CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
351 CVE-2018-16658 200 +Info 2018-09-07 2018-11-28
3.6
None Local Low Not required Partial None Partial
An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940.
352 CVE-2018-16639 79 XSS 2019-05-13 2019-05-13
3.5
None Remote Medium Single system None Partial None
Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.
353 CVE-2018-16638 79 XSS 2018-12-28 2019-01-06
3.5
None Remote Medium Single system None Partial None
Evolution CMS 1.4.x allows XSS via the manager/ search parameter.
354 CVE-2018-16637 79 XSS 2018-12-28 2019-01-06
3.5
None Remote Medium Single system None Partial None
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.
355 CVE-2018-16635 79 XSS 2018-12-10 2018-12-28
3.5
None Remote Medium Single system None Partial None
Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.
356 CVE-2018-16633 79 XSS 2018-12-04 2018-12-27
3.5
None Remote Medium Single system None Partial None
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.
357 CVE-2018-16632 79 XSS 2018-12-28 2019-01-09
3.5
None Remote Medium Single system None Partial None
Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.
358 CVE-2018-16631 79 XSS 2018-12-04 2018-12-27
3.5
None Remote Medium Single system None Partial None
Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.
359 CVE-2018-16630 79 XSS 2018-12-28 2019-01-09
3.5
None Remote Medium Single system None Partial None
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.
360 CVE-2018-16628 79 XSS 2018-12-04 2018-12-27
3.5
None Remote Medium Single system None Partial None
panel/login in Kirby v2.5.12 allows XSS via a blog name.
361 CVE-2018-16626 79 XSS 2019-05-13 2019-05-13
3.5
None Remote Medium Single system None Partial None
index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.
362 CVE-2018-16625 79 XSS 2019-05-13 2019-05-13
3.5
None Remote Medium Single system None Partial None
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
363 CVE-2018-16624 79 XSS 2019-05-13 2019-05-13
3.5
None Remote Medium Single system None Partial None
panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.
364 CVE-2018-16623 79 XSS 2019-05-13 2019-05-13
3.5
None Remote Medium Single system None Partial None
Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.
365 CVE-2018-16622 79 XSS 2018-09-06 2018-11-02
3.5
None Remote Medium Single system None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in /api/content/addOne in DoraCMS v2.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) discription or (2) comments field, related to users/userAddContent.
366 CVE-2018-16607 79 XSS 2018-09-19 2018-11-07
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field.
367 CVE-2018-16605 79 XSS 2018-09-12 2018-10-30
3.5
None Remote Medium Single system None Partial None
D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.
368 CVE-2018-16551 79 XSS 2018-09-05 2018-10-25
3.5
None Remote Medium Single system None Partial None
LavaLite 5.5 has XSS via a /edit URI, as demonstrated by client/job/job/Zy8PWBekrJ/edit.
369 CVE-2018-16468 79 XSS 2018-10-30 2019-01-10
3.5
None Remote Medium Single system None Partial None
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
370 CVE-2018-16464 287 2018-10-30 2019-01-17
3.5
None Remote Medium Single system Partial None None
A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.
371 CVE-2018-16463 384 2018-10-30 2019-01-17
3.6
None Remote High Single system Partial Partial None
A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares.
372 CVE-2018-16379 79 XSS 2018-09-02 2018-11-09
3.5
None Remote Medium Single system None Partial None
Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field on the "Theme/Theme Options" screen.
373 CVE-2018-16374 79 XSS 2018-09-02 2018-10-24
3.5
None Remote Medium Single system None Partial None
Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.
374 CVE-2018-16363 79 XSS 2018-09-07 2018-11-06
3.5
None Remote Medium Single system None Partial None
The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\wpfilemanager.php.
375 CVE-2018-16358 79 XSS 2018-09-02 2018-10-24
3.5
None Remote Medium Single system None Partial None
A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.
376 CVE-2018-16348 79 XSS 2018-09-02 2018-10-25
3.5
None Remote Medium Single system None Partial None
SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.
377 CVE-2018-16346 79 XSS 2018-09-02 2018-11-09
3.5
None Remote Medium Single system None Partial None
ChemCMS 1.0.6 has XSS via the "setting -> website information" field.
378 CVE-2018-16342 79 XSS 2018-09-02 2018-10-24
3.5
None Remote Medium Single system None Partial None
ShowDoc v1.8.0 has XSS via a new page.
379 CVE-2018-16327 79 XSS 2018-09-01 2018-11-09
3.5
None Remote Medium Single system None Partial None
There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.
380 CVE-2018-16316 79 XSS 2018-09-01 2018-11-09
3.5
None Remote Medium Single system None Partial None
A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.
381 CVE-2018-16277 79 XSS 2018-09-27 2018-11-15
3.5
None Remote Medium Single system None Partial None
The Image Import function in XWiki through 10.7 has XSS.
382 CVE-2018-16219 287 2019-04-25 2019-04-26
3.3
None Local Network Low Not required None Partial None
A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the same network as the device) to change the admin password without authentication via a POST request.
383 CVE-2018-16205 79 XSS 2019-01-09 2019-01-16
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal.
384 CVE-2018-16204 79 XSS 2019-01-09 2019-01-16
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
385 CVE-2018-16193 79 XSS 2019-01-09 2019-01-17
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
386 CVE-2018-16192 200 +Info 2019-01-09 2019-01-17
3.3
None Local Network Low Not required Partial None None
Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same network segment to obtain information registered on the device via unspecified vectors.
387 CVE-2018-16164 79 XSS 2019-01-09 2019-01-16
3.5
None Remote Medium Single system None Partial None
Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
388 CVE-2018-16138 79 XSS 2019-05-13 2019-05-15
3.5
None Remote Medium Single system None Partial None
An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities.
389 CVE-2018-15917 79 XSS 2018-09-05 2018-10-24
3.5
None Remote Medium Single system None Partial None
Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.
390 CVE-2018-15903 79 XSS 2018-10-08 2018-11-26
3.5
None Remote Medium Single system None Partial None
The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS). An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies from high privilege accounts and hijack these, enabling them to hijack the elevated session and perform actions in their security context.
391 CVE-2018-15896 79 XSS 2018-08-28 2018-10-31
3.5
None Remote Medium Single system None Partial None
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via Personal Address or Company Name.
392 CVE-2018-15880 79 XSS 2018-08-28 2018-11-02
3.5
None Remote Medium Single system None Partial None
An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack.
393 CVE-2018-15843 79 XSS 2018-08-25 2018-10-17
3.5
None Remote Medium Single system None Partial None
GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.
394 CVE-2018-15842 79 XSS 2018-08-25 2018-10-17
3.5
None Remote Medium Single system None Partial None
WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter.
395 CVE-2018-15800 200 +Info 2018-12-10 2019-04-01
3.5
None Remote Medium Single system Partial None None
Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing attack to brute-force the signing key, allowing them complete read and write access to the the Bits Service storage.
396 CVE-2018-15713 79 XSS 2018-11-14 2018-12-06
3.5
None Remote Medium Single system None Partial None
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.
397 CVE-2018-15707 79 XSS 2018-10-31 2018-12-12
3.5
None Remote Medium Single system None Partial None
Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things.
398 CVE-2018-15701 20 DoS 2018-10-01 2018-11-27
3.3
None Local Network Low Not required None None Partial
The web interface in TP-Link TL-WRN841N 0.9.1 4.16 v0348.0 is vulnerable to a denial of service when an unauthenticated LAN user sends a crafted HTTP header containing an unexpected Cookie field.
399 CVE-2018-15693 285 Bypass 2018-11-16 2018-12-19
3.5
None Remote Medium Single system None Partial None
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass via insecure direct object reference.
400 CVE-2018-15692 285 Bypass 2018-11-16 2018-12-19
3.5
None Remote Medium Single system None Partial None
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain functions.
Total number of vulnerabilities : 4017   Page : 1 2 3 4 5 6 7 8 (This Page)9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.