Total
404364 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-18964 | 1 Oscommerce | 1 Online Merchant | 2026-06-17 | 4.0 MEDIUM | 4.9 MEDIUM |
| osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. The .htaccess file in catalog/images/ bans the html extension, but there are several extensions in which contained HTML can be executed, such as the svg extension. | |||||
| CVE-2018-18963 | 1 Degraupublicidade | 1 Degraupublicidade | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Busca.aspx.cs in Degrau Publicidade e Internet Plataforma de E-commerce allows SQL Injection via the busca/ URI. | |||||
| CVE-2018-18960 | 1 Epson | 2 Epson Workforce Wf-2861, Epson Workforce Wf-2861 Firmware | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. They use SNMP to find certain devices on the network, but the default version is v2c, allowing an amplification attack. | |||||
| CVE-2018-18959 | 1 Epson | 2 Epson Workforce Wf-2861, Epson Workforce Wf-2861 Firmware | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longer functions until a reboot. | |||||
| CVE-2018-18958 | 1 Opnsense | 1 Opnsense | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| OPNsense 18.7.x before 18.7.7 has Incorrect Access Control. | |||||
| CVE-2018-18957 | 1 Mz-automation | 1 Libiec61850 | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue has been found in libIEC61850 v1.3. It is a stack-based buffer overflow in prepareGooseBuffer in goose/goose_publisher.c. | |||||
| CVE-2018-18956 | 1 Suricata-ids | 1 Suricata | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The ProcessMimeEntity function in util-decode-mime.c in Suricata 4.x before 4.0.6 allows remote attackers to cause a denial of service (segfault and daemon crash) via crafted input to the SMTP parser, as exploited in the wild in November 2018. | |||||
| CVE-2018-18955 | 2 Canonical, Linux | 2 Ubuntu Linux, Linux Kernel | 2026-06-17 | 4.4 MEDIUM | 7.0 HIGH |
| In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction. | |||||
| CVE-2018-18954 | 3 Canonical, Opensuse, Qemu | 3 Ubuntu Linux, Leap, Qemu | 2026-06-17 | 2.1 LOW | 5.5 MEDIUM |
| The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory. | |||||
| CVE-2018-18952 | 1 Jeecms | 1 Jeecms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| JEECMS 9.3 has XSS via an index.do#/content/update?type=update URI. | |||||
| CVE-2018-18950 | 1 Kindeditor | 1 Kindeditor | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| KindEditor through 4.1.11 has a path traversal vulnerability in php/upload_json.php. Anyone can browse a file or directory in the kindeditor/attached/ folder via the path parameter without authentication. | |||||
| CVE-2018-18949 | 1 Zohocorp | 1 Manageengine Opmanager | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Zoho ManageEngine OpManager 12.3 before 123222 has SQL Injection via Mail Server settings. | |||||
| CVE-2018-18944 | 1 Artha Project | 1 Artha | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Artha ~ The Open Thesaurus 1.0.3.0 has a Buffer Overflow. | |||||
| CVE-2018-18943 | 1 Basercms | 1 Basercms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the data[UploaderCategory][name] parameter to an admin/uploader/uploader_categories/edit URI. | |||||
| CVE-2018-18942 | 1 Basercms | 1 Basercms | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter. | |||||
| CVE-2018-18941 | 1 Vignette | 1 Content Management | 2026-06-17 | 5.0 MEDIUM | 9.8 CRITICAL |
| In Vignette Content Management version 6, it is possible to gain remote access to administrator privileges by discovering the admin password in the vgn/ccb/user/mgmt/user/edit/0,1628,0,00.html?uid=admin HTML source code, and then creating a privileged user account. NOTE: this product is discontinued. | |||||
| CVE-2018-18940 | 1 Netscape | 1 Enterprise Server | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| servlet/SnoopServlet (a servlet installed by default) in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=[XSS] in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. NOTE: this product is discontinued. | |||||
| CVE-2018-18939 | 1 Wuzhi Cms Project | 1 Wuzhi Cms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field. | |||||
| CVE-2018-18938 | 1 Wuzhicms | 1 Wuzhicms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field. | |||||
| CVE-2018-18937 | 1 Mz-automation | 1 Libiec61850 | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in ClientDataSet_getValues in client/ied_connection.c. | |||||