rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-19170 
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the web_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-11T05:00:00.000Z
CVE-2018-19178 
In JEESNS 1.3, com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java allows stored XSS via an HTML EMBED element, a different vulnerability than CVE-2018-17886.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-11T16:00:00.000Z
CVE-2018-19180 
statics/app/index/controller/Install.php in YUNUCMS 1.1.5 (if install.lock is not present) allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DB_PREFIX field, which is written to database.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-11T17:00:00.000Z
CVE-2018-19181 
statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-11T17:00:00.000Z
CVE-2018-19182 
Engelsystem before commit hash 2e28336 allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-26T20:00:00.000Z
CVE-2018-19183 
ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a "code: Buffer.from(my_code, 'hex')" attribute. NOTE: the vendor disputes this because REVERT is a normal bytecode that can be triggered from high-level source code, leading to a normal programmatic execution result.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T00:00:00.000Z
CVE-2018-19184 
cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted bytecode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T02:00:00.000Z
CVE-2018-19185 
An issue has been found in libIEC61850 v1.3. It is a heap-based buffer overflow in BerEncoder_encodeOctetString in mms/asn1/ber_encoder.c. This is exploitable even after CVE-2018-18834 has been patched, with a different dataSetValue sequence than the CVE-2018-18834 attack vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T05:00:00.000Z
CVE-2018-19186 
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T07:00:00.000Z
CVE-2018-19187 
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in a success.php echo statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T07:00:00.000Z
CVE-2018-19188 
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T07:00:00.000Z
CVE-2018-19189 
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T07:00:00.000Z
CVE-2018-19190 
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error_msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T07:00:00.000Z
CVE-2018-19191 
Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T21:27:18.000Z
CVE-2018-19192 
An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the data[content] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T05:00:00.000Z
CVE-2018-19193 
An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the "New news" screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T05:00:00.000Z
CVE-2018-19194 
An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T05:00:00.000Z
CVE-2018-19195 
An issue was discovered in XiaoCms 20141229. There is XSS related to the template\default\show_product.html file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T05:00:00.000Z
CVE-2018-19196 
An issue was discovered in XiaoCms 20141229. It allows remote attackers to execute arbitrary code by using the type parameter to bypass the standard admin\controller\uploadfile.php restrictions on uploaded file types (jpg, jpeg, bmp, png, gif), as demonstrated by an admin/index.php?c=uploadfile&a=uploadify_upload&type=php URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T05:00:00.000Z
CVE-2018-19197 
An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths[]=../ directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T05:00:00.000Z
CVE-2018-19198 
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T15:00:00.000Z
CVE-2018-19199 
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T15:00:00.000Z
CVE-2018-19200 
An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T15:00:00.000Z
CVE-2018-19201 
A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-29T18:58:41.000Z
CVE-2018-19202 
A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-11T20:00:10.000Z
CVE-2018-19203 
PRTG Network Monitor before 18.2.41.1652 allows remote unauthenticated attackers to terminate the PRTG Core Server Service via a special HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T16:00:00.000Z
CVE-2018-19204 
PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker (with read-write privileges) to execute arbitrary code and OS commands with system privileges. When creating an HTTP Advanced Sensor, the user's input in the POST parameter 'proxyport_' is mishandled. The attacker can craft an HTTP request and override the 'writeresult' command-line parameter for HttpAdvancedSensor.exe to store arbitrary data in an arbitrary place on the file system. For example, the attacker can create an executable file in the \Custom Sensors\EXE directory and execute it by creating EXE/Script Sensor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T16:00:00.000Z
CVE-2018-19205 
Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T17:00:00.000Z
CVE-2018-19206 
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T17:00:00.000Z
CVE-2018-19207 
The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T17:00:00.000Z
CVE-2018-19208 
In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack. This is related to WPXTable.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19209 
Netwide Assembler (NASM) 2.14rc15 has a NULL pointer dereference in the function find_label in asm/labels.c that will lead to a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19210 
In LibTIFF 4.0.9, there is a NULL pointer dereference in the TIFFWriteDirectorySec function in tif_dirwrite.c that will lead to a denial of service attack, as demonstrated by tiffset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19211 
In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19212 
In libwebm through 2018-10-03, there is an abort caused by libwebm::Webm2Pes::InitWebmParser() that will lead to a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19213 
Netwide Assembler (NASM) through 2.14rc16 has memory leaks that may lead to DoS, related to nasm_malloc in nasmlib/malloc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19214 
Netwide Assembler (NASM) 2.14rc15 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for insufficient input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19215 
Netwide Assembler (NASM) 2.14rc16 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for the special cases of the % and $ and ! characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19216 
Netwide Assembler (NASM) before 2.13.02 has a use-after-free in detoken at asm/preproc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19217 
In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19218 
