Total
34649 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-2479 | 1 Sap | 1 Businessobjects Bi Platform | 2018-11-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | |||||
| CVE-2016-4003 | 1 Apache | 1 Struts | 2018-11-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter. | |||||
| CVE-2015-5169 | 1 Apache | 1 Struts | 2018-11-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20. | |||||
| CVE-2018-18069 | 1 Wpml | 1 Wpml | 2018-11-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php. | |||||
| CVE-2018-2466 | 1 Sap | 1 Data Services | 2018-11-23 | 3.5 LOW | 5.4 MEDIUM |
| In Impact and Lineage Analysis in SAP Data Services, version 4.2, the management console does not sufficiently validate user-controlled inputs, which results in Cross-Site Scripting (XSS) vulnerability. | |||||
| CVE-2018-18029 | 1 Naviwebs | 1 Navigate Cms | 2018-11-23 | 3.5 LOW | 5.4 MEDIUM |
| Navigate CMS has Stored XSS via the navigate.php Title field in an edit action. | |||||
| CVE-2018-18082 | 1 Bijiadao | 1 Waimai Super Cms | 2018-11-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in Waimai Super Cms 20150505 via the fname parameter to the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave URI. | |||||
| CVE-2018-18198 | 1 Redaxo | 1 Redaxo | 2018-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=[XSS] request. | |||||
| CVE-2018-18199 | 1 Redaxo | 1 Redaxo | 2018-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Mediamanager in REDAXO before 5.6.4 has XSS. | |||||
| CVE-2018-18210 | 1 Dilicms | 1 Dilicms | 2018-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_url parameter. | |||||
| CVE-2018-18209 | 1 Dilicms | 1 Dilicms | 2018-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_type parameter. | |||||
| CVE-2018-0657 | 2 Ec-cube, Gmo-pg | 3 Ec-cube, Ec-cube Payment Module, Gmo-pg Payment Module | 2018-11-20 | 3.5 LOW | 4.8 MEDIUM |
| Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG Payment Module (PG Multi-Payment Service) (2.12) version 3.5.23 and earlier, and GMO-PG Payment Module (PG Multi-Payment Service) (2.11) version 2.3.17 and earlier) allow an attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2015-2420 | 1 Microsoft | 1 System Center Operations Manager | 2018-11-20 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and R2 before Rollup 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "System Center Operations Manager Web Console XSS Vulnerability." | |||||
| CVE-2018-16050 | 1 Gitlab | 1 Gitlab | 2018-11-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View. | |||||
| CVE-2018-17849 | 1 Naviwebs | 1 Navigate Cms | 2018-11-19 | 3.5 LOW | 5.4 MEDIUM |
| Navigate CMS 2.8 has Stored XSS via a navigate_upload.php (aka File Upload) request with a multipart/form-data JavaScript payload. | |||||
| CVE-2015-9273 | 1 Wp-slimstat | 1 Slimstat Analytics | 2018-11-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking. | |||||
| CVE-2018-17946 | 1 Tribulant | 1 Slideshow Gallery | 2018-11-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter. | |||||
| CVE-2018-17876 | 1 Web-feet | 1 Coaster Cms | 2018-11-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product. | |||||
| CVE-2018-17947 | 1 Atmist | 1 Snazzy Maps | 2018-11-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter. | |||||
| CVE-2018-17886 | 1 Jeesns | 1 Jeesns | 2018-11-16 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in JEESNS 1.3. The XSS filter in com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java could be bypassed, as demonstrated by a <svg/onLoad=confirm substring. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-12429. | |||||