2018

16,509 vulnerabilities published in 2018.

All 16,509 CRITICAL 2,545 HIGH 7,428 MEDIUM 6,298 LOW 238 KEV 76

Results

6,298 of 16,509· Page 62/126

6.1

CVE-2018-3769

ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.

Jul 5 4.8

CVE-2018-3764

In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a s

Jul 5 4.8

CVE-2018-3763

In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could l

Jul 5 4.3

CVE-2018-3762

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowi

Jul 5 5.5

CVE-2018-8026

This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in

Jul 5 6.5

CVE-2018-13251

In libming 0.4.8, there is an excessive memory allocation attempt in the readBytes function of the util/read.c file, rel

Jul 5 6.5

CVE-2018-13250

libming 0.4.8 has a NULL pointer dereference in the getString function of the decompile.c file, related to decompileSTRI

Jul 5 6.5

CVE-2018-8928

Cross-site scripting (XSS) vulnerability in Address Book Editor in Synology CardDAV Server before 6.0.8-0086 allows remo

Jul 5 6.5

CVE-2018-10885

In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash

Jul 5 6.5

CVE-2017-16773

Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote a

Jul 5 6.5

CVE-2018-13153

In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.

Jul 5 5.4

CVE-2015-9260

An issue was discovered in BEdita before 3.7.0. A cross-site scripting (XSS) attack occurs via a crafted pages/showObjec

Jul 5 6.1

CVE-2018-13136

The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.

Jul 4 6.1

CVE-2018-13134

TP-Link Archer C1200 1.13 Build 2018/01/24 rel.52299 EU devices have XSS via the PATH_INFO to the /webpages/data URI.

Jul 4 6.5

CVE-2018-13122

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to delete arbitrary files via the Delete File(s) s

Jul 3 5.5

CVE-2018-13121

RealOne Player 2.0 Build 6.0.11.872 allows remote attackers to cause a denial of service (array out-of-bounds access and

Jul 3 5.4

CVE-2018-9337

The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and

Jul 3 5.4

CVE-2018-9335

The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS

Jul 3 5.5

CVE-2018-9334

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earli

Jul 3 5.5

CVE-2018-9242

The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earli

Jul 3 6.1

CVE-2018-7636

The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScri

Jul 3 6.1

CVE-2018-3748

There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTM

Jul 3 6.1

CVE-2018-3747

The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to

Jul 3 4.7

CVE-2017-0913

Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note

Jul 3 5.4

CVE-2017-0912

Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting. Due to the lack sanitization, it is

Jul 3 6.5

CVE-2018-8036

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite lo

Jul 3 5.4

CVE-2017-1717