CVE-2018-16148

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://knowledge.opsview.com/v5.3/docs/whats-newRelease Notes, Vendor Advisory
https://knowledge.opsview.com/v5.4/docs/whats-newRelease Notes, Vendor Advisory
https://seclists.org/fulldisclosure/2018/Sep/3Exploit, Mailing List, Third Party Advisory
https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilitiesExploit, Third Party Advisory
https://knowledge.opsview.com/v5.3/docs/whats-newRelease Notes, Vendor Advisory
https://knowledge.opsview.com/v5.4/docs/whats-newRelease Notes, Vendor Advisory
https://seclists.org/fulldisclosure/2018/Sep/3Exploit, Mailing List, Third Party Advisory
https://www.coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilitiesExploit, Third Party Advisory

Timeline

Published: Sep 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-161495.9In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification blindly trusts the declared lengths in t CVE-2018-161505.9In sig_verify() in x509.c in axTLS version 2.1.3 and before, the PKCS#1 v1.5 signature verification does not reject excess data after the ha CVE-2018-161517.5In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation ba CVE-2018-161527.5In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation ba CVE-2018-161537.5An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts t CVE-2018-161567.8In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messa CVE-2018-161575.3waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet captu CVE-2018-161589.8Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installation CVE-2018-161599.8The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the template_id parameter in a wp-admin/admin-ajax.php wpgv_do CVE-2018-161607.8SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in to a Windows PC.CVE-2018-161618.8OpenDolphin 2.7.0 and earlier allows authenticated users to gain administrative privileges and perform unintended operations.CVE-2018-161628.8OpenDolphin 2.7.0 and earlier allows authenticated attackers to obtain other users credentials such as a user ID and/or its password via uns