Total
42233 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-10854 | 2 Linux, Redhat | 2 Linux Kernel, Cloudforms Management Engine | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.
|
|||||
| CVE-2018-10821 | 1 Blackcat-cms | 1 Blackcat Cms | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
Cross-site scripting (XSS) vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel.
|
|||||
| CVE-2018-10817 | 1 Severalnines | 1 Clustercontrol | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Severalnines ClusterControl before 1.6.0-4699 allows XSS.
|
|||||
| CVE-2018-10810 | 1 Livezilla | 1 Livezilla | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header.
|
|||||
| CVE-2018-10806 | 1 Frogcms Project | 1 Frogcms | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to the admin/?/plugin/file_manager/rename URI. This can be used in conjunction with CSRF.
|
|||||
| CVE-2018-10803 | 1 Zohocorp | 1 Manageengine Netflow Analyzer | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF.
|
|||||
| CVE-2018-10763 | 1 Synametrics | 1 Synaman | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page.
|
|||||
| CVE-2018-10752 | 1 Tagregator Project | 1 Tagregator | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.
|
|||||
| CVE-2018-10727 | 1 Fabrikar | 1 Fabrik | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web script via the HTTP Referer header.
|
|||||
| CVE-2018-10726 | 1 Datenstrom | 1 Yellow | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS
|
|||||
| CVE-2018-10704 | 1 Yii2cmf Project | 1 Yii2cmf | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
yidashi yii2cmf 2.0 has XSS via the /search q parameter.
|
|||||
| CVE-2018-10700 | 1 Moxa | 2 Awk-3121, Awk-3121 Firmware | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered on Moxa AWK-3121 1.19 devices. It provides functionality so that an administrator can change the name of the device. However, the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter "iw_board_deviceName" is susceptible to this injection.
|
|||||
| CVE-2018-10692 | 1 Moxa | 2 Awk-3121, Awk-3121 Firmware | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily.
|
|||||
| CVE-2018-10686 | 1 Vestacp | 1 Control Panel | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $_REQUEST['path'] to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a file_put_contents call in web/upload/UploadHandler.php.
|
|||||
| CVE-2018-10680 | 1 Zblogcn | 1 Z-blogphp | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug.
|
|||||
| CVE-2018-10665 | 1 Ilias | 1 Ilias | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files.
|
|||||
| CVE-2018-10649 | 1 Citrix | 1 Xenmobile Server | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.
|
|||||
| CVE-2018-10609 | 1 Martem | 4 Telem-gw6, Telem-gw6 Firmware, Telem-gwm and 1 more | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow improper sanitization of data over a Websocket which may allow cross-site scripting and client-side code execution with target user privileges.
|
|||||
| CVE-2018-10586 | 1 Netgain-systems | 1 Enterprise Manager | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
NetGain Enterprise Manager (EM) is affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities in versions before 10.1.12.
|
|||||
| CVE-2018-10580 | 1 Latest Posts On Profile Project | 1 Latest Posts On Profile | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts without sanitizing the tsubject (aka thread subject) field.
|
|||||
| CVE-2018-10571 | 1 Open-emr | 1 Openemr | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter to interface/main/finder/finder_navigation.php; (2) key parameter to interface/billing/get_claim_file.php; (3) formid or (4) formseq parameter to interface/orders/types.php; (5) eraname, (6) paydate, (7) post_to_date, (8) deposit_date, (9) debug, or (10) InsId parameter to interface/billing/sl_eob_process.php; (11) form_ ...
Show More |
|||||
| CVE-2018-10570 | 1 Frogcms Project | 1 Frogcms | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.
|
|||||
| CVE-2018-10569 | 1 Edimax | 2 Edimax Ew-7438rpn V2 Firmware, Ew-7438rpn Mini V2 | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field.
|
|||||
| CVE-2018-10568 | 1 Flexense | 1 Disksorter | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
XSS exists in Flexense DiskSorter Enterprise from v9.5.12 to v10.7.
|
|||||
| CVE-2018-10567 | 1 Flexense | 1 Vx Search | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
XSS exists in Flexense VX Search Enterprise from v10.1.12 to v10.7.
|
|||||
| CVE-2018-10566 | 1 Flexense | 1 Dupscout | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7.
|
|||||
| CVE-2018-10565 | 1 Flexense | 1 Disksavvy | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
XSS exists in Flexense DiskSavvy Enterprise from v10.4 to v10.7.
|
|||||
| CVE-2018-10564 | 1 Flexense | 1 Diskpulse | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
XSS exists in Flexense DiskPulse Enterprise from v10.4 to v10.7.
|
|||||
| CVE-2018-10563 | 1 Flexense | 1 Syncbreeze | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An XSS in Flexense SyncBreeze affects all versions (tested from SyncBreeze Enterprise from v10.1 to v10.7).
|
|||||
| CVE-2018-10554 | 1 Nagios | 1 Nagios Xi | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/components/xicore/downtime.php, related to the update_pages function; (3) the ajaxhelper.php opts or background parameter; (4) the i[] array parameter to ajax_handler.php; or (5) the deploynotification.php title parameter.
|
|||||
| CVE-2018-10547 | 4 Canonical, Debian, Netapp and 1 more | 4 Ubuntu Linux, Debian Linux, Storage Automation Store and 1 more | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.
|
|||||
| CVE-2018-10527 | 1 Easycms Project | 1 Easycms | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title, keyword, abstract, and content, as demonstrated by the /admin/index/index.html#listarticle URI.
|
|||||
| CVE-2018-10430 | 1 Dilicms | 1 Dilicms | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting->site setting" of admin/index.php.
|
|||||
| CVE-2018-10428 | 1 Ilias | 1 Ilias | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected cross-site-scripting.
|
|||||
| CVE-2018-10422 | 1 Hongcms Project | 1 Hongcms | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
|
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.
|
|||||
| CVE-2018-10383 | 1 Lantronix | 2 Securelinx Spider, Securelinx Spider Firmware | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.
|
|||||
| CVE-2018-10382 | 1 Modx | 1 Modx Revolution | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
MODX Revolution 2.6.3 has XSS.
|
|||||
| CVE-2018-10379 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Issue feature contained a persistent XSS vulnerability.
|
|||||
| CVE-2018-10374 | 1 Easycms | 1 Easycms | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html request.
|
|||||
| CVE-2018-10371 | 1 Wunderfarm | 1 Wf Cookie Consent | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser via a page title.
|
|||||