Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (342082 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-18890 1 1234n 1 Minicms 2024-11-21 N/A
MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename.
CVE-2018-18888 1 Laravelcms Project 1 Laravelcms 2024-11-21 N/A
An issue was discovered in laravelCMS through 2018-04-02. \app\Http\Controllers\Backend\ProfileController.php allows upload of arbitrary PHP files because the file extension is not properly checked and uploaded files are not properly renamed.
CVE-2018-18887 1 S-cms 1 S-cms 2024-11-21 N/A
S-CMS PHP 1.0 has SQL injection in member/member_news.php via the type parameter (aka the $N_type field).
CVE-2018-18886 1 Helpy.io 1 Helpy 2024-11-21 6.1 Medium
Helpy v2.1.0 has Stored XSS via the Ticket title.
CVE-2018-18883 1 Xen 1 Xen 2024-11-21 N/A
An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted.
CVE-2018-18882 1 Controlbyweb 2 X-320m-i, X-320m-i Firmware 2024-11-21 N/A
A stored cross-site scripting (XSS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisition module 1.05 with firmware revision v1.05. An authenticated user can inject arbitrary script via setup.html in the web interface.
CVE-2018-18881 1 Controlbyweb 2 X-320m-i, X-320m-i Firmware 2024-11-21 N/A
A Denial of Service (DOS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisition module 1.05 with firmware revision v1.05. An authenticated user can configure invalid network settings, stopping TCP based communications to the device. A physical factory reset is required to restore the device to an operational state.
CVE-2018-18880 1 Columbiaweather 2 Weather Microserver, Weather Microserver Firmware 2024-11-21 N/A
In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting (XSS) vulnerability allows remote authenticated users to inject arbitrary web script.
CVE-2018-18879 1 Columbiaweather 2 Weather Microserver, Weather Microserver Firmware 2024-11-21 N/A
In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php.
CVE-2018-18878 1 Columbiaweather 2 Weather Microserver, Weather Microserver Firmware 2024-11-21 N/A
In firmware version MS_2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable.
CVE-2018-18877 1 Columbiaweather 2 Weather Microserver, Weather Microserver Firmware 2024-11-21 N/A
In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page config_main.php that allows manipulation of the device.
CVE-2018-18876 1 Columbiaweather 2 Weather Microserver, Weather Microserver Firmware 2024-11-21 N/A
In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a readouts_rd.php directory traversal issue makes it possible to read any file present on the underlying operating system.
CVE-2018-18875 1 Columbiaweather 2 Weather Microserver, Weather Microserver Firmware 2024-11-21 N/A
In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting (XSS) vulnerability allows remote authenticated users to inject arbitrary web script via changestationname.php.
CVE-2018-18874 1 Nconsulting 1 Nc-cms 2024-11-21 N/A
nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=file_manager_upload URI.
CVE-2018-18873 4 Canonical, Debian, Jasper Project and 1 more 5 Ubuntu Linux, Debian Linux, Jasper and 2 more 2024-11-21 5.5 Medium
An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.
CVE-2018-18872 1 Kieranoshea 1 Calendar 2024-11-21 N/A
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI.
CVE-2018-18871 1 Gigasetpro 2 Maxwell Basic, Maxwell Basic Firmware 2024-11-21 N/A
Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to change the admin password without authentication (and without knowing the original password).
CVE-2018-18869 1 Phome 1 Empirecms 2024-11-21 N/A
EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter.
CVE-2018-18868 1 No-cms Project 1 No-cms 2024-11-21 N/A
No-CMS 1.1.3 is prone to Persistent XSS via a contact_us name parameter, as demonstrated by the VG48Z5PqVWname parameter.
CVE-2018-18867 1 Tecrail 1 Responsive Filemanager 2024-11-21 N/A
An SSRF issue was discovered in tecrail Responsive FileManager 9.13.4 via the upload.php url parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-15495.