Latest Newest CVEs from every source Trending Rising exploit risk, new exploits Exploited in the wild CISA KEV + ENISA exploited Public exploit Exploit code on GitHub, Metasploit, Exploit-DB Critical CVSS 9.0 and above Vendors & products Browse by vendor

Browse

Weekly digest The week in one page Patch days Patch Tuesday, Oracle CPU, Android … Weaknesses (CWE) XSS, SQL injection, path traversal… Archive By year, month and day

Catalogues

CISA KEV Known Exploited Vulnerabilities ENISA EUVD EU Vulnerability Database

National CERTs & open source

BSI CERT-Bund German federal CERT (WID) CISA ICS & IT US advisories, industrial control systems NCSC-NL Dutch national CERT Open source (OSV) GitHub, PyPA, Go, RustSec…

Vendor & industrial PSIRTs

Microsoft MSRC Security Update Guide, exploitability Siemens ProductCERT SSA advisories Schneider Electric SEVD security notifications ABB PSIRT ABB cyber security advisories SICK PSIRT SICK security advisories CERT@VDE Phoenix Contact, WAGO, CODESYS, Pilz, Festo …

Linux distributions

Debian DSA / DLA Ubuntu USN Red Hat RHSA SUSE / openSUSE SUSE-SU Rocky Linux RLSA AlmaLinux ALSA Amazon Linux ALAS Oracle Linux ELSA

Check a version Is my package version vulnerable? Scan a lockfile or SBOM package-lock, composer.lock, CycloneDX, SPDX… Scan a server Installed packages on Linux and containers Daily notifications One push a day — no e-mail, no account

Malware

About What this is and who runs it Data sources Licenses and live update status Methodology Scoring, merging, version matching Contact Corrections and feedback

For developers

Guide Servers, lockfiles, CI, feeds API & feeds JSON endpoints, Atom feeds

Search vulnerabilities

Vulnerabilities

Latest
Trending
Exploited in the wild
Public exploit
Critical
Vendors & products

Browse

Weekly digest
Patch days
Weaknesses (CWE)
Archive

Catalogues

CISA KEV
ENISA EUVD

Advisories

National CERTs & open source

BSI CERT-Bund
CISA ICS & IT
NCSC-NL
Open source (OSV)

Vendor & industrial PSIRTs

Microsoft MSRC
Siemens ProductCERT
Schneider Electric
ABB PSIRT
SICK PSIRT
CERT@VDE

Linux distributions

Debian
Ubuntu
Red Hat
SUSE / openSUSE
Rocky Linux
AlmaLinux
Amazon Linux
Oracle Linux

Tools

Check a version
Scan a lockfile or SBOM
Scan a server
Daily notifications

Malware

Malicious packages

Resources

About
Data sources
Methodology
Contact

For developers

Guide
API & feeds

Vulnerabilities / CVE-2018-19048

Medium · 6.1 CVE-2018-19048 EUVD-2019-0460GHSA-8v67-x8q5-3x3g

Cross-Site Scripting in simditor

Published May 13, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Package: simditor Ecosystem: npm

Description

Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	simditor	< 2.3.22	2.3.22	GHSA-8v67-x8q5-3x3g

References

https://github.com/hkglue/simditor_demo.git
https://github.com/mycolorway/simditor/commit/ef01a643cbb7f8163535d6bfb71135f80ec6a6fd
https://github.com/hkglue/simditor_dom_xss/blob/master/README.md
https://github.com/mycolorway/simditor/releases/tag/v2.3.22

CVSS v3.0

6.1

EPSS exploit probability (30d)

1.5%

Higher than 75.2% of all scored CVEs

Weakness: CWE-79
Sources: CVE List (cvelistV5); ENISA EU Vulnerability Database section →; OSV.dev (GitHub Advisories, PyPA, Go, RustSec…) section →

Free vulnerability intelligence: what is new, exploited or exploitable, what affects the software you run and which version fixes it — from nearly 30 public sources, updated hourly. No account, no tracking.

A service by Aurelius Julian Ballweber — ballweber.org

Vulnerabilities

Latest
Trending
Exploited in the wild
Public exploit
Critical
Vendors & products

Browse

Weekly digest
Patch days
Weaknesses (CWE)
Archive
CISA KEV
ENISA EUVD

Advisories

BSI CERT-Bund
CISA ICS & IT
NCSC-NL
Open source (OSV)
Microsoft MSRC
Siemens ProductCERT
Schneider Electric
ABB PSIRT
SICK PSIRT
CERT@VDE
Debian
Ubuntu
Red Hat
SUSE / openSUSE
Rocky Linux
AlmaLinux
Amazon Linux
Oracle Linux

Tools

Check a version
Scan a lockfile or SBOM
Scan a server
Daily notifications
Malicious packages

Resources

About
Data sources
Methodology
Guide
API & feeds

Hosting & Security by Mediasecure We use Debian for our infrastructure

Security tooling & research in collaboration with Marian Amza

Legal notice
Privacy
Terms of use
Contact
Site map

CVE® is a registered trademark of The MITRE Corporation. Data: CVE Program, CISA, FIRST EPSS, ENISA EUVD, BSI CERT-Bund, NCSC-NL, CERT@VDE, OSV.dev, Linux distributions, vendor PSIRTs, MITRE CWE and public exploit databases — all sources.