CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
201 CVE-2018-16736 79 XSS 2018-09-09 2018-11-06
3.5
None Remote Medium Single system None Partial None
In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).
202 CVE-2018-16729 79 XSS 2018-09-12 2018-11-09
3.5
None Remote Medium Single system None Partial None
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files.
203 CVE-2018-16728 79 XSS 2018-09-12 2018-11-02
3.5
None Remote Medium Single system None Partial None
feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new.
204 CVE-2018-16727 79 XSS 2018-09-12 2018-11-02
3.5
None Remote Medium Single system None Partial None
razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.
205 CVE-2018-16726 79 XSS 2018-09-12 2018-11-02
3.5
None Remote Medium Single system None Partial None
razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.
206 CVE-2018-16665 119 Overflow 2018-09-07 2018-10-26
3.6
None Local Low Not required None Partial Partial
An issue was discovered in Contiki-NG through 4.1. There is a buffer overflow while parsing AQL in lvm_shift_for_operator in os/storage/antelope/lvm.c.
207 CVE-2018-16658 200 +Info 2018-09-07 2018-11-28
3.6
None Local Low Not required Partial None Partial
An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940.
208 CVE-2018-16638 79 XSS 2018-12-28 2019-01-06
3.5
None Remote Medium Single system None Partial None
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
209 CVE-2018-16637 79 XSS 2018-12-28 2019-01-06
3.5
None Remote Medium Single system None Partial None
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.
210 CVE-2018-16635 79 XSS 2018-12-10 2018-12-28
3.5
None Remote Medium Single system None Partial None
Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.
211 CVE-2018-16633 79 XSS 2018-12-04 2018-12-27
3.5
None Remote Medium Single system None Partial None
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.
212 CVE-2018-16632 79 XSS 2018-12-28 2019-01-09
3.5
None Remote Medium Single system None Partial None
Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.
213 CVE-2018-16631 79 XSS 2018-12-04 2018-12-27
3.5
None Remote Medium Single system None Partial None
Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.
214 CVE-2018-16630 79 XSS 2018-12-28 2019-01-09
3.5
None Remote Medium Single system None Partial None
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.
215 CVE-2018-16628 79 XSS 2018-12-04 2018-12-27
3.5
None Remote Medium Single system None Partial None
panel/login in Kirby v2.5.12 allows XSS via a blog name.
216 CVE-2018-16622 79 XSS 2018-09-06 2018-11-02
3.5
None Remote Medium Single system None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/userAddContent.
217 CVE-2018-16607 79 XSS 2018-09-19 2018-11-07
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field.
218 CVE-2018-16605 79 XSS 2018-09-12 2018-10-30
3.5
None Remote Medium Single system None Partial None
D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.
219 CVE-2018-16551 79 XSS 2018-09-05 2018-10-25
3.5
None Remote Medium Single system None Partial None
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.
220 CVE-2018-16468 79 XSS 2018-10-30 2019-01-10
3.5
None Remote Medium Single system None Partial None
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
221 CVE-2018-16379 79 XSS 2018-09-02 2018-11-09
3.5
None Remote Medium Single system None Partial None
Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field on the "Theme/Theme Options" screen.
222 CVE-2018-16374 79 XSS 2018-09-02 2018-10-24
3.5
None Remote Medium Single system None Partial None
Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.
223 CVE-2018-16363 79 XSS 2018-09-07 2018-11-06
3.5
None Remote Medium Single system None Partial None
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
224 CVE-2018-16358 79 XSS 2018-09-02 2018-10-24
3.5
None Remote Medium Single system None Partial None
A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.
225 CVE-2018-16348 79 XSS 2018-09-02 2018-10-25
3.5
None Remote Medium Single system None Partial None
SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.
226 CVE-2018-16346 79 XSS 2018-09-02 2018-11-09
3.5
None Remote Medium Single system None Partial None
ChemCMS 1.0.6 has XSS via the "setting -> website information" field.
