Total
34649 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-10109 | 1 Monstra | 1 Monstra | 2018-05-16 | 3.5 LOW | 4.8 MEDIUM |
| Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a new page in the blog catalog. | |||||
| CVE-2018-6958 | 1 Vmware | 1 Vrealize Automation | 2018-05-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| VMware vRealize Automation (vRA) prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting (XSS) attack. Exploitation of this issue may lead to the compromise of the vRA user's workstation. | |||||
| CVE-2018-10121 | 1 Monstra | 1 Monstra | 2018-05-16 | 3.5 LOW | 4.8 MEDIUM |
| plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=edit_page&name=error404 (aka Edit 404 page) action. | |||||
| CVE-2015-4557 | 1 Nextendweb | 1 Nextend Twitter Connect | 2018-05-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter. NOTE: this may overlap CVE-2015-4413. | |||||
| CVE-2018-10000 | 1 Videodownloaderultimate | 1 Video Downloader | 2018-05-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS (UXSS) via vectors related to a link64_msgAddLinks event. | |||||
| CVE-2018-9993 | 1 Yunucms | 1 Yunucms | 2018-05-16 | 3.5 LOW | 4.8 MEDIUM |
| YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/## page (aka a news center page). | |||||
| CVE-2018-6182 | 1 Mahara | 1 Mahara | 2018-05-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but also clean input on the server / PHP side as one can create own packets of POST data containing bad content with which to hit the server. | |||||
| CVE-2017-9838 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2018-05-16 | 3.5 LOW | 5.4 MEDIUM |
| Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters). | |||||
| CVE-2017-18259 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2018-05-16 | 3.5 LOW | 5.4 MEDIUM |
| Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0. | |||||
| CVE-2018-10068 | 1 Jdownloads | 1 Jdownloads | 2018-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| The jDownloads extension before 3.2.59 for Joomla! has XSS. | |||||
| CVE-2018-9985 | 1 Metinfo | 1 Metinfo | 2018-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator. | |||||
| CVE-2018-1000144 | 1 Jenkins | 1 Cucumber Living Documentation | 2018-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynamic that disables the Content-Security-Policy protection for archived artifacts and workspace files, allowing attackers able to control the content of these files to attack Jenkins users. | |||||
| CVE-2017-18100 | 1 Atlassian | 1 Jira | 2018-05-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of quick filters. | |||||
| CVE-2017-0365 | 2 Debian, Mediawiki | 2 Debian Linux, Mediawiki | 2018-05-14 | 2.6 LOW | 4.7 MEDIUM |
| Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations. | |||||
| CVE-2018-10073 | 1 Joyplus-cms Project | 1 Joyplus-cms | 2018-05-14 | 3.5 LOW | 4.8 MEDIUM |
| joyplus-cms 1.6.0 has XSS in manager/admin_vod.php via the keyword parameter. | |||||
| CVE-2018-10128 | 1 Xyhcms Project | 1 Xyhcms | 2018-05-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php. | |||||
| CVE-2018-9844 | 1 Iptanus | 1 Wordpress File Upload | 2018-05-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. | |||||
| CVE-2014-6169 | 1 Ibm | 1 Forms Experience Builder | 2018-05-11 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.0 and 8.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 97777. | |||||
| CVE-2018-10096 | 1 Joyplus-cms Project | 1 Joyplus-cms | 2018-05-11 | 3.5 LOW | 4.8 MEDIUM |
| joyplus-cms 1.6.0 has XSS via the device_name parameter in a manager/admin_ajax.php?action=save flag=add request. | |||||
| CVE-2018-6870 | 1 Website Seller Script Project | 1 Website Seller Script | 2018-05-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature. | |||||