CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1401 CVE-2017-1000478 79 DoS XSS 2018-01-03 2018-01-17
3.5
None Remote Medium Single system None Partial None
ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service.
1402 CVE-2017-1000467 79 Exec Code XSS 2018-01-03 2018-01-17
3.5
None Remote Medium Single system None Partial None
LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.
1403 CVE-2017-1000466 79 Exec Code XSS 2018-01-02 2018-01-16
3.5
None Remote Medium Single system None Partial None
Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code.
1404 CVE-2017-1000465 79 Exec Code XSS 2018-01-09 2018-02-01
3.5
None Remote Medium Single system None Partial None
Sulu-standard version 1.6.6 is vulnerable to stored cross-site scripting vulnerability, within the page creation page, which can result in disruption of service and execution of javascript code.
1405 CVE-2017-1000463 79 Exec Code XSS 2018-01-02 2018-01-17
3.5
None Remote Medium Single system None Partial None
Leafpub version 1.2.0-beta6 is vulnerable to stored cross-site scripting vulnerability, within the edit blog post page, which can result in disruption of service and execution of javascript code.
1406 CVE-2017-1000462 79 Exec Code XSS 2018-01-03 2018-01-17
3.5
None Remote Medium Single system None Partial None
BookStack version 0.18.4 is vulnerable to stored cross-site scripting, within the page creation page, which can result in disruption of service and execution of javascript code.
1407 CVE-2017-1000457 79 XSS 2018-01-02 2018-01-17
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or "Content Administrators" role.
1408 CVE-2017-1000442 79 XSS 2018-01-02 2018-01-16
3.5
None Remote Medium Single system None Partial None
Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace
1409 CVE-2017-1000392 79 XSS 2018-01-25 2019-05-08
3.5
None Remote Medium Single system None Partial None
Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.
1410 CVE-2017-1000386 79 XSS 2018-01-25 2019-06-11
3.5
None Remote Medium Single system None Partial None
Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, for example, arbitrary JavaScript. Active Choices now sanitizes the HTML inserted on the 'Build With Parameters' page if and only if the script is executed in a sandbox. As unsandboxed scripts are subject to administrator approval, it is up to the administrator to allow or disallow problematic script output.
1411 CVE-2017-1000250 200 +Info 2017-09-12 2018-02-16
3.3
None Local Network Low Not required Partial None None
All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.
1412 CVE-2017-1000240 79 XSS 2017-11-16 2017-11-30
3.5
None Remote Medium Single system None Partial None
The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script or HTML.
1413 CVE-2017-1000239 79 XSS 2017-11-16 2017-11-29
3.5
None Remote Medium Single system None Partial None
InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site.
1414 CVE-2017-1000227 79 XSS 2017-11-17 2019-08-24
3.5
None Remote Medium Single system None Partial None
Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can
1415 CVE-2017-1000223 79 XSS 2017-11-17 2017-12-01
3.5
None Remote Medium Single system None Partial None
A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.
1416 CVE-2017-1000213 79 XSS 2017-11-16 2017-11-29
3.5
None Remote Medium Single system None Partial None
WBCE v1.1.11 is vulnerable to reflected XSS via the "begriff" POST parameter in /admin/admintools/tool.php?tool=user_search
1417 CVE-2017-1000164 79 Exec Code XSS 2017-11-17 2017-11-29
3.5
None Remote Medium Single system None Partial None
Tine 2.0 version 2017.02.4 is vulnerable to XSS in the Addressbook resulting code execution and privilege escalation
1418 CVE-2017-1000160 79 XSS 2017-11-17 2017-12-01
3.5
None Remote Medium Single system None Partial None
EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injection
1419 CVE-2017-1000157 200 +Info 2017-11-03 2017-11-13
3.5
None Remote Medium Single system Partial None None
Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the event_log table during the user creation process if full event logging was turned on.
1420 CVE-2017-1000149 79 XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.10 before 1.10.9 and 15.04 before 15.04.6 and 15.10 before 15.10.2 are vulnerable to XSS due to window.opener (target="_blank" and window.open())
1421 CVE-2017-1000146 79 XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.9 before 1.9.7 and 1.10 before 1.10.5 and 15.04 before 15.04.2 are vulnerable to the arbitrary execution of Javascript in the browser of a logged-in user because the title of the portfolio page was not being properly escaped in the AJAX script that updates the Add/remove watchlist link on artefact detail pages.
