National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database



The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics.
 
Last 20 Scored Vulnerability IDs & Summaries CVSS Severity
  • CVE-2018-15411 A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected s... read CVE-2018-15411
    Published: October 05, 2018; 10:29:09 AM -04:00

    V3: 7.8 HIGH
    V2: 9.3 HIGH

  • CVE-2018-1420 IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fix (CF) installation. This can lead to security miss-configuration of the installation. IBM X-Force ID: 138950.
    Published: October 01, 2018; 10:29:00 AM -04:00

  • CVE-2018-1672 IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user. IBM X-Force ID: 144958.
    Published: October 01, 2018; 10:29:00 AM -04:00

  • CVE-2018-17215 An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway. Only the respon... read CVE-2018-17215
    Published: September 26, 2018; 05:29:01 PM -04:00

  • CVE-2017-12573 An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. The device has a command-injection vulnerability in the web management UI on NAS settings page "/cgi-bin/nasset.cgi". An attacker can send a crafted HTTP POST request to... read CVE-2017-12573
    Published: August 24, 2018; 03:29:00 PM -04:00

    V3: 8.8 HIGH
    V2: 9.0 HIGH

  • CVE-2017-12574 An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. A hardcoded credential "supervisor:dangerous" was injected into web authentication database "/.htpasswd" during booting process, which allows attackers to gain unauthoriz... read CVE-2017-12574
    Published: August 24, 2018; 03:29:00 PM -04:00

  • CVE-2018-1777 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credential... read CVE-2018-1777
    Published: October 16, 2018; 03:29:00 PM -04:00

  • CVE-2018-1767 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Cachemonitor is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading... read CVE-2018-1767
    Published: October 29, 2018; 11:29:00 AM -04:00

  • CVE-2018-0675 AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors.
    Published: September 04, 2018; 09:29:07 AM -04:00

  • CVE-2018-0674 AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors.
    Published: September 04, 2018; 09:29:06 AM -04:00

  • CVE-2018-1794 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi... read CVE-2018-1794
    Published: October 03, 2018; 10:29:00 AM -04:00

  • CVE-2018-1793 IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin... read CVE-2018-1793
    Published: October 03, 2018; 10:29:00 AM -04:00

  • CVE-2018-11761 In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
    Published: September 19, 2018; 10:29:00 AM -04:00

  • CVE-2018-11762 In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that... read CVE-2018-11762
    Published: September 19, 2018; 10:29:00 AM -04:00

  • CVE-2018-1517 A flaw in the java.math component in IBM SDK, Java Technology Edition 6.0, 7.0, and 8.0 may allow an attacker to inflict a denial-of-service attack with specially crafted String data. IBM X-Force ID: 141681.
    Published: August 20, 2018; 05:29:01 PM -04:00

  • CVE-2018-0657 Cross-site scripting vulnerability in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE (EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) version 2.3.17 and earlier, GMO-PG... read CVE-2018-0657
    Published: September 07, 2018; 10:29:02 AM -04:00

  • CVE-2018-1603 IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le... read CVE-2018-1603
    Published: October 04, 2018; 10:29:00 AM -04:00

  • CVE-2018-1602 IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le... read CVE-2018-1602
    Published: October 04, 2018; 10:29:00 AM -04:00

  • CVE-2018-1692 IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le... read CVE-2018-1692
    Published: October 02, 2018; 11:29:03 AM -04:00

  • CVE-2018-1691 IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially le... read CVE-2018-1691
    Published: October 02, 2018; 11:29:02 AM -04:00