In LibSass 3.5-stable, there is an illegal address access at Sass::Parser::parse_css_variable_value_token that will lead to a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19219 
In LibSass 3.5-stable, there is an illegal address access at Sass::Eval::operator that will lead to a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T19:00:00.000Z
CVE-2018-19220 
An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T20:00:00.000Z
CVE-2018-19221 
An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T20:00:00.000Z
CVE-2018-19222 
An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysql_hy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T20:00:00.000Z
CVE-2018-19223 
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T20:00:00.000Z
CVE-2018-19224 
An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T20:00:00.000Z
CVE-2018-19225 
An issue was discovered in LAOBANCMS 2.0. admin/mima.php has CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T20:00:00.000Z
CVE-2018-19226 
An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to list .txt files via a direct request for the /data/0/admin.txt URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T20:00:00.000Z
CVE-2018-19227 
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/liuyan.php neirong[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T20:00:00.000Z
CVE-2018-19228 
An issue was discovered in LAOBANCMS 2.0. It allows arbitrary file deletion via ../ directory traversal in the admin/pic.php del parameter, as demonstrated by deleting install/install.txt to permit a reinstallation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T20:00:00.000Z
CVE-2018-19229 
An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-12T20:00:00.000Z
CVE-2018-19232 
The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows remote attackers to cause a denial of service via a FIRMWAREUPDATE GET request, as demonstrated by the /DOWN/FIRMWAREUPDATE/ROM1 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-24T17:00:00.000Z
CVE-2018-19233 
COMPAREX Miss Marple Enterprise Edition before 2.0 allows local users to execute arbitrary code by reading the user name and encrypted password hard-coded in an Inventory Agent configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T17:00:00.000Z
CVE-2018-19234 
The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges via vectors related to missing update validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T17:00:00.000Z
CVE-2018-19239 
TRENDnet TEW-673GRU v1.00b40 devices have an OS command injection vulnerability in the start_arpping function of the timer binary, which allows remote attackers to execute arbitrary commands via three parameters (dhcpd_start, dhcpd_end, and lan_ipaddr) passed to the apply.cgi binary through a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-19240 
Buffer overflow in network.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload (without authentication).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-19241 
Buffer overflow in video.cgi on TRENDnet TV-IP110WN V1.2.2 build 68, V1.2.2.65, and V1.2.2 build 64 and TV-IP121WN V1.2.2 build 28 devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload (without authentication).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-19242 
Buffer overflow in apply.cgi on TRENDnet TEW-632BRP 1.010B32 and TEW-673GRU devices allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload (with authentication).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-20T22:00:00.000Z
CVE-2018-19244 
An XML External Entity (XXE) vulnerability exists in the Charles 4.2.7 import/export setup option. If a user imports a "Charles Settings.xml" file from an attacker, an intranet network may be accessed and information may be leaked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-13T06:00:00.000Z
CVE-2018-19246 
PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app_key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-13T07:00:00.000Z
CVE-2018-19248 
The web service on Epson WorkForce WF-2861 10.48 LQ22I3(Recovery-mode), WF-2861 10.51.LQ20I6, and WF-2861 10.52.LQ17IA devices allows remote attackers to upload a firmware file and reset the printer without authentication by making a request to the /DOWN/FIRMWAREUPDATE/ROM1 URI and a POST request to the /FIRMWAREUPDATE URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-24T17:00:00.000Z
CVE-2018-19249 
The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data, parsing the response under the object card{}, and reading the cvc_check information if the creation is successful without charging the actual card used in the transaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-03T22:00:00.000Z
CVE-2018-19271 
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T11:00:00.000Z
CVE-2018-19274 
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-17T13:00:00.000Z
CVE-2018-19275 
The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain unauthorized access and execute arbitrary scripts with potential impacts to the confidentiality, integrity and availability of the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-02T17:47:36.000Z
CVE-2018-19276 
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T21:30:20.000Z
CVE-2018-19277 
securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T11:00:00.000Z
CVE-2018-19278 
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T20:00:00.000Z
CVE-2018-19279 
PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file sizes less than 600 bytes. The effect on SSD devices may be greater.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T20:00:00.000Z
CVE-2018-19280 
Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T20:00:00.000Z
CVE-2018-19281 
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-14T20:00:00.000Z
CVE-2018-19282 
Rockwell Automation PowerFlex 525 AC Drives 5.001 and earlier allow remote attackers to cause a denial of service by crashing the Common Industrial Protocol (CIP) network stack. The vulnerability allows the attacker to crash the CIP in a way that it does not accept new connections, but keeps the current connections active, which can prevent legitimate users from recovering control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-04T20:31:36.000Z
CVE-2018-19286 
The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value), and then creating and sharing a note.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T05:00:00.000Z
CVE-2018-19287 
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T05:00:00.000Z
CVE-2018-19288 
Zoho ManageEngine OpManager 12.3 before Build 123223 has XSS via the updateWidget API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-15T06:00:00.000Z