Export limit exceeded: 339825 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10914 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-16670 1 Circontrol 1 Circarlife Scada 2024-11-21 N/A
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html.
CVE-2018-16668 1 Circontrol 1 Circarlife Scada 2024-11-21 5.3 Medium
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository.
CVE-2018-16590 1 Furuno 4 Felcom 250, Felcom 250 Firmware, Felcom 500 and 1 more 2024-11-21 N/A
FURUNO FELCOM 250 and 500 devices use only client-side JavaScript in login.js for authentication.
CVE-2018-16553 1 Jspxcms 1 Jspxcms 2024-11-21 N/A
In Jspxcms 9.0.0, a vulnerable URL routing implementation allows remote code execution after logging in as web admin.
CVE-2018-16496 1 Versa-networks 1 Versa Director 2024-11-21 5.3 Medium
In Versa Director, the un-authentication request found.
CVE-2018-16476 2 Redhat, Rubyonrails 3 Cloudforms, Cloudforms Managementengine, Rails 2024-11-21 N/A
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
CVE-2018-16467 1 Nextcloud 1 Nextcloud Server 2024-11-21 N/A
A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.
CVE-2018-16466 1 Nextcloud 1 Nextcloud Server 2024-11-21 N/A
Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.
CVE-2018-16465 1 Nextcloud 1 Nextcloud Server 2024-11-21 N/A
Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load.
CVE-2018-16464 1 Nextcloud 1 Nextcloud Server 2024-11-21 N/A
A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.
CVE-2018-16286 1 Lg 1 Supersign Cms 2024-11-21 N/A
LG SuperSign CMS allows authentication bypass because the CAPTCHA requirement is skipped if a captcha:pass cookie is sent, and because the PIN is limited to four digits.
CVE-2018-16219 1 Audiocodes 2 405hd, 405hd Firmware 2024-11-21 N/A
A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the same network as the device) to change the admin password without authentication via a POST request.
CVE-2018-16160 2 Ftsafe, Microsoft 3 Securecore, Windows 8, Windows 8.1 2024-11-21 N/A
SecureCore Standard Edition Version 2.x allows an attacker to bypass the product 's authentication to log in to a Windows PC.
CVE-2018-16086 2 Google, Redhat 2 Chrome, Rhel Extras 2024-11-21 N/A
Insufficient policy enforcement in extensions API in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.
CVE-2018-16077 2 Google, Redhat 2 Chrome, Rhel Extras 2024-11-21 N/A
Object lifecycle issue in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVE-2018-16074 2 Google, Redhat 2 Chrome, Rhel Extras 2024-11-21 N/A
Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page.
CVE-2018-16073 2 Google, Redhat 2 Chrome, Rhel Extras 2024-11-21 N/A
Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page.
CVE-2018-15819 1 Easyio 2 Easyio 30p, Easyio 30p Firmware 2024-11-21 7.5 High
EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js.
CVE-2018-15758 2 Pivotal Software, Redhat 2 Spring Security Oauth, Jboss Fuse 2024-11-21 N/A
Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval endpoint that can modify the previously saved authorization request and lead to a privilege escalation on the subsequent approval. This scenario can happen if the application is configured to use a custom approval endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and use a custom Approval Endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability does not expose applications that: Act in the role of an Authorization Server and use the default Approval Endpoint, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
CVE-2018-15751 1 Saltstack 1 Salt 2024-11-21 N/A
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).