Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (94777 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-17130 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
PHPMyWind 5.5 has XSS in member.php via an HTTP Referer header,
CVE-2018-17128 1 Mybb 1 Mybb 2024-11-21 N/A
A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.
CVE-2018-17113 1 Easycms 1 Easycms 2024-11-21 N/A
App/Modules/Admin/Tpl/default/Public/dwz/uploadify/scripts/uploadify.swf in EasyCMS 1.5 has XSS via the uploadifyID or movieName parameter, a related issue to CVE-2018-9173.
CVE-2018-17101 4 Canonical, Debian, Libtiff and 1 more 4 Ubuntu Linux, Debian Linux, Libtiff and 1 more 2024-11-21 N/A
An issue was discovered in LibTIFF 4.0.9. There are two out-of-bounds writes in cpTags in tools/tiff2bw.c and tools/pal2rgb.c, which can cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image file.
CVE-2018-17098 1 Surina 1 Soundtouch 2024-11-21 N/A
The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows remote attackers to cause a denial of service (heap corruption from size inconsistency) or possibly have unspecified other impact, as demonstrated by SoundStretch.
CVE-2018-17090 1 I4a 1 Donlinkage 2024-11-21 N/A
An issue was discovered in DonLinkage 6.6.8. The modules /pages/bazy/bazy_adresow.php and /pages/proxy/add.php are vulnerable to stored XSS that can be triggered by closing <textarea> followed by <script></script> tags.
CVE-2018-17086 1 Otcms 1 Otcms 2024-11-21 N/A
An issue was discovered in OTCMS 3.61. XSS exists in admin/share_switch.php via these parameters: fieldName fieldName2 tabName.
CVE-2018-17085 1 Otcms 1 Otcms 2024-11-21 N/A
An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr.
CVE-2018-17082 4 Debian, Netapp, Php and 1 more 4 Debian Linux, Storage Automation Store, Php and 1 more 2024-11-21 N/A
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
CVE-2018-17079 1 Zrlog 1 Zrlog 2024-11-21 N/A
An issue was discovered in ZRLOG 2.0.1. There is a Stored XSS vulnerability in the nickname field of the comment area.
CVE-2018-17077 1 Yiqicms Project 1 Yiqicms 2024-11-21 N/A
An issue was discovered in yiqicms through 2016-11-20. There is stored XSS in comment.php because a length limit can be bypassed.
CVE-2018-17068 1 Dlink 2 Dir-816 A2, Dir-816 A2 Firmware 2024-11-21 N/A
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/Diagnosis route. This could lead to command injection via shell metacharacters in the sendNum parameter.
CVE-2018-17067 1 Dlink 2 Dir-816 A2, Dir-816 A2 Firmware 2024-11-21 N/A
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. A very long password to /goform/formLogin could lead to a stack-based buffer overflow and overwrite the return address.
CVE-2018-17066 1 Dlink 2 Dir-816 A2, Dir-816 A2 Firmware 2024-11-21 N/A
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/form2systime.cgi route. This could lead to command injection via shell metacharacters in the datetime parameter.
CVE-2018-17065 1 Dlink 2 Dir-816 A2, Dir-816 A2 Firmware 2024-11-21 N/A
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. Within the handler function of the /goform/DDNS route, a very long password could lead to a stack-based buffer overflow and overwrite the return address.
CVE-2018-17064 1 Dlink 2 Dir-816 A2, Dir-816 A2 Firmware 2024-11-21 N/A
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/sylogapply route. This could lead to command injection via the syslogIp parameter after /goform/clearlog is invoked.
CVE-2018-17063 1 Dlink 2 Dir-816 A2, Dir-816 A2 Firmware 2024-11-21 N/A
An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/NTPSyncWithHost route. This could lead to command injection via shell metacharacters.
CVE-2018-17062 1 Seacms 1 Seacms 2024-11-21 N/A
An issue was discovered in SeaCMS 6.64. XSS exists in admin_video.php via the action, area, type, yuyan, jqtype, v_isunion, v_recycled, v_ismoney, or v_ispsd parameter.
CVE-2018-17061 1 Bullguard 1 Safe Browsing 2024-11-21 N/A
BullGuard Safe Browsing before 18.1.355.9 allows XSS on Google, Bing, and Yahoo! pages via domains indexed in search results.
CVE-2018-17056 1 Progress 1 Sitefinity Cms 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in ServiceStack in Progress Sitefinity CMS versions 10.2 through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.