Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (44069 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-10937 1 Redhat 1 Openshift Container Platform 2024-11-21 N/A
A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.
CVE-2018-10934 1 Redhat 4 Enterprise Linux Server, Jboss Enterprise Application Platform, Jboss Single Sign On and 1 more 2024-11-21 N/A
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.
CVE-2018-10898 2 Openstack, Redhat 2 Tripleo Heat Templates, Openstack 2024-11-21 N/A
A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight in RHOSP13 is configured with easily guessable default credentials.
CVE-2018-10854 2 Linux, Redhat 3 Linux Kernel, Cloudforms Management Engine, Cloudforms Managementengine 2024-11-21 5.4 Medium
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.
CVE-2018-10821 1 Blackcat-cms 1 Blackcat Cms 2024-11-21 4.8 Medium
Cross-site scripting (XSS) vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel.
CVE-2018-10817 1 Severalnines 1 Clustercontrol 2024-11-21 N/A
Severalnines ClusterControl before 1.6.0-4699 allows XSS.
CVE-2018-10813 1 Aprendecondedos 1 Dedos-web 2024-11-21 N/A
In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation.
CVE-2018-10810 1 Livezilla 1 Livezilla 2024-11-21 N/A
chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header.
CVE-2018-10806 1 Frogcms Project 1 Frogcms 2024-11-21 N/A
An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to the admin/?/plugin/file_manager/rename URI. This can be used in conjunction with CSRF.
CVE-2018-10803 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF.
CVE-2018-10763 1 Synametrics 1 Synaman 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page.
CVE-2018-10752 1 Tagregator Project 1 Tagregator 2024-11-21 N/A
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.
CVE-2018-10727 1 Fabrikar 1 Fabrik 2024-11-21 6.1 Medium
Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web script via the HTTP Referer header.
CVE-2018-10726 1 Datenstrom 1 Yellow 2024-11-21 5.4 Medium
A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS
CVE-2018-10723 1 Rangerstudio 1 Directus 2024-11-21 N/A
Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql.
CVE-2018-10704 1 Yii2cmf Project 1 Yii2cmf 2024-11-21 6.1 Medium
yidashi yii2cmf 2.0 has XSS via the /search q parameter.
CVE-2018-10700 1 Moxa 2 Awk-3121, Awk-3121 Firmware 2024-11-21 N/A
An issue was discovered on Moxa AWK-3121 1.19 devices. It provides functionality so that an administrator can change the name of the device. However, the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter "iw_board_deviceName" is susceptible to this injection.
CVE-2018-10692 1 Moxa 2 Awk-3121, Awk-3121 Firmware 2024-11-21 N/A
An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily.
CVE-2018-10686 1 Vestacp 1 Control Panel 2024-11-21 N/A
An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $_REQUEST['path'] to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a file_put_contents call in web/upload/UploadHandler.php.
CVE-2018-10680 1 Zblogcn 1 Z-blogphp 2024-11-21 N/A
Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug.