Export limit exceeded: 413835 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 47077 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 94850 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (94850 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-19942 1 Qnap 3 Qts, Quts Hero, Qutscloud 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 build 20210202 (and later) QTS 4.5.1.1456 build 20201015 (and later) QTS 4.3.6.1446 build 20200929 (and later) QTS 4.3.4.1463 build 20201006 (and later) QTS 4.3.3.1432 build 20201006 (and later) QTS 4.2.6 build 20210327 (and later) QuTS hero h4.5.1.1472 build 20201031 (and later) QuTScloud c4.5.4.1601 build 20210309 (and later) QuTScloud c4.5.3.1454 build 20201013 (and later)
CVE-2018-19934 1 Solarwinds 1 Serv-u Ftp Server 2024-11-21 N/A
SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL path and HTTP POST parameter.
CVE-2018-19933 1 Bolt 1 Bolt Cms 2024-11-21 N/A
Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.
CVE-2018-19931 3 Canonical, Gnu, Netapp 3 Ubuntu Linux, Binutils, Vasa Provider 2024-11-21 7.8 High
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted.
CVE-2018-19927 1 Zenitel 2 Ip-stationweb, Ip-stationweb Firmware 2024-11-21 N/A
Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings, related to the goform/zForm_save_changes sip_nick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases.
CVE-2018-19926 1 Zenitel 2 Ip-stationweb, Ip-stationweb Firmware 2024-11-21 N/A
Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATH_INFO.
CVE-2018-19924 1 Sales \& Company Management System Project 1 Sales \& Company Management System 2024-11-21 N/A
An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to storage of an XSS payload contained in the modified address.
CVE-2018-19922 1 Actiontec 2 C1000a, C1000a Firmware 2024-11-21 N/A
Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd' URL parameter in a /urlfilter.cmd POST request.
CVE-2018-19921 1 Zohocorp 1 Manageengine Opmanager 2024-11-21 N/A
Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.
CVE-2018-19919 1 Pixelimity 1 Pixelimity 2024-11-21 N/A
Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php data[title] parameter, as demonstrated by a crafted onload attribute of an SVG element.
CVE-2018-19917 1 Microweber 1 Microweber 2024-11-21 N/A
Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.
CVE-2018-19915 1 Domainmod 1 Domainmod 2024-11-21 N/A
DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.
CVE-2018-19914 1 Domainmod 1 Domainmod 2024-11-21 N/A
DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.
CVE-2018-19913 1 Domainmod 1 Domainmod 2024-11-21 N/A
DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.
CVE-2018-19911 1 Freeswitch 1 Freeswitch 2024-11-21 N/A
FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used.
CVE-2018-19908 1 Misp-project 1 Misp 2024-11-21 N/A
An issue was discovered in MISP 2.4.9x before 2.4.99. In app/Model/Event.php (the STIX 1 import code), an unescaped filename string is used to construct a shell command. This vulnerability can be abused by a malicious authenticated user to execute arbitrary commands by tweaking the original filename of the STIX import.
CVE-2018-19907 1 Craftercms 1 Crafter Cms 2024-11-21 N/A
A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.
CVE-2018-19903 1 Xsltcms.org Project 1 Xsltcms.org 2024-11-21 N/A
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.
CVE-2018-19902 1 No-cms Project 1 No-cms 2024-11-21 N/A
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.
CVE-2018-19901 1 No-cms Project 1 No-cms 2024-11-21 N/A
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.