Export limit exceeded: 10341 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 92861 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (92861 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-16254 | 1 Soflyy | 1 Wp All Import | 2024-11-21 | N/A |
| There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator | ||||
| CVE-2018-16250 | 1 Creatiwity | 1 Witycms | 2024-11-21 | N/A |
| The "utilisateur" menu in Creatiwity wityCMS 0.6.2 modifies the presence of XSS at two input points for user information, with the "first name" and "last name" parameters. | ||||
| CVE-2018-16249 | 1 B3log | 1 Symphony | 2024-11-21 | N/A |
| In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name. | ||||
| CVE-2018-16248 | 1 B3log | 1 Solo | 2024-11-21 | N/A |
| b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request. | ||||
| CVE-2018-16247 | 1 Yzmcms | 1 Yzmcms | 2024-11-21 | N/A |
| YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter. | ||||
| CVE-2018-16243 | 1 Solarwinds | 1 Database Performance Analyzer | 2024-11-21 | 5.4 Medium |
| SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen. | ||||
| CVE-2018-16236 | 1 Cpanel | 1 Cpanel | 2024-11-21 | N/A |
| cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering. | ||||
| CVE-2018-16235 | 1 Telligent | 1 Community | 2024-11-21 | N/A |
| Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed RSS widget. | ||||
| CVE-2018-16234 | 1 Morningstarsecurity | 1 Whatweb | 2024-11-21 | N/A |
| MorningStar WhatWeb 0.4.9 has XSS via JSON report files. | ||||
| CVE-2018-16233 | 1 1234n | 1 Minicms | 2024-11-21 | N/A |
| MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter. | ||||
| CVE-2018-16232 | 1 Ipfire | 1 Ipfire | 2024-11-21 | 8.8 High |
| An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authenticated user with privileges for the affected page to execute arbitrary commands. | ||||
| CVE-2018-16226 | 1 Mitel | 1 Mivoice Office 400 | 2024-11-21 | N/A |
| A vulnerability in the web admin component of Mitel MiVoice Office 400, versions R5.0 HF3 (v8839a1) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack, due to insufficient validation for the start.asp page. A successful exploit could allow the attacker to execute arbitrary scripts to access sensitive browser-based information. | ||||
| CVE-2018-16220 | 1 Audiocodes | 2 405hd, 405hd Firmware | 2024-11-21 | N/A |
| Cross Site Scripting in different input fields (domain field and personal settings) in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an attacker (local or remote) to inject JavaScript into the web interface of the device by manipulating the phone book entries or manipulating the domain name sent to the device from the domain controller. | ||||
| CVE-2018-16217 | 1 Yealink | 2 Ultra-elegant Ip Phone Sip-t41p, Ultra-elegant Ip Phone Sip-t41p Firmware | 2024-11-21 | N/A |
| The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated attacker to trigger OS commands or open a reverse shell via command injection. | ||||
| CVE-2018-16216 | 1 Audiocodes | 2 405hd, 405hd Firmware | 2024-11-21 | N/A |
| A command injection (missing input validation, escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2.12) VoIP phone allows an authenticated remote attacker in the same network as the device to trigger OS commands (like starting telnetd or opening a reverse shell) via a POST request to the web server. In combination with another attack (unauthenticated password change), the attacker can circumvent the authentication requirement. | ||||
| CVE-2018-16206 | 1 Ohtanz | 1 Spam-byebye | 2024-11-21 | N/A |
| Cross-site scripting vulnerability in WordPress plugin spam-byebye 2.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||
| CVE-2018-16205 | 1 Weseek | 1 Growi | 2024-11-21 | N/A |
| Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal. | ||||
| CVE-2018-16204 | 1 Google Xml Sitemaps Project | 1 Google Xml Sitemaps | 2024-11-21 | 4.8 Medium |
| Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||
| CVE-2018-16201 | 1 Toshiba | 4 Hem-gw16a, Hem-gw16a Firmware, Hem-gw26a and 1 more | 2024-11-21 | N/A |
| Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on the same network segment to login to the administrators settings screen and change the configuration or execute arbitrary OS commands. | ||||
| CVE-2018-16200 | 1 Toshiba | 4 Hem-gw16a, Hem-gw16a Firmware, Hem-gw26a and 1 more | 2024-11-21 | N/A |
| Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to execute arbitrary OS commands. | ||||