CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2018-19597 79 XSS 2018-12-19 2019-01-04
3.5
None Remote Medium Single system None Partial None
CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.
102 CVE-2018-19596 79 XSS 2018-12-19 2019-01-04
3.5
None Remote Medium Single system None Partial None
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506.
103 CVE-2018-19508 79 XSS 2018-12-19 2019-01-04
3.5
None Remote Medium Single system None Partial None
CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI.
104 CVE-2018-19507 79 XSS 2018-12-19 2019-01-04
3.5
None Remote Medium Single system None Partial None
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.
105 CVE-2018-19506 79 XSS 2018-12-19 2019-01-04
3.5
None Remote Medium Single system None Partial None
Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI.
106 CVE-2018-19464 79 XSS 2018-11-22 2018-12-19
3.5
None Remote Medium Single system None Partial None
Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code.
107 CVE-2018-19350 79 XSS 2018-11-17 2018-12-17
3.5
None Remote Medium Single system None Partial None
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
108 CVE-2018-19324 79 XSS 2018-11-17 2018-12-17
3.5
None Remote Medium Single system None Partial None
kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.
109 CVE-2018-19311 79 XSS 2018-11-16 2018-12-17
3.5
None Remote Medium Single system None Partial None
Centreon 3.4.x allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
110 CVE-2018-19229 79 XSS 2018-11-12 2018-12-11
3.5
None Remote Medium Single system None Partial None
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter.
111 CVE-2018-19227 79 XSS 2018-11-12 2018-12-11
3.5
None Remote Medium Single system None Partial None
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/liuyan.php neirong[] parameter.
112 CVE-2018-19223 79 XSS 2018-11-12 2018-12-11
3.5
None Remote Medium Single system None Partial None
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI.
113 CVE-2018-19178 79 XSS 2018-11-11 2018-12-13
3.5
None Remote Medium Single system None Partial None
In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulnerability than CVE-2018-17886.
114 CVE-2018-19170 79 XSS 2018-11-11 2018-12-13
3.5
None Remote Medium Single system None Partial None
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name parameter.
115 CVE-2018-19142 79 XSS 2018-11-11 2018-12-12
3.5
None Remote Medium Single system None Partial None
Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL.
116 CVE-2018-19141 79 XSS 2018-11-11 2018-12-12
3.5
None Remote Medium Single system None Partial None
Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and customer preferences are mishandled.
117 CVE-2018-19091 79 XSS 2018-11-07 2018-12-11
3.5
None Remote Medium Single system None Partial None
tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter.
118 CVE-2018-19090 79 XSS 2018-11-07 2018-12-11
3.5
None Remote Medium Single system None Partial None
tianti 2.3 has stored XSS in the article management module via an article title.
119 CVE-2018-19089 79 XSS 2018-11-07 2018-12-11
3.5
None Remote Medium Single system None Partial None
tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/save_role name parameter, which is mishandled in tianti-module-admin\src\main\webapp\WEB-INF\views\user\user_list.jsp.
120 CVE-2018-19072 264 2018-11-07 2018-12-11
3.6
None Local Low Not required None Partial Partial
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/app has 0777 permissions, allowing local users to replace an archive file (within that directory) to control what is extracted to RAM at boot time.
121 CVE-2018-19044 59 2018-11-08 2019-01-09
3.3
None Local Medium Not required None Partial Partial
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.
122 CVE-2018-18952 79 XSS 2018-11-05 2018-12-10
3.5
None Remote Medium Single system None Partial None
JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI.
123 CVE-2018-18943 79 XSS 2018-11-05 2018-12-10
3.5
None Remote Medium Single system None Partial None
An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploader_categories/edit URI.
124 CVE-2018-18939 79 XSS 2018-11-05 2018-11-15
3.5
None Remote Medium Single system None Partial None
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field.
125 CVE-2018-18938 79 XSS 2018-11-05 2018-11-16
3.5
None Remote Medium Single system None Partial None
An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field.
126 CVE-2018-18927 79 XSS 2018-11-04 2018-12-11
3.5
None Remote Medium Single system None Partial None
An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached" attribute (which typically has 'class="icon-globe icon-large"' in its value), as demonstrated by an 'UPDATE sys_module SET attached = "[XSS]" WHERE id="page_list"' statement.
127 CVE-2018-18919 79 XSS 2018-11-04 2018-12-11
3.5
None Remote Medium Single system None Partial None
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area.
128 CVE-2018-18841 79 XSS 2018-10-30 2018-12-06
3.5
None Remote Medium Single system None Partial None
XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexkey parameter.
129 CVE-2018-18840 79 XSS 2018-10-30 2018-12-06
3.5
None Remote Medium Single system None Partial None
XSS was discovered in SEMCMS PHP V3.4 via the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexmetatit parameter.
130 CVE-2018-18807 79 XSS 2018-11-26 2019-01-02
3.5
None Remote Medium Single system None Partial None
The web application of the TIBCO Statistica component of TIBCO Software Inc.'s TIBCO Statistica Server contains vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Statistica Server versions up to and including 13.4.0.
131 CVE-2018-18745 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Menu.php?lgid=1 during editing.
132 CVE-2018-18744 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via the fifth text box to the admin/SEMCMS_Main.php URI.
133 CVE-2018-18743 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via the second text field to the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI.
134 CVE-2018-18741 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via admin/SEMCMS_Download.php?lgid=1 during editing.
135 CVE-2018-18740 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via the first input field to the admin/SEMCMS_Link.php?lgid=1 URI.
136 CVE-2018-18739 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Products.php?lgid=1 Keywords field.
137 CVE-2018-18738 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_Categories.php?pid=1&lgid=1 category_key parameter.
138 CVE-2018-18736 79 XSS 2018-10-29 2018-12-07
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in catfish blog 2.0.33, related to "write source code."
139 CVE-2018-18733 79 XSS 2018-10-29 2018-12-07
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in Catfish CMS 4.8.30, related to "write source code," a similar issue to CVE-2018-13999.
140 CVE-2018-18726 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in admin/sitelink/editsitelink?id=16 in YUNUCMS 1.1.5.
141 CVE-2018-18725 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in admin/banner/editbanner?id=20 in YUNUCMS 1.1.5.
142 CVE-2018-18724 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5.
143 CVE-2018-18723 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5.
144 CVE-2018-18722 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in admin/content/editcontent?id=29&gopage=1 in YUNUCMS 1.1.5.
145 CVE-2018-18721 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5.
146 CVE-2018-18720 79 XSS 2018-10-29 2018-12-04
3.5
None Remote Medium Single system None Partial None
An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5.
147 CVE-2018-18717 79 XSS 2018-10-29 2018-12-10
3.5
None Remote Medium Single system None Partial None
An issue was discovered in Eleanor CMS through 2015-03-19. XSS exists via the ajax.php?direct=admin&file=autocomplete&query=[XSS] URI.
148 CVE-2018-18694 79 XSS 2018-10-29 2018-12-06
3.5
None Remote Medium Single system None Partial None
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases.
149 CVE-2018-18564 284 2018-11-20 2018-12-28
3.3
None Local Network Low Not required None Partial None
An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). Improper access control allows attackers in the adjacent network to change the instrument configuration.
150 CVE-2018-18562 255 2018-11-20 2018-12-28
3.3
None Local Network Low Not required Partial None None
An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service interface.
Total number of vulnerabilities : 3830   Page : 1 2 3 (This Page)4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.