CVE-2018-10428

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected cross-site-scripting.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-104299.8Cosmo 1.0.0Beta6 allows attackers to execute arbitrary PHP code via the Database Prefix field on the Database Info screen of install.php.CVE-2018-10436.5In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.CVE-2018-104304.8An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting->si CVE-2018-104317.2D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.CVE-2018-104327.5Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP).CVE-2018-10444.3In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.CVE-2018-10455.4In Moodle 3.x, there is XSS via a calendar event name.CVE-2018-10467.8pdns before version 4.1.2 is vulnerable to a buffer overflow in dnsreplay. In the dnsreplay tool provided with PowerDNS Authoritative, repla CVE-2018-104658.8Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full acces CVE-2018-104669.8Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection.CVE-2018-104687.5The transferFrom function of a smart contract implementation for Useless Ethereum Token (UET), an Ethereum ERC20 token, allows attackers to CVE-2018-104699.8b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI