CVE Vulnerability Database
Search and browse 394,603 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
16,510 records from 2018Clear filters
- CVE-2018-19903Medium 6.1Dec 31, 2018Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.
- CVE-2018-19902Medium 4.8Dec 31, 2018No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.
- CVE-2018-19901Medium 4.8Dec 31, 2018No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.
- CVE-2018-19845Medium 5.4Dec 31, 2018There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php "post-menu" parameter, a related issue to CVE-2018-16325.
- CVE-2018-19844Medium 4.8Dec 31, 2018FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319.
- CVE-2018-18593High 7.5Dec 31, 2018Remote Directory Traversal and Remote Disclosure of Privileged Information in UCMDB Configuration Management Service, version 10.22, 10.22 CUP1, 10.22 CUP2, 10.22 CUP3, 10.22 CUP4, 10.22 CUP5, 10.22 CUP6, 10.22 CUP7, 10.33, 10.33 CUP1, 10.33 CUP2, 10.33 CUP3, 2018.02, 2018.05, 2018.08, 2018.11. The vulnerabilities could allow Remote Directory Traversal and Remote Disclosure of Privileged Information
- CVE-2018-20617High 8.8Dec 31, 2018ok-file-formats through 2018-10-16 has a heap-based buffer overflow in the ok_csv_decode2 function in ok_csv.c.
- CVE-2018-17191Critical 9.8Dec 31, 2018Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Using the nashorn script engine the environment of the javascript execution for the Proxy Auto-Configuration leaks privileged objects, that can be used to circumvent the execution limits. If a different script engine was used, no execution limits were in place. Both vectors allow remote code execution.
- CVE-2018-20616High 8.8Dec 31, 2018ok-file-formats through 2018-10-16 has a heap-based buffer overflow in the ok_wav_decode_ms_adpcm_data function in ok_wav.c.
- CVE-2018-20614High 7.5Dec 30, 2018public\install\install.php in CIM 0.9.3 allows remote attackers to reload the product via the public/install/#/step3 URI.
- CVE-2018-20613High 8.8Dec 30, 2018TEMMOKU T1.09 Beta allows admin/user/add CSRF.
- CVE-2018-20612High 8.8Dec 30, 2018UWA 2.3.11 allows index.php?g=admin&c=admin&a=add_admin_do CSRF.
- CVE-2018-20611Medium 6.1Dec 30, 2018imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.
- CVE-2018-20610Medium 4.9Dec 30, 2018imcat 4.4 allows directory traversal via the root/run/adm.php efile parameter.
- CVE-2018-20609Medium 5.3Dec 30, 2018imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/check.php URI.
- CVE-2018-20608High 7.5Dec 30, 2018imcat 4.4 allows remote attackers to read phpinfo output via the root/tools/adbug/binfo.php?phpinfo1 URI.
- CVE-2018-20607Medium 5.3Dec 30, 2018imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.php URI.
- CVE-2018-20606High 7.5Dec 30, 2018imcat 4.4 allows full path disclosure via a dev.php?tools-ipaddr&api=Pcoln&uip= URI.
- CVE-2018-20605Critical 9.8Dec 30, 2018imcat 4.4 allows remote attackers to execute arbitrary PHP code by using root/run/adm.php to modify the boot/bootskip.php file.
- CVE-2018-20604Medium 4.9Dec 30, 2018Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..* in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/*web*..*..*..*..*1.txt.html URI to read the 1.txt file.
- CVE-2018-20603High 8.8Dec 30, 2018Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF.
- CVE-2018-20602High 7.5Dec 30, 2018Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI.
- CVE-2018-20601Medium 4.8Dec 30, 2018UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.
- CVE-2018-20600Medium 6.1Dec 30, 2018sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.
- CVE-2018-20599High 8.8Dec 30, 2018UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action.