# CVEs published 2019-01-09 196 CVEs were published on January 9, 2019: 0 critical, 3 high. Days are UTC. - [CVE-2016-10736](https://cve.now/CVE-2016-10736.md): The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp\_ (no CVSS) - [CVE-2018-1000406](https://cve.now/CVE-2018-1000406.md): A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameter (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2018-1000407](https://cve.now/CVE-2018-1000407.md): A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.jav (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2018-1000408](https://cve.now/CVE-2018-1000408.md): A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonP (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2018-1000409](https://cve.now/CVE-2018-1000409.md): A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPr (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2018-1000410](https://cve.now/CVE-2018-1000410.md): An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these (no CVSS, org.jenkins-ci.main:jenkins-core) - [CVE-2018-1000411](https://cve.now/CVE-2018-1000411.md): A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the descri (no CVSS, org.jenkins-ci.plugins:junit) - [CVE-2018-1000412](https://cve.now/CVE-2018-1000412.md): An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/ (no CVSS, org.jenkins-ci.plugins:jira) - [CVE-2018-1000413](https://cve.now/CVE-2018-1000413.md): A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly (no CVSS, org.jenkins-ci.plugins:config-file-provider) - [CVE-2018-1000414](https://cve.now/CVE-2018-1000414.md): A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, Fold (no CVSS, org.jenkins-ci.plugins:config-file-provider) - [CVE-2018-1000415](https://cve.now/CVE-2018-1000415.md): A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, Rebui (no CVSS, com.sonyericsson.hudson.plugins.rebuild:rebuild) - [CVE-2018-1000416](https://cve.now/CVE-2018-1000416.md): A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows ar (no CVSS, org.jenkins-ci.plugins:jobConfigHistory) - [CVE-2018-1000417](https://cve.now/CVE-2018-1000417.md): A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.j (no CVSS, org.jenkins-ci.plugins:email-ext) - [CVE-2018-1000418](https://cve.now/CVE-2018-1000418.md): An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers wit (no CVSS, org.jvnet.hudson.plugins:hipchat) - [CVE-2018-1000419](https://cve.now/CVE-2018-1000419.md): An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers wit (no CVSS, org.jvnet.hudson.plugins:hipchat) - [CVE-2018-1000420](https://cve.now/CVE-2018-1000420.md): An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Over (no CVSS, org.jenkins-ci.plugins:mesos) - [CVE-2018-1000421](https://cve.now/CVE-2018-1000421.md): An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Over (no CVSS, org.jenkins-ci.plugins:mesos) - [CVE-2018-1000422](https://cve.now/CVE-2018-1000422.md): An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allow (no CVSS, org.jenkins-ci.plugins:crowd2) - [CVE-2018-1000423](https://cve.now/CVE-2018-1000423.md): An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.j (no CVSS, org.jenkins-ci.plugins:crowd2) - [CVE-2018-1000424](https://cve.now/CVE-2018-1000424.md): An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, Cr (no CVSS, org.jenkins-ci.plugins:artifactory) - [CVE-2018-1000425](https://cve.now/CVE-2018-1000425.md): An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java t (no CVSS, org.jenkins-ci.plugins:sonar) - [CVE-2018-1000426](https://cve.now/CVE-2018-1000426.md): A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, G (no CVSS, de.wellnerbou.jenkins:git-changelog) - [CVE-2018-20681](https://cve.now/CVE-2018-20681.md): mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control (no CVSS) - [CVE-2018-20682](https://cve.now/CVE-2018-20682.md): Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook\_admin\_ids parameter (aka "Admin ids" input in the Facebook section). (no CVSS, forkcms/forkcms) - [CVE-2018-0625](https://cve.now/CVE-2018-0625.md): Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd para (no CVSS, NEC WG1200HP) - [CVE-2018-0626](https://cve.now/CVE-2018-0626.md): Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formW (no CVSS, NEC WG1200HP) - [CVE-2018-0627](https://cve.now/CVE-2018-0627.md): Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid pa (no CVSS, NEC WG1200HP) - [CVE-2018-0628](https://cve.now/CVE-2018-0628.md): Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request