Export limit exceeded: 94289 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94289 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-6405 | 2 Canonical, Imagemagick | 2 Ubuntu Linux, Imagemagick | 2024-11-21 | 6.5 Medium |
| In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allows remote attackers to cause a denial of service. | ||||
| CVE-2018-6401 | 1 Meross | 2 Mss110, Mss110 Firmware | 2024-11-21 | N/A |
| Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password. | ||||
| CVE-2018-6388 | 1 Iball | 2 Ib-wra150n, Ib-wra150n Firmware | 2024-11-21 | N/A |
| iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping test arguments on the Diagnostics page. | ||||
| CVE-2018-6387 | 1 Iball | 2 Ib-wra150n, Ib-wra150n Firmware | 2024-11-21 | N/A |
| iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hardcoded password of support for the support account, and a hardcoded password of user for the user account. | ||||
| CVE-2018-6380 | 1 Joomla | 1 Joomla\! | 2024-11-21 | N/A |
| In Joomla! before 3.8.4, lack of escaping in the module chromes leads to XSS vulnerabilities in the module system. | ||||
| CVE-2018-6379 | 1 Joomla | 1 Joomla\! | 2024-11-21 | N/A |
| In Joomla! before 3.8.4, inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability. | ||||
| CVE-2018-6378 | 1 Joomla | 1 Joomla\! | 2024-11-21 | N/A |
| In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager. | ||||
| CVE-2018-6377 | 1 Joomla | 1 Joomla\! | 2024-11-21 | N/A |
| In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox | ||||
| CVE-2018-6362 | 1 Ehcp | 1 Easy Hosting Control Panel | 2024-11-21 | N/A |
| Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie. | ||||
| CVE-2018-6361 | 1 Ehcp | 1 Easy Hosting Control Panel | 2024-11-21 | N/A |
| Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account. | ||||
| CVE-2018-6358 | 2 Debian, Libming | 2 Debian Linux, Libming | 2024-11-21 | N/A |
| The printDefineFont2 function (util/listfdb.c) in libming through 0.4.8 is vulnerable to a heap-based buffer overflow, which may allow attackers to cause a denial of service or unspecified other impact via a crafted FDB file. | ||||
| CVE-2018-6357 | 1 Acurax | 1 Social Media Widget | 2024-11-21 | N/A |
| The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS. | ||||
| CVE-2018-6355 | 1 Iball | 2 Ib-wrb302n, Ib-wrb302n Firmware | 2024-11-21 | N/A |
| /goform/setLang on iBall 300M devices with "iB-WRB302N_1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the lang parameter. | ||||
| CVE-2018-6354 | 1 Formspree | 1 Formspree | 2024-11-21 | N/A |
| templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter. | ||||
| CVE-2018-6353 | 1 Electrum | 1 Electrum | 2024-11-21 | N/A |
| The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineering attacks in which a user pastes code that they do not understand and (2) code pasted by a physically proximate attacker at an unattended workstation, which makes it easier for attackers to steal Bitcoin via hook code that runs at a later time when the wallet password has been entered, a different vulnerability than CVE-2018-1000022. | ||||
| CVE-2018-6345 | 1 Facebook | 1 Hhvm | 2024-11-21 | 9.8 Critical |
| The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below). | ||||
| CVE-2018-6313 | 1 Wbce | 1 Wbce Cms | 2024-11-21 | N/A |
| Cross-site scripting (XSS) in WBCE CMS 1.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the Modify Page screen, a different issue than CVE-2017-2118. | ||||
| CVE-2018-6304 | 1 Gemalto | 1 Sentinel Ldk Rte | 2024-11-21 | N/A |
| Stack overflow in custom XML-parser in Gemalto's Sentinel LDK RTE version before 7.65 leads to remote denial of service | ||||
| CVE-2018-6291 | 1 Kaspersky | 1 Secure Mail Gateway | 2024-11-21 | N/A |
| WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1. | ||||
| CVE-2018-6289 | 1 Kaspersky | 1 Secure Mail Gateway | 2024-11-21 | N/A |
| Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1. | ||||