Search

Expected end of text, found '.' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (337625 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-13323 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
Cross-site scripting in detail.html in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute JavaScript via the "username" cookie.
CVE-2018-13322 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
Directory traversal in list_folders method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to list directory contents via the "path" parameter.
CVE-2018-13321 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
Incorrect access controls in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allow attackers to call dangerous internal functions via the "method" parameter.
CVE-2018-13320 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters.
CVE-2018-13319 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device information via an unauthenticated POST request.
CVE-2018-13318 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter.
CVE-2018-13317 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm.
CVE-2018-13316 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter.
CVE-2018-13315 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request.
CVE-2018-13314 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter.
CVE-2018-13313 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 6.5 Medium
In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.
CVE-2018-13312 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field.
CVE-2018-13311 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter.
CVE-2018-13310 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username.
CVE-2018-13309 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password.
CVE-2018-13308 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field.
CVE-2018-13307 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST parameter. Certain payloads cause the device to become permanently inoperable.
CVE-2018-13306 1 Totolink 2 A3002ru, A3002ru Firmware 2024-11-21 N/A
System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter.
CVE-2018-13305 1 Ffmpeg 1 Ffmpeg 2024-11-21 N/A
In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service.
CVE-2018-13304 1 Ffmpeg 1 Ffmpeg 2024-11-21 N/A
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c.