High
CVE-2018-20094
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2018-20000
Improper Restriction of XML External Entity Reference in bedework:bw-webdav
Critical
CVE-2018-20059
Improper Restriction of XML External Entity Reference in pippo-core
High
CVE-2018-19907
OS Command Injection in craftercms:crafter-studio
Critical
CVE-2018-9207
Unrestricted Upload of File with Dangerous Type in jquery-file-upload
Unrated
drupal-contrib-2018-081
drupal/jsonapi - SA-CONTRIB-2018-081
High
CVE-2018-20968
Export WordPress Data with Advanced Filters <= 1.4.1 - Cross-Site Request Forgery
High
CVE-2018-20231
Two Factor Authentication <= 1.3.12 - Cross-Site Request Forgery
Critical
CVE-2018-20133
Code injection in ymlref
Unrated
CVE-2018-20170
** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the
Critical
CVE-2018-20156
WP Maintenance Mode <= 2.0.6 - Remote Code Execution
Medium
CVE-2018-5668
Read and Understood < 2.2 - Cross-Site Scripting
Medium
CVE-2018-20099
There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
Medium
CVE-2018-20098
There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
Medium
CVE-2018-20097
There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
Medium
CVE-2018-20096
There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
Medium
CVE-2018-20150
WordPress Core < 5.0.1 Reflected Cross-Site Scripting
High
CVE-2018-20151
WordPress Core < 5.0.1 - Sensitive Information Disclosure
Medium
CVE-2018-20152
WordPress Core < 5.0.1 - Authorization Bypass
Medium
CVE-2018-20153
WordPress Core < 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments
High
CVE-2018-20147
WordPress Core < 5.0.1 - Arbitrary File Deletion
Medium
CVE-2018-20149
WordPress Core < 5.0.1 - Stored Cross-Site Scripting via File Uploads
High
CVE-2018-20148
WordPress Core < 5.0.1 - PHP Object Injection
Critical
CVE-2018-20060
Exposure of Sensitive Information to an Unauthorized Actor in urllib3
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.