Export limit exceeded: 89938 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (89938 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-11151 | 1 Quest | 1 Disk Backup | 2024-11-21 | N/A |
| Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46). | ||||
| CVE-2018-11150 | 1 Quest | 1 Disk Backup | 2024-11-21 | N/A |
| Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46). | ||||
| CVE-2018-11149 | 1 Quest | 1 Disk Backup | 2024-11-21 | N/A |
| Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46). | ||||
| CVE-2018-11148 | 1 Quest | 1 Disk Backup | 2024-11-21 | N/A |
| Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46). | ||||
| CVE-2018-11147 | 1 Quest | 1 Disk Backup | 2024-11-21 | N/A |
| Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46). | ||||
| CVE-2018-11146 | 1 Quest | 1 Disk Backup | 2024-11-21 | N/A |
| Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46). | ||||
| CVE-2018-11145 | 1 Quest | 1 Disk Backup | 2024-11-21 | N/A |
| Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46). | ||||
| CVE-2018-11144 | 1 Quest | 1 Disk Backup | 2024-11-21 | N/A |
| Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46). | ||||
| CVE-2018-11143 | 1 Quest | 1 Disk Backup | 2024-11-21 | N/A |
| Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46). | ||||
| CVE-2018-11139 | 1 Quest | 1 Kace System Management Appliance | 2024-11-21 | N/A |
| The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TEST_SERVER' sent to the script via the POST method. | ||||
| CVE-2018-11133 | 1 Quest | 1 Kace System Management Appliance | 2024-11-21 | N/A |
| The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting. | ||||
| CVE-2018-11132 | 1 Quest | 1 Kace System Management Appliance | 2024-11-21 | N/A |
| In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root. | ||||
| CVE-2018-11128 | 1 Pdfparser | 1 Pdfparser | 2024-11-21 | N/A |
| The ObjReader::ReadObj() function in ObjReader.cpp in vincent0629 PDFParser allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly execute arbitrary code via a crafted pdf file. | ||||
| CVE-2018-11124 | 1 Opmantek | 1 Open-audit | 2024-11-21 | N/A |
| Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute. | ||||
| CVE-2018-11120 | 1 Ilias | 1 Ilias | 2024-11-21 | N/A |
| Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS. | ||||
| CVE-2018-11118 | 1 Ilias | 1 Ilias | 2024-11-21 | N/A |
| The RSS subsystem in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a URI to Services/Feeds/classes/class.ilExternalFeedItem.php. | ||||
| CVE-2018-11117 | 1 Ilias | 1 Ilias | 2024-11-21 | N/A |
| Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute. | ||||
| CVE-2018-11116 | 1 Openwrt | 1 Openwrt | 2024-11-21 | 8.8 High |
| OpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl.d files, which allows remote authenticated users to call arbitrary methods (i.e., achieve ubus access over HTTP) that were only supposed to be accessible to a specific user, as demonstrated by the file, log, and service namespaces, potentially leading to remote Information Disclosure or Code Execution. NOTE: The developer disputes this as a vulnerability, indicating that rpcd functions appropriately | ||||
| CVE-2018-11106 | 1 Netgear | 10 Wc7500, Wc7500 Firmware, Wc7520 and 7 more | 2024-11-21 | 9.8 Critical |
| NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions prior to 6.5.3.5. | ||||
| CVE-2018-11105 | 1 3cx | 1 Live Chat | 2024-11-21 | N/A |
| There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email) input fields to wp-json/wp_live_chat_support/v1/start_chat whenever a malicious attacker would initiate a new chat with an administrator. NOTE: this issue exists because of an incomplete fix for CVE-2018-9864. | ||||