuration" screen of the manager/ URI.
796 CVE-2018-13002 79 Exec Code XSS 2018-06-29 2018-08-20
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point is located in the Project `Title` and the execution point occurs in the `Inhaltsprojekte` output listing section. Remote attackers with privileged user accounts are able to inject their own malicious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected web-application module output context. The request method to inject is POST.
797 CVE-2018-13000 79 Exec Code XSS 2018-06-29 2018-08-20
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to inject malicious script code payloads as a private message (aka pmbody). The injection point is the editor ftp link element and the execution point occurs in the message body context on arrival. The request method to inject is POST with restricted user privileges.
798 CVE-2018-12992 79 XSS 2018-06-29 2018-08-20
3.5
None Remote Medium Single system None Partial None
An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface.
799 CVE-2018-12981 79 Exec Code XSS 2018-07-12 2018-09-07
3.5
None Remote Medium Single system None Partial None
An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be rendered and/or executed in the browser of the user's browser.
800 CVE-2018-12903 79 XSS 2018-06-26 2018-08-30
3.5
None Remote Medium Single system None Partial None
In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on the create token screen, the VfManager.asmx SelectAccounts->DisplayName screen, a user's groups in ConfigurationPage, the Dialog Title field, and App Group Name in the Application Group Wizard.
Total number of vulnerabilities : 4400   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 (This Page)17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.