Export limit exceeded: 87157 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (87157 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-14886 | 1 Odoo | 1 Odoo | 2024-11-21 | N/A |
| The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description. | ||||
| CVE-2018-14877 | 1 Weaselcms Project | 1 Weaselcms | 2024-11-21 | N/A |
| An issue was discovered in WeaselCMS v0.3.5. XSS exists via Site Language, Site Title, Site Description, and Site Keywords on the SETTINGS page. | ||||
| CVE-2018-14875 | 1 Polarisft | 1 Intellect Core Banking | 2024-11-21 | N/A |
| An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the Customerid, formName, FrameId, or MODE parameter. | ||||
| CVE-2018-14873 | 1 Rincewind Project | 1 Rincewind | 2024-11-21 | N/A |
| An issue was discovered in Rincewind 0.1. There is a cross-site scripting (XSS) vulnerability involving a p=account request to index.php and another file named commonPages.php. | ||||
| CVE-2018-14869 | 1 Php Template Store Script Project | 1 Php Template Store Script | 2024-11-21 | N/A |
| PHP Template Store Script 3.0.6 allows XSS via the Address line 1, Address Line 2, Bank name, or A/C Holder name field in a profile. | ||||
| CVE-2018-14866 | 1 Odoo | 1 Odoo | 2024-11-21 | N/A |
| Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to access data in transient records that they do not own by making an RPC call before garbage collection occurs. | ||||
| CVE-2018-14862 | 1 Odoo | 1 Odoo | 2024-11-21 | N/A |
| Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to delete arbitrary menuitems via a crafted RPC request. | ||||
| CVE-2018-14861 | 1 Odoo | 1 Odoo | 2024-11-21 | N/A |
| Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed passwords of other users. | ||||
| CVE-2018-14860 | 1 Odoo | 1 Odoo | 2024-11-21 | N/A |
| Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to escape from the dynamic expression sandbox and execute arbitrary code on the hosting system. | ||||
| CVE-2018-14850 | 1 Tiki | 1 Tikiwiki Cms\/groupware | 2024-11-21 | N/A |
| Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image. | ||||
| CVE-2018-14849 | 1 Tiki | 1 Tikiwiki Cms\/groupware | 2024-11-21 | N/A |
| Tiki before 18.2, 15.7 and 12.14 has XSS via link attributes, related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php. | ||||
| CVE-2018-14846 | 1 Mondula | 1 Multi Step Form | 2024-11-21 | N/A |
| The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php. | ||||
| CVE-2018-14840 | 1 Intelliants | 1 Subrion | 2024-11-21 | N/A |
| uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads). | ||||
| CVE-2018-14838 | 1 Rejucms Project | 1 Rejucms | 2024-11-21 | N/A |
| rejucms 2.1 has stored XSS via the admin/book.php content parameter. | ||||
| CVE-2018-14837 | 1 Wolfcms | 1 Wolf Cms | 2024-11-21 | N/A |
| Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI. | ||||
| CVE-2018-14835 | 1 Subrion | 1 Subrion Cms | 2024-11-21 | N/A |
| Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas. | ||||
| CVE-2018-14825 | 2 Google, Honeywell | 15 Android, Ck75, Cn51 and 12 more | 2024-11-21 | N/A |
| On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android OS 6.0, CN75 running Android OS 6.0, CN75e running Android OS 6.0, CT50 running Android OS 6.0, D75e running Android OS 6.0, CT50 running Android OS 4.4, D75e running Android OS 4.4, CN51 running Android OS 6.0, EDA50k running Android 4.4, EDA50 running Android OS 7.1, EDA50k running Android OS 7.1, EDA70 running Android OS 7.1, EDA60k running Android OS 7.1, and EDA51 running Android OS 8.1), a skilled attacker with advanced knowledge of the target system could exploit this vulnerability by creating an application that would successfully bind to the service and gain elevated system privileges. This could enable the attacker to obtain access to keystrokes, passwords, personal identifiable information, photos, emails, or business-critical documents. | ||||
| CVE-2018-14823 | 1 Fujielectric | 2 V-server, V-server Firmware | 2024-11-21 | 9.8 Critical |
| Fuji Electric V-Server 4.0.3.0 and prior, A stack-based buffer overflow vulnerability has been identified, which may allow remote code execution. | ||||
| CVE-2018-14820 | 1 Advantech | 1 Webaccess | 2024-11-21 | N/A |
| Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion when processing. | ||||
| CVE-2018-14818 | 1 We-con | 2 Pi Studio, Pi Studio Hmi | 2024-11-21 | 9.8 Critical |
| WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior have a stack-based buffer overflow vulnerability which may allow remote code execution. | ||||