Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (40064 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-21042 1 Google 1 Android 2024-11-21 9.8 Critical
An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Dual Messenger allows installation of an arbitrary APK with resultant privileged code execution. The Samsung ID is SVE-2018-13299 (December 2018).
CVE-2018-21039 1 Google 1 Android 2024-11-21 7.5 High
An issue was discovered on Samsung mobile devices with N(7.0) software. With the Location permission for the compass feature in Quick Tools (aka QuickTools), an attacker can bypass the lockscreen. The Samsung ID is SVE-2018-12053 (December 2018).
CVE-2018-21030 1 Jupyter 1 Notebook 2024-11-21 5.3 Medium
Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
CVE-2018-21022 1 Centreon 1 Centreon Web 2024-11-21 8.8 High
makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.
CVE-2018-21021 1 Centreon 1 Centreon Web 2024-11-21 8.8 High
img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.
CVE-2018-21004 1 Carrcommunications 1 Rsvpmaker 2024-11-21 N/A
The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.
CVE-2018-21003 1 Themekraft 1 Buddyforms 2024-11-21 N/A
The buddyforms plugin before 2.2.8 for WordPress has SQL injection.
CVE-2018-20887 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 74.0.0 allows SQL injection during database backups (SEC-420).
CVE-2018-20826 1 Atlassian 1 Jira 2024-11-21 4.3 Medium
The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check.
CVE-2018-20805 1 Mongodb 1 Mongodb 2024-11-21 6.5 Medium
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affects MongoDB Server v4.0 versions prior to 4.0.5 and MongoDB Server v3.6 versions prior to 3.6.10.
CVE-2018-20803 1 Mongodb 1 Mongodb 2024-11-21 6.5 Medium
A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics processing while retaining locks. This issue affects MongoDB Server v4.0 versions prior to 4.0.5; MongoDB Server v3.6 versions prior to 3.6.10 and MongoDB Server v3.4 versions prior to 3.4.19.
CVE-2018-20784 3 Canonical, Linux, Redhat 4 Ubuntu Linux, Linux Kernel, Enterprise Linux and 1 more 2024-11-21 9.8 Critical
In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load.
CVE-2018-20779 1 Traq 1 Traq 2024-11-21 N/A
Traq 3.7.1 allows SQL Injection via a tickets?search= URI.
CVE-2018-20770 1 Xerox 58 Workcentre 3655, Workcentre 3655 Firmware, Workcentre 3655i and 55 more 2024-11-21 N/A
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is Blind SQL Injection.
CVE-2018-20730 1 Nedi 1 Nedi 2024-11-21 N/A
A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component.
CVE-2018-20719 1 Tiki 1 Tikiwiki Cms\/groupware 2024-11-21 N/A
In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.
CVE-2018-20716 1 Cubecart 1 Cubecart 2024-11-21 N/A
CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the "I forgot my Password!" feature.
CVE-2018-20715 1 Oxid-esales 1 Eshop 2024-11-21 N/A
The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php.
CVE-2018-20713 1 Shopware 1 Shopware 2024-11-21 N/A
Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404.
CVE-2018-20678 1 Librenms 1 Librenms 2024-11-21 N/A
LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search.