an (no CVSS, NEC WG1200HP) - [CVE-2018-0629](https://cve.now/CVE-2018-0629.md): Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response. (no CVSS, NEC Aterm W300P) - [CVE-2018-0630](https://cve.now/CVE-2018-0630.md): Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter. (no CVSS, NEC Aterm W300P) - [CVE-2018-0631](https://cve.now/CVE-2018-0631.md): Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter. (no CVSS, NEC Aterm W300P) - [CVE-2018-0632](https://cve.now/CVE-2018-0632.md): Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request an (no CVSS, NEC Aterm W300P) - [CVE-2018-0633](https://cve.now/CVE-2018-0633.md): Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url para (no CVSS, NEC Aterm W300P) - [CVE-2018-0634](https://cve.now/CVE-2018-0634.md): Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter (no CVSS, NEC HC100RC) - [CVE-2018-0635](https://cve.now/CVE-2018-0635.md): Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter. (no CVSS, NEC HC100RC) - [CVE-2018-0636](https://cve.now/CVE-2018-0636.md): Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter (no CVSS, NEC HC100RC) - [CVE-2018-0637](https://cve.now/CVE-2018-0637.md): Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey paramete (no CVSS, NEC HC100RC) - [CVE-2018-0638](https://cve.now/CVE-2018-0638.md): Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey paramete (no CVSS, NEC HC100RC) - [CVE-2018-0639](https://cve.now/CVE-2018-0639.md): Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools\_firmware.cgi date pa (no CVSS, NEC HC100RC) - [CVE-2018-0640](https://cve.now/CVE-2018-0640.md): Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi (no CVSS, NEC HC100RC) - [CVE-2018-0641](https://cve.now/CVE-2018-0641.md): Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools\_system.c (no CVSS, NEC HC100RC) - [CVE-2018-0651](https://cve.now/CVE-2018-0651.md): Buffer overflow in the license management function of YOKOGAWA products (iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and e (no CVSS, Yokogawa Electric The license management function of YOKOGA…) - [CVE-2018-0665](https://cve.now/CVE-2018-0665.md): Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlie (no CVSS, Yamaha Broadband VoIP Router RT57i · Yamaha Broadband Vo… +5) - [CVE-2018-0666](https://cve.now/CVE-2018-0666.md): Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlie (no CVSS, Yamaha Broadband VoIP Router RT57i · Yamaha Broadband Vo… +5) - [CVE-2018-0667](https://cve.now/CVE-2018-0667.md): Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier allo (no CVSS, MICRONET Installer of INplc SDK Express 3.08 and earlier an…) - [CVE-2018-0668](https://cve.now/CVE-2018-0668.md): Buffer overflow in INplc-RT 3.08 and earlier allows remote attackers to cause denial-of-service (DoS) condition that may result in executing (no CVSS, MICRONET INplc-RT) - [CVE-2018-0669](https://cve.now/CVE-2018-0669.md): INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant tr (no CVSS, MICRONET INplc-RT) - [CVE-2018-0670](https://cve.now/CVE-2018-0670.md): INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant tr (no CVSS, MICRONET INplc-RT) - [CVE-2018-0671](https://cve.now/CVE-2018-0671.md): Privilege escalation vulnerability in INplc-RT 3.08 and earlier allows an attacker with administrator rights to execute arbitrary code on th (no CVSS, MICRONET INplc-RT) - [CVE-2018-0676](https://cve.now/CVE-2018-0676.md): BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the manage (no CVSS, Panasonic BN-SDWBP3) - [CVE-2018-0677](https://cve.now/CVE-2018-0677.md): BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to execute arbitrary OS c (no CVSS, Panasonic BN-SDWBP3) - [CVE-2018-0678](https://cve.now/CVE-2018-0678.md): Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execute arbitrary code via (no CVSS, Panasonic BN-SDWBP3) - [CVE-2018-0688](https://cve.now/CVE-2018-0688.md): Open redirect vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmwar (no CVSS, SEIKO EPSON printers and scanners) - [CVE-2018-0689](https://cve.now/CVE-2018-0689.md): HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N (no CVSS, SEIKO EPSON printers and scanners) - [CVE-2018-0698](https://cve.now/CVE-2018-0698.md): Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecifie (no CVSS, WESEEK GROWI) - [CVE-2018-0702](https://cve.now/CVE-2018-0702.md): Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vector (no CVSS, Cybozu Mailwise) - [CVE-2018-0703](https://cve.now/CVE-2018-0703.md): Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests. (no CVSS, Cybozu Office) - [CVE-2018-0704](https://cve.now/CVE-2018-0704.md): Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen. (no CVSS, Cybozu Office) - [CVE-2018-0705](https://cve.now/CVE-2018-0705.md): Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HTTP requests. (no CVSS, Cybozu Dezie) - [CVE-2018-16164](https://cve.now/CVE-2018-16164.md): Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary (no CVSS, Web-Dorado Event Calendar WD version) - [CVE-2018-16165](https://cve.now/CVE-2018-16165.md): Cross-site scripting vulnerability in LogonTracer 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspe (no CVSS, JPCERT Coordination Center LogonTracer) - [CVE-2018-16166](https://cve.now/CVE-2018-16166.md): LogonTracer 1.2.0 and earlier allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. (no CVSS, JPCERT Coordination Center LogonTracer) - [CVE-2018-16167](https://cve.now/CVE-2018-16167.md): LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS, JPCERT Coordination Center LogonTracer) - [CVE-2018-16168](https://cve.now/CVE-2018-16168.md): LogonTracer 1.2.0 and earlier allows remote attackers to conduct Python code injection attacks via unspecified vectors. (no CVSS, JPCERT Coordination Center LogonTracer) - [CVE-2018-16169](https://cve.now/CVE-2018-16169.md): Cybozu Remote Service 3.0.0 to 3.1.0 allows remote authenticated attackers to upload and execute Java code file on the server via unspecifie (no CVSS, Cybozu Remote Service) - [CVE-2018-16170](https://cve.now/CVE-2018-16170.md): Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 for Windows allows remote authenticated attackers to read arbitrar (no CVSS, Cybozu Remote Service) - [CVE-2018-16171](https://cve.now/CVE-2018-16171.md): Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server vi (no CVSS, Cybozu Remote Service) - [CVE-2018-16172](https://cve.now/CVE-2018-16172.md): Improper countermeasure against clickjacking attack in client certificates management screen was discovered in Cybozu Remote Service 3.0.0 t (no CVSS, Cybozu Remote Service) - [CVE-2018-16173](https://cve.now/CVE-2018-16173.md): Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via u (no CVSS, ThimPress LearnPress) - [CVE-2018-16174](https://cve.now/CVE-2018-16174.md): Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduc (no CVSS, ThimPress LearnPress) - [CVE-2018-16175](https://cve.now/CVE-2018-16175.md): SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL comm (no CVSS, ThimPress LearnPress) - [CVE-2018-16176](https://cve.now/CVE-2018-16176.md): Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan (no CVSS, Japan Atomic Energy Agency Installer of Mapping Tool) - [CVE-2018-16177](https://cve.now/CVE-2018-16177.md): Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an a (no CVSS, NIPPON TELEGRAPH AND TELEPHONE WEST The installer of Window…) - [CVE-2018-16178](https://cve.now/CVE-2018-16178.md): Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user via (no CVSS, Cybozu Garoon) - [CVE-2018-16179](https://cve.now/CVE-2018-16179.md): The Mizuho Direct App for Android version 3.13.0 and earlier does not verify server certificates, which allows man-in-the-middle attackers t (no CVSS, Mizuho Bank Mizuho Direct App for Android) - [CVE-2018-16180](https://cve.now/CVE-2018-16180.md): Cross-site scripting vulnerability in i-FILTER Ver.9.50R05 and earlier allows remote attackers to inject arbitrary web script or HTML via un (no CVSS, Digital Arts i-FILTER) - [CVE-2018-16181](https://cve.now/CVE-2018-16181.md): HTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote attackers to inject arbitrary HTTP headers and cond (no CVSS, Digital Arts i-FILTER) - [CVE-2018-16182](https://cve.now/CVE-2018-16182.md): Untrusted search path vulnerability in the installer of MARKET SPEED Ver.16.4 and earlier allows an attacker to gain privileges via a Trojan (no CVSS, Rakuten Securities The installer of MARKET SPEED) - [CVE-2018-16183](https://cve.now/CVE-2018-16183.md): An unquoted search path vulnerability in some pre-installed applications on Panasonic PC run on Windows 7 (32bit), Windows 7 (64bit), Window (no CVSS, Some pre-installed applications on Panasonic PC) - [CVE-2018-16184](https://cve.now/CVE-2018-16184.md): RICOH Interactive Whiteboard D2200 V1.6 to V2.2, D5500 V1.6 to V2.2, D5510 V1.6 to V2.2, and the display versions with RICOH Interactive Whi (no CVSS, RICOH COMPANY RICOH Interactive Whiteboard) - [CVE-2018-16185](https://cve.now/CVE-2018-16185.md): RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whitebo (no CVSS, RICOH COMPANY RICOH Interactive Whiteboard) - [CVE-2018-16186](https://cve.now/CVE-2018-16186.md): RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whitebo (no CVSS, RICOH COMPANY RICOH Interactive Whiteboard) - [CVE-2018-16187](https://cve.now/CVE-2018-16187.md): The RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whi (no CVSS, RICOH COMPANY RICOH Interactive Whiteboard) - [CVE-2018-16188](https://cve.now/CVE-2018-16188.md): SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display vers (no CVSS, RICOH COMPANY RICOH Interactive Whiteboard) - [CVE-2018-16191](https://cve.now/CVE-2018-16191.md): Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3. (no CVSS, LOCKON CO. EC-CUBE · ec-cube/ec-cube) - [CVE-2018-16192](https://cve.now/CVE-2018-16192.md): Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an atta (no CVSS, NEC Aterm WF1200CR and Aterm WG1200CR) - [CVE-2018-16193](https://cve.now/CVE-2018-16193.md): Cross-site scripting vulnerability in Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmwa (no CVSS, NEC Aterm WF1200CR and Aterm WG1200CR) - [CVE-2018-16194](https://cve.now/CVE-2018-16194.md): Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authen (no CVSS, NEC Aterm WF1200CR and Aterm WG1200CR) - [CVE-2018-16195](https://cve.now/CVE-2018-16195.md): Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows an att (no CVSS, NEC Aterm WF1200CR and Aterm WG1200CR) - [CVE-2018-16196](https://cve.now/CVE-2018-16196.md): Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R (no CVSS, Yokogawa Electric Multiple Yokogawa products that contain V…) - [CVE-2018-16197](https://cve.now/CVE-2018-16197.md): Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network se (no CVSS, Toshiba Lighting & Technology Toshiba Home gateway HEM-GW16…) - [CVE-2018-16198](https://cve.now/CVE-2018-16198.md): Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier may allow an attacker on the same network (no CVSS, Toshiba Lighting & Technology Toshiba Home gateway HEM-GW16…) - [CVE-2018-16199](https://cve.now/CVE-2018-16199.md): Cross-site scripting vulnerability in Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier all (no CVSS, Toshiba Lighting & Technology Toshiba Home gateway HEM-GW16…) - [CVE-2018-16200](https://cve.now/CVE-2018-16200.md): Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network se (no CVSS, Toshiba Lighting & Technology Toshiba Home gateway HEM-GW16…) - [CVE-2018-16201](https://cve.now/CVE-2018-16201.md): Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may al (no CVSS, Toshiba Lighting & Technology Toshiba Home gateway HEM-GW16…) - [CVE-2018-16202](https://cve.now/CVE-2018-16202.md): Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-b (no CVSS, npm cordova-plugin-ionic-webview · cordova-plugin-ionic-web…) - [CVE-2018-16203](https://cve.now/CVE-2018-16203.md): PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the Postgr (no CVSS, PgPool Global Development Group PgpoolAdmin) - [CVE-2018-16204](https://cve.now/CVE-2018-16204.md): Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrar (no CVSS, Arne Brachhold Google XML Sitemaps) - [CVE-2018-16205](https://cve.now/CVE-2018-16205.md): Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page m (no CVSS, WESEEK GROWI) - [CVE-2019-3498](https://cve.now/CVE-2019-3498.md): In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used (no CVSS, django) - [CVE-2019-5882](https://cve.now/CVE-2019-5882.md): Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer. (no CVSS) - [CVE-2016-10403](https://cve.now/CVE-2016-10403.md): Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of b (no CVSS, Google Chrome) - [CVE-2016-9651](https://cve.now/CVE-2016-9651.md): A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to e (no CVSS, Google Chrome) - [CVE-2017-15401](https://cve.now/CVE-2017-15401.md): A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google Chrome prior to 62.0.3 (no CVSS, Google Chrome) - [CVE-2017-15402](https://cve.now/CVE-2017-15402.md): Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page\_state of any other frame in the sa (no CVSS, Google Chrome) - [CVE-2017-15403](https://cve.now/CVE-2017-15403.md): Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS (no CVSS, Google Chrome) - [CVE-2017-15404](https://cve.now/CVE-2017-15404.md): An ability to process crash dumps under root privileges and inappropriate symlinks handling could lead to a local privilege escalation in Cr (no CVSS, Google Chrome) - [CVE-2017-15405](https://cve.now/CVE-2017-15405.md): Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a persistance established (no CVSS, Google Chrome) - [CVE-2017-15428](https://cve.now/CVE-2017-15428.md): Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior (no CVSS, Google Chrome) - [CVE-2018-16065](https://cve.now/CVE-2018-16065.md): A Javascript reentrancy issues that caused a use-after-free in V8 in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execut (no CVSS, Google Chrome) - [CVE-2018-16066](https://cve.now/CVE-2018-16066.md): A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome) - [CVE-2018-16067](https://cve.now/CVE-2018-16067.md): A use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome) - [CVE-2018-16068](https://cve.now/CVE-2018-16068.md): Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a cr (no CVSS, Google Chrome) - [CVE-2018-16071](https://cve.now/CVE-2018-16071.md): A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome) - [CVE-2018-16072](https://cve.now/CVE-2018-16072.md): A missing origin check related to HLS manifests in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass same ori (no CVSS, Google Chrome) - [CVE-2018-16076](https://cve.now/CVE-2018-16076.md): Missing bounds check in PDFium in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via (no CVSS, Google Chrome) - [CVE-2018-16078](https://cve.now/CVE-2018-16078.md): Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially se (no CVSS, Google Chrome) - [CVE-2018-16079](https://cve.now/CVE-2018-16079.md): A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to s (no CVSS, Google Chrome) - [CVE-2018-16080](https://cve.now/CVE-2018-16080.md): A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remote attacker to spoof t (no CVSS, Google Chrome) - [CVE-2018-16081](https://cve.now/CVE-2018-16081.md): Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an attacker who convinced (no CVSS, Google Chrome) - [CVE-2018-16082](https://cve.now/CVE-2018-16082.md): An out of bounds read in Swiftshader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform out of bounds m (no CVSS, Google Chrome) - [CVE-2018-16083](https://cve.now/CVE-2018-16083.md): An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform (no CVSS, Google Chrome) - [CVE-2018-16084](https://cve.now/CVE-2018-16084.md): The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the user (no CVSS, Google Chrome) - [CVE-2018-16085](https://cve.now/CVE-2018-16085.md): A use after free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corrupt (no CVSS, Google Chrome) - [CVE-2018-16087](https://cve.now/CVE-2018-16087.md): Lack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass navigation restricti (no CVSS, Google Chrome) - [CVE-2018-16088](https://cve.now/CVE-2018-16088.md): A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrar (no CVSS, Google Chrome) - [CVE-2018-17457](https://cve.now/CVE-2018-17457.md): An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attack (no CVSS, Google Chrome) - [CVE-2018-17458](https://cve.now/CVE-2018-17458.md): An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to exec (no CVSS, Google Chrome) - [CVE-2018-17459](https://cve.now/CVE-2018-17459.md): Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to spoof the cont (no CVSS, Google Chrome) - [CVE-2018-17461](https://cve.now/CVE-2018-17461.md): An out of bounds read in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform an out of bounds memory read via (no CVSS, Google Chrome) - [CVE-2018-17470](https://cve.now/CVE-2018-17470.md): A heap buffer overflow in GPU in Google Chrome prior to 70.0.3538.67 allowed a remote attacker who had compromised the renderer process to p (no CVSS, Google Chrome) - [CVE-2018-20065](https://cve.now/CVE-2018-20065.md): Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigations (no CVSS, Google Chrome) - [CVE-2018-20066](https://cve.now/CVE-2018-20066.md): Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corrup (no CVSS, Google Chrome) - [CVE-2018-20067](https://cve.now/CVE-2018-20067.md): A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0. (no CVSS, Google Chrome) - [CVE-2018-20068](https://cve.now/CVE-2018-20068.md): Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user ab (no CVSS, Google Chrome) - [CVE-2018-20069](https://cve.now/CVE-2018-20069.md): Failure to prevent navigation to top frame to data URLs in Navigation in Google Chrome on iOS prior to 71.0.3578.80 allowed a remote attacke (no CVSS, Google Chrome) - [CVE-2018-20070](https://cve.now/CVE-2018-20070.