Search

Expected end of text, found '.' (at char 13), (line:1, col:14)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (339428 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-12115 2 Nodejs, Redhat 5 Node.js, Openshift, Openshift Application Runtimes and 2 more 2024-11-21 N/A
In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.
CVE-2018-12114 1 Maccms 1 Maccms 2024-11-21 N/A
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
CVE-2018-12113 1 Coreftp 1 Core Ftp 2024-11-21 N/A
Core FTP LE version 2.2 Build 1921 is prone to a buffer overflow vulnerability that may result in a DoS or remote code execution via a PASV response.
CVE-2018-12112 1 Md4c Project 1 Md4c 2024-11-21 N/A
md_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact via a crafted file.
CVE-2018-12111 1 Canon 1 Efi Printme 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the /wt3/mydocs.php URI.
CVE-2018-12110 1 Portfoliocms Project 1 Portfoliocms 2024-11-21 N/A
portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter.
CVE-2018-12109 1 Flif 1 Flif 2024-11-21 N/A
An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The TransformPaletteC<FileIO>::process function in transform/palette_C.hpp allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PAM image file.
CVE-2018-12108 1 Dropbox 1 Lepton 2024-11-21 N/A
An issue was discovered in Dropbox Lepton 1.2.1. The validateAndCompress function in validation.cc allows remote attackers to cause a denial of service (SIGFPE and application crash) via a malformed file.
CVE-2018-12104 1 Airbnb 1 Knowledge Repo 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/new_report.kp URI.
CVE-2018-12103 2 D-link, Dlink 6 Dir-885\/r, Dir-885l\/r Firmware, Dir-895\/r and 3 more 2024-11-21 N/A
An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03beta01 and earlier, and DIR-895L/R with firmware 1.21B04beta04 and earlier devices (all hardware revisions). Due to the predictability of the /docs/captcha_(number).jpeg URI, being local to the network, but unauthenticated to the administrator's panel, an attacker can disclose the CAPTCHAs used by the access point and can elect to load the CAPTCHA of their choosing, leading to unauthorized login attempts to the access point.
CVE-2018-12102 1 Md4c Project 1 Md4c 2024-11-21 N/A
md4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c, related to ctx->current_block.
CVE-2018-12101 1 Clippercms 1 Clippercms 2024-11-21 N/A
CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields.
CVE-2018-12100 1 Sonatype 1 Nexus Repository Manager 2024-11-21 N/A
Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.
CVE-2018-12099 3 Grafana, Netapp, Redhat 4 Grafana, Active Iq Performance Analytics Services, Storagegrid Webscale Nas Bridge and 1 more 2024-11-21 N/A
Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.
CVE-2018-12098 1 Liblnk Project 1 Liblnk 2024-11-21 N/A
The liblnk_data_block_read function in liblnk_data_block.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub
CVE-2018-12097 1 Liblnk Project 1 Liblnk 2024-11-21 N/A
The liblnk_location_information_read_data function in liblnk_location_information.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub
CVE-2018-12096 1 Liblnk Project 1 Liblnk 2024-11-21 N/A
The liblnk_data_string_get_utf8_string_size function in liblnk_data_string.c in liblnk through 2018-04-19 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted lnk file. NOTE: the vendor has disputed this as described in libyal/liblnk issue 33 on GitHub
CVE-2018-12095 1 Oecms Project 1 Oecms 2024-11-21 N/A
A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php.
CVE-2018-12094 1 Dimofinf 1 Dimofinf Cms 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
CVE-2018-12093 1 Tinyexr Project 1 Tinyexr 2024-11-21 N/A
tinyexr 0.9.5 has a memory leak in ParseEXRHeaderFromMemory in tinyexr.h.