227 CVE-2018-16342 79 XSS 2018-09-02 2018-10-24
3.5
None Remote Medium Single system None Partial None
ShowDoc v1.8.0 has XSS via a new page.
228 CVE-2018-16327 79 XSS 2018-09-01 2018-11-09
3.5
None Remote Medium Single system None Partial None
There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.
229 CVE-2018-16316 79 XSS 2018-09-01 2018-11-09
3.5
None Remote Medium Single system None Partial None
A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.
230 CVE-2018-16277 79 XSS 2018-09-27 2018-11-15
3.5
None Remote Medium Single system None Partial None
The Image Import function in XWiki through 10.7 has XSS.
231 CVE-2018-16205 79 XSS 2019-01-09 2019-01-16
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal.
232 CVE-2018-16204 79 XSS 2019-01-09 2019-01-16
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
233 CVE-2018-16164 79 XSS 2019-01-09 2019-01-16
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
234 CVE-2018-15917 79 XSS 2018-09-05 2018-10-24
3.5
None Remote Medium Single system None Partial None
Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.
235 CVE-2018-15903 79 XSS 2018-10-08 2018-11-26
3.5
None Remote Medium Single system None Partial None
The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS). An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies from high privilege accounts and hijack these, enabling them to hijack the elevated session and perform actions in their security context.
236 CVE-2018-15896 79 XSS 2018-08-28 2018-10-31
3.5
None Remote Medium Single system None Partial None
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.
237 CVE-2018-15880 79 XSS 2018-08-28 2018-11-02
3.5
None Remote Medium Single system None Partial None
An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack.
238 CVE-2018-15843 79 XSS 2018-08-25 2018-10-17
3.5
None Remote Medium Single system None Partial None
GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.
239 CVE-2018-15842 79 XSS 2018-08-25 2018-10-17
3.5
None Remote Medium Single system None Partial None
WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter.
240 CVE-2018-15713 79 XSS 2018-11-14 2018-12-06
3.5
None Remote Medium Single system None Partial None
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.
241 CVE-2018-15707 79 XSS 2018-10-31 2018-12-12
3.5
None Remote Medium Single system None Partial None
Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things.
242 CVE-2018-15701 20 DoS 2018-10-01 2018-11-27
3.3
None Local Network Low Not required None None Partial
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header containing an unexpected Cookie field.
243 CVE-2018-15693 285 Bypass 2018-11-16 2018-12-19
3.5
None Remote Medium Single system None Partial None
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object reference.
244 CVE-2018-15692 285 Bypass 2018-11-16 2018-12-19
3.5
None Remote Medium Single system None Partial None
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain functions.
245 CVE-2018-15570 79 XSS 2018-08-19 2018-10-19
3.5
None Remote Medium Single system None Partial None
In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.
246 CVE-2018-15451 79 Exec Code XSS 2018-11-08 2018-11-20
3.5
None Remote Medium Single system None Partial None
A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.
247 CVE-2018-15426 79 Exec Code XSS 2018-10-05 2018-11-26
3.5
None Remote Medium Single system None Partial None
A vulnerability in the web-based interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the web-based interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
248 CVE-2018-15392 399 DoS 2018-10-05 2019-01-11
3.3
None Local Network Low Not required None None Partial
A vulnerability in the DHCP service of Cisco Industrial Network Director could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper handling of DHCP lease requests. An attacker could exploit this vulnerability by sending malicious DHCP lease requests to an affected application. A successful exploit could allow the attacker to cause the DHCP service to terminate, resulting in a DoS condition.
249 CVE-2018-15365 79 XSS Bypass CSRF 2018-09-28 2018-11-16
3.5
None Remote Medium Single system None Partial None
A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability.
250 CVE-2018-15199 79 XSS 2018-08-07 2018-10-04
3.5
None Remote Medium Single system None Partial None
AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.
Total number of vulnerabilities : 3830   Page : 1 2 3 4 5 (This Page)6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.