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the c (no CVSS, Google Chrome) - [CVE-2018-20071](https://cve.now/CVE-2018-20071.md): Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote (no CVSS, Google Chrome) - [CVE-2018-6056](https://cve.now/CVE-2018-6056.md): Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.168 allowing a remote attacker to execute (no CVSS, Google Chrome) - [CVE-2018-6084](https://cve.now/CVE-2018-6084.md): Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute (no CVSS, Google Chrome) - [CVE-2018-6091](https://cve.now/CVE-2018-6091.md): Service Workers can intercept any request made by an \ or \ tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a (no CVSS, Google Chrome) - [CVE-2018-6093](https://cve.now/CVE-2018-6093.md): Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafte (no CVSS, Google Chrome) - [CVE-2018-6096](https://cve.now/CVE-2018-6096.md): A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote (no CVSS, Google Chrome) - [CVE-2018-6097](https://cve.now/CVE-2018-6097.md): Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enter (no CVSS, Google Chrome) - [CVE-2018-6100](https://cve.now/CVE-2018-6100.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to p (no CVSS, Google Chrome) - [CVE-2018-6106](https://cve.now/CVE-2018-6106.md): An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentia (no CVSS, Google Chrome) - [CVE-2018-6109](https://cve.now/CVE-2018-6109.md): readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google C (no CVSS, Google Chrome) - [CVE-2018-6110](https://cve.now/CVE-2018-6110.md): Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts (no CVSS, Google Chrome) - [CVE-2018-6111](https://cve.now/CVE-2018-6111.md): An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute (no CVSS, Google Chrome) - [CVE-2018-6112](https://cve.now/CVE-2018-6112.md): Making URLs clickable and allowing them to be styled in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass (no CVSS, Google Chrome) - [CVE-2018-6113](https://cve.now/CVE-2018-6113.md): Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to pe (no CVSS, Google Chrome) - [CVE-2018-6114](https://cve.now/CVE-2018-6114.md): Incorrect enforcement of CSP for \ tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content (no CVSS, Google Chrome) - [CVE-2018-6117](https://cve.now/CVE-2018-6117.md): Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information (no CVSS, Google Chrome) - [CVE-2018-6120](https://cve.now/CVE-2018-6120.md): An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 all (no CVSS, Google Chrome) - [CVE-2018-6123](https://cve.now/CVE-2018-6123.md): A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome) - [CVE-2018-6124](https://cve.now/CVE-2018-6124.md): Type confusion in ReadableStreams in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit object co (no CVSS, Google Chrome) - [CVE-2018-6126](https://cve.now/CVE-2018-6126.md): A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a cr (no CVSS, Google Chrome) - [CVE-2018-6127](https://cve.now/CVE-2018-6127.md): Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer pro (no CVSS, Google Chrome) - [CVE-2018-6133](https://cve.now/CVE-2018-6133.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform dom (no CVSS, Google Chrome) - [CVE-2018-6135](https://cve.now/CVE-2018-6135.md): Lack of clearing the previous site before loading alerts from a new one in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote att (no CVSS, Google Chrome) - [CVE-2018-6137](https://cve.now/CVE-2018-6137.md): CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (no CVSS, Google Chrome) - [CVE-2018-6139](https://cve.now/CVE-2018-6139.md): Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a (no CVSS, Google Chrome) - [CVE-2018-6140](https://cve.now/CVE-2018-6140.md): Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convin (no CVSS, Google Chrome) - [CVE-2018-6141](https://cve.now/CVE-2018-6141.md): Insufficient validation of an image filter in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the (no CVSS, Google Chrome) - [CVE-2018-6143](https://cve.now/CVE-2018-6143.md): Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a (no CVSS, Google Chrome) - [CVE-2018-6144](https://cve.now/CVE-2018-6144.md): Off-by-one error in PDFium in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a c (no CVSS, Google Chrome) - [CVE-2018-6147](https://cve.now/CVE-2018-6147.md): Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially se (no CVSS, Google Chrome) - [CVE-2018-6151](https://cve.now/CVE-2018-6151.md): Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to insta (no CVSS, Google Chrome) - [CVE-2018-6153](https://cve.now/CVE-2018-6153.md): A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perfo (no CVSS, Google Chrome) - [CVE-2018-6158](https://cve.now/CVE-2018-6158.md): A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome) - [CVE-2018-6160](https://cve.now/CVE-2018-6160.md): JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox ( (no CVSS, Google Chrome) - [CVE-2018-6162](https://cve.now/CVE-2018-6162.md): Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corrup (no CVSS, Google Chrome) - [CVE-2018-6163](https://cve.now/CVE-2018-6163.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform dom (no CVSS, Google Chrome) - [CVE-2018-6164](https://cve.now/CVE-2018-6164.md): Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin da (no CVSS, Google Chrome) - [CVE-2018-6165](https://cve.now/CVE-2018-6165.md): Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Om (no CVSS, Google Chrome) - [CVE-2018-6166](https://cve.now/CVE-2018-6166.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform dom (no CVSS, Google Chrome) - [CVE-2018-6167](https://cve.now/CVE-2018-6167.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform dom (no CVSS, Google Chrome) - [CVE-2018-6169](https://cve.now/CVE-2018-6169.md): Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger instal (no CVSS, Google Chrome) - [CVE-2018-6170](https://cve.now/CVE-2018-6170.md): A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted P (no CVSS, Google Chrome) - [CVE-2018-6172](https://cve.now/CVE-2018-6172.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform dom (no CVSS, Google Chrome) - [CVE-2018-6173](https://cve.now/CVE-2018-6173.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform dom (no CVSS, Google Chrome) - [CVE-2018-6174](https://cve.now/CVE-2018-6174.md): Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via (no CVSS, Google Chrome) - [CVE-2018-6175](https://cve.now/CVE-2018-6175.md): Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform dom (no CVSS, Google Chrome) - [CVE-2018-6178](https://cve.now/CVE-2018-6178.md): Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to ins (no CVSS, Google Chrome) - [CVE-2018-6179](https://cve.now/CVE-2018-6179.md): Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an att (no CVSS, Google Chrome) - [CVE-2018-20680](https://cve.now/CVE-2018-20680.md): Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field. (no CVSS) - [CVE-2019-5748](https://cve.now/CVE-2019-5748.md): In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks. (no CVSS) - [CVE-2018-20679](https://cve.now/CVE-2018-20679.md): An issue was discovered in BusyBox before 1.30.0. (CVSS 7.5) - [CVE-2019-5747](https://cve.now/CVE-2019-5747.md): An issue was discovered in BusyBox through 1.30.0. (CVSS 7.5) - [CVE-2019-0542](https://cve.now/CVE-2019-0542.md): A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution (no CVSS, https://xtermjs.org/ xterm.js · xterm) - [CVE-2019-3581](https://cve.now/CVE-2019-3581.md): McAfee Web Gateway denial of service attack due to Improper Input Validation (CVSS 7.5, McAfee Web Gateway) - [CVE-2016-10735](https://cve.now/CVE-2016-10735.md): In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than (no CVSS, bootstrap · org.webjars:bootstrap +3) - [CVE-2018-20676](https://cve.now/CVE-2018-20676.md): In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute. (no CVSS, bootstrap · bootstrap-sass +2) - [CVE-2018-20677](https://cve.now/CVE-2018-20677.md): In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. (no CVSS, bootstrap · bootstrap-sass +2) - [CVE-2018-20674](https://cve.now/CVE-2018-20674.md): D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A\* before v1.21B08Beta, DIR-850L B\* before v2.22B03Beta, (no CVSS) - [CVE-2018-20675](https://cve.now/CVE-2018-20675.md): D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A\* before v1.21B08Beta, DIR-850L B\* before v2.22B03Beta, (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2019-01-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.