1422 CVE-2017-1000144 79 XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages.
1423 CVE-2017-1000140 79 Exec Code XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .xml file that can have its code executed when user tries to download the file.
1424 CVE-2017-1000138 79 XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when dragging/dropping files into a collection if the file has Javascript code in its title.
1425 CVE-2017-1000137 79 XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to possible cross site scripting when adding a text block to a page via the keyboard (rather than drag and drop).
1426 CVE-2017-1000132 79 Exec Code XSS 2017-11-03 2017-11-15
3.5
None Remote Medium Single system None Partial None
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .swf files that can have its code executed when a user tries to download the file.
1427 CVE-2017-1000103 79 XSS 2017-10-04 2017-11-01
3.5
None Remote Medium Single system None Partial None
The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view.
1428 CVE-2017-1000102 79 XSS 2017-10-04 2017-11-01
3.5
None Remote Medium Single system None Partial None
The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins, for example the console output which is parsed to extract build warnings (Warnings Plugin), could insert arbitrary HTML into this view.
1429 CVE-2017-1000088 79 XSS 2017-10-04 2017-11-02
3.5
None Remote Medium Single system None Partial None
The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects. There was no input validation, which meant users were able to use javascript: schemes for these links.
1430 CVE-2017-18601 79 XSS 2019-09-10 2019-09-10
3.5
None Remote Medium Single system None Partial None
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
1431 CVE-2017-18600 79 XSS 2019-09-10 2019-09-10
3.5
None Remote Medium Single system None Partial None
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
1432 CVE-2017-18481 79 XSS 2019-08-05 2019-08-07
3.5
None Remote Medium Single system None Partial None
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).
1433 CVE-2017-18473 79 XSS 2019-08-05 2019-08-07
3.5
None Remote Medium Single system None Partial None
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
1434 CVE-2017-18471 79 XSS 2019-08-05 2019-08-07
3.5
None Remote Medium Single system None Partial None
cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).
1435 CVE-2017-18458 20 2019-08-02 2019-08-06
3.6
None Local Low Not required None Partial Partial
cPanel before 62.0.17 allows file overwrite when renaming an account (SEC-219).
1436 CVE-2017-18454 79 XSS 2019-08-02 2019-08-06
3.5
None Remote Medium Single system None Partial None
cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).
1437 CVE-2017-18437 74 Exec Code 2019-08-02 2019-08-09
3.6
None Local Low Not required Partial Partial None
cPanel before 64.0.21 allows a Webmail account to execute code via forwarders (SEC-240).
1438 CVE-2017-18420 79 XSS 2019-08-02 2019-08-05
3.5
None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).
1439 CVE-2017-18419 79 XSS 2019-08-02 2019-08-05
3.5
None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).
1440 CVE-2017-18418 79 XSS 2019-08-02 2019-08-05
3.5
None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).
1441 CVE-2017-18417 79 XSS 2019-08-02 2019-08-05
3.5
None Remote Medium Single system None Partial None
cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).
1442 CVE-2017-18416 284 2019-08-02 2019-08-12
3.6
None Local Low Not required None Partial Partial
cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).
1443 CVE-2017-18408 79 XSS 2019-08-02 2019-08-12
3.5
None Remote Medium Single system None Partial None
cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).
1444 CVE-2017-18402 79 XSS 2019-08-02 2019-08-13
3.5
None Remote Medium Single system None Partial None
cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).
1445 CVE-2017-18286 79 XSS 2018-06-05 2018-07-31
3.5
None Remote Medium Single system None Partial None
nZEDb v0.7.3.3 has XSS in the 404 error page.
1446 CVE-2017-18285 264 2018-06-04 2019-04-02
3.6
None Local Low Not required Partial Partial None
The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change.
1447 CVE-2017-18284 264 2018-06-04 2019-03-29
3.6
None Local Low Not required None Partial Partial
The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL.
1448 CVE-2017-18270 255 DoS 2018-05-18 2018-08-24
3.6
None Local Low Not required None Partial Partial
In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands, setting unwanted defaults or causing a denial of service.
1449 CVE-2017-18259 79 XSS 2018-04-10 2018-05-16
3.5
None Remote Medium Single system None Partial None
Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
1450 CVE-2017-18248 20 2018-03-26 2018-07-12
3.5
None Remote Medium Single system None None Partial
The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.
Total number of vulnerabilities : 4400   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 (This Page)30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.