Export limit exceeded: 14425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 23783 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 92892 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (92892 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-17184 1 Apache 1 Syncope 2024-11-21 N/A
A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.
CVE-2018-17174 1 Nmealib Project 1 Nmealib 2024-11-21 N/A
A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c allows an attacker to trigger denial of service (even arbitrary code execution in a certain context) in a product using this library via malformed data.
CVE-2018-17172 1 Xerox 20 Altalink B8045, Altalink B8045 Firmware, Altalink B8055 and 17 more 2024-11-21 N/A
The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 before 100.003.028.05200 allows unauthenticated command injection.
CVE-2018-17167 1 Printeron 1 Printeron 2024-11-21 N/A
PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Machine Host Name" or "Server Serial Number" field in the clustering configuration, (2) "name" field in the Edit Group configuration, (3) "Rule Name" field in the Access Control configuration, (4) "Service Name" in the Service Configuration, or (5) First Name or Last Name field in the Edit Account configuration.
CVE-2018-17160 1 Freebsd 1 Freebsd 2024-11-21 N/A
In FreeBSD before 11.2-STABLE(r341486) and 11.2-RELEASE-p6, insufficient bounds checking in one of the device models provided by bhyve can permit a guest operating system to overwrite memory in the bhyve host possibly permitting arbitrary code execution. A guest OS using a firmware image can cause the bhyve process to crash, or possibly execute arbitrary code on the host as root.
CVE-2018-17156 1 Freebsd 1 Freebsd 2024-11-21 N/A
In FreeBSD before 11.2-STABLE(r340268) and 11.2-RELEASE-p5, due to incorrectly accounting for padding on 64-bit platforms, a buffer underwrite could occur when constructing an ICMP reply packet when using a non-standard value for the net.inet.icmp.quotelen sysctl.
CVE-2018-17150 1 Intersystems 1 Cache 2024-11-21 N/A
Intersystems Cache 2017.2.2.865.0 allows XSS.
CVE-2018-17147 1 Nagios 1 Nagios Xi 2024-11-21 N/A
Nagios XI before 5.5.4 has XSS in the auto login admin management page.
CVE-2018-17146 1 Nagios 1 Nagios Xi 2024-11-21 N/A
A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.
CVE-2018-17141 2 Debian, Hylafax 3 Debian Linux, Hylafax, Hylafax\+ 2024-11-21 N/A
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.
CVE-2018-17140 1 Vms-studio 1 Quizlord 2024-11-21 N/A
The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php.
CVE-2018-17138 1 Nickelpro 1 Jibu Pro 2024-11-21 N/A
The Jibu Pro plugin through 1.7 for WordPress is prone to Stored XSS via the wp-content/plugins/jibu-pro/quiz_action.php name (aka Quiz Name) field.
CVE-2018-17130 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,
CVE-2018-17128 1 Mybb 1 Mybb 2024-11-21 N/A
A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.
CVE-2018-17113 1 Easycms 1 Easycms 2024-11-21 N/A
App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter, a related issue to CVE-2018-9173.
CVE-2018-17101 4 Canonical, Debian, Libtiff and 1 more 4 Ubuntu Linux, Debian Linux, Libtiff and 1 more 2024-11-21 N/A
An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
CVE-2018-17098 1 Surina 1 Soundtouch 2024-11-21 N/A
The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (heap corruption from size inconsistency) or possibly have unspecified other impact, as demonstrated by SoundStretch.
CVE-2018-17090 1 I4a 1 Donlinkage 2024-11-21 N/A
An issue was discovered in DonLinkage 6.6.8. The modules /pages/bazy/bazy_adresow.php and /pages/proxy/add.php are vulnerable to stored XSS that can be triggered by closing <textarea> followed by <script></script> tags.
CVE-2018-17086 1 Otcms 1 Otcms 2024-11-21 N/A
An issue was discovered in OTCMS 3.61. XSS exists in admin/share_switch.php via these parameters: fieldName fieldName2 tabName.
CVE-2018-17085 1 Otcms 1 Otcms 2024-11-21 N/A
An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr.