Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,467 results · page 46 of 70
Aug 19, 2022Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at cliCVE-2022-35554 · Other software · Bpcbt · reported by MITREMedium 6.1
Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at client side.
- Product
- Smartvista
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtf1t.gitbook.iotf1t.gitbook.io
Aug 16, 2022In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.CVE-2020-14320 · Other software · Moodle · reported by Red HatMedium 6.1
In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2022There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a craftedCVE-2022-38188 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2022There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click onCVE-2022-38186 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victim’s browser.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2022JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attackCVE-2022-38179 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.7
JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack
- Product
- Ktor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjetbrains.com
Aug 10, 2022Adobe Experience Manager Core Components version 2.20.6 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2022-35697 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager Core Components version 2.20.6 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires a low author privilege access.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in EndUserSummary page.CVE-2022-33929 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in EndUserSummary page. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service VulnerabilityCVE-2022-0028 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedHigh 8.6
A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.
- Product
- PAN-OS
- On CISA’s list since
- Aug 22, 2022 (federal fix deadline Sep 12, 2022)
- What to do
- Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Aug 9, 2022Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site ScCVE-2022-36801 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.1
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint. The affected versions are before version 8.20.8.
- Product
- Jira Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.atlassian.comjira.atlassian.com
Aug 9, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.CVE-2022-2733 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.CVE-2022-2731 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability.CVE-2022-31663 · Other software · VMware · reported by security@vmware.comMedium 6.1
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
- Product
- Identity Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2022A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06.CVE-2022-37431 · Other software · Dotcms · reported by MITREMedium 6.1
A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTECTION_ENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSS_PROTECTION_ENABLED=true in all configurations
- Product
- Dotcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.comfortiguard.fortinet.com
Aug 2, 2022In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface.CVE-2022-36967 · Other software · Progress · reported by MITREMedium 6.1
In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface. It is possible for a remote attacker to inject arbitrary JavaScript into a WS_FTP administrator's web session. This would allow the attacker to execute code within the context of the victim's browser.
- Product
- Ipswitch WS FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comprogress.com
Aug 2, 2022The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains easily exploitable Reflected Cross Site Scripting (XSS) CVE-2022-30571 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 8.1
The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO iWay Service Manager: versions 8.0.6 and below.
- Product
- TIBCO iWay Service Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.CVE-2022-2589 · Other software · beancount · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3.
- Product
- beancount/fava
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2022Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class.CVE-2022-30287 · Other software · Horde · reported by MITREHigh 8
Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects.
- Product
- Groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comlists.debian.org
Jul 26, 2022Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first_name and last_name parameters.CVE-2022-34991 · Other software · Techvill · reported by MITREMedium 5.4
Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first_name and last_name parameters.
- Product
- Paymoney
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022A reflected XSS issue was identified in the LTI module of Moodle.CVE-2022-35653 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.1
A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website to steal potentially sensitive information, change appearance of the web page, can perform phishing and drive-by-download attacks. This vulnerability does not impact authenticated users.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Jul 25, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.CVE-2022-2523 · Other software · beancount · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
- Product
- beancount/fava
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2022The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameteCVE-2022-2514 · Other software · beancount · reported by security@huntr.devMedium 6.1
The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the parameters in verbatim.
- Product
- beancount/fava
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.CVE-2022-2470 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2022Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter.CVE-2022-34048 · Other software · Wavlink · reported by MITREMedium 6.1
Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter.
- Product
- Wn533a8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comdrive.google.com
Jul 20, 2022The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a userCVE-2022-2199 · Other software · MiCODUS · reported by ics-cert@hq.dhs.govHigh 7.5
The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.
- Product
- MV720
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2022Adobe RoboHelp versions 2020.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2022-23201 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe RoboHelp versions 2020.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- RoboHelp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jul 14, 2022A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0.CVE-2022-32225 · Other software · Veeam · reported by support@hackerone.comMedium 6.1
A reflected DOM-Based XSS vulnerability has been discovered in the Help directory of Veeam Management Pack for Microsoft System Center 8.0. This vulnerability could be exploited by an attacker by convincing a legitimate user to visit a crafted URL on a Veeam Management Pack for Microsoft System Center server, allowing for the execution of arbitrary scripts.
- Product
- Management Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflectedCVE-2022-35172 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
- Product
- SAP NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jul 10, 2022In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload fuCVE-2022-27910 · Websites & servers · Joomlatools · reported by security@joomla.orgMedium 6.1
In Joomla component 'Joomlatools - DOCman 3.5.13 (and likely most versions below)' are affected to an reflected Cross-Site Scripting (XSS) in an image upload function
- Product
- DOCman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjoomlatools.comjoomlatools.com
Jul 6, 2022A reflected XSS was discovered in PESCMS-V2.3.3.CVE-2021-31676 · Other software · Pescms · reported by MITREMedium 6.1
A reflected XSS was discovered in PESCMS-V2.3.3. When combined with CSRF in the same file, they can cause bigger destruction.
- Product
- Pescms Team
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users.CVE-2022-35230 · Other software · Zabbix · reported by security@zabbix.comLow 3.7
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsupport.zabbix.com
Jul 6, 2022An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users.CVE-2022-35229 · Other software · Zabbix · reported by security@zabbix.comLow 3.7
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
- Product
- Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Jul 6, 2022JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API CVE-2021-45721 · Other software · JFrog · reported by reefs@jfrog.comMedium 6.1
JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to 7.29.8; JFrog Artifactory versions before 6.23.41 versions prior to 6.23.38.
- Product
- JFrog Artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2022Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via agent, and search_arCVE-2022-34879 · Other software · VICIdial · reported by cve@rapid7.comMedium 6.5
Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.php) of VICIdial via agent, and search_archived_data parameters. This issue affects: VICIdial 2.14b0.5 versions prior to 3555.
- Product
- VICIdial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvicidial.orgvicidial.org
Jul 3, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.CVE-2022-2290 · Other software · zadam · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta.
- Product
- zadam/trilium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter.CVE-2020-19897 · Other software · Wuzhicms · reported by MITREMedium 6.1
A reflected Cross Site Scripting (XSS) in wuzhicms v4.1.0 allows remote attackers to execute arbitrary web script or HTML via the imgurl parameter.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2022The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS).CVE-2022-29931 · Other software · Raytion · reported by MITREMedium 6.1
The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS).
- Product
- Custom Security Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Jun 24, 2022Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in saveGroupConfigurations page.CVE-2022-29096 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in saveGroupConfigurations page. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Wyse Management Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php.CVE-2022-34328 · Other software · Sigb · reported by MITREMedium 6.1
PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=author_see request to index.php.
- Product
- PMB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerabiliCVE-2022-34182 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Nested View Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /index/notice/show.CVE-2022-32131 · Other software · 74cms · reported by MITREMedium 6.1
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /index/notice/show.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/down_resume/total/nature.CVE-2022-32130 · Other software · 74cms · reported by MITREMedium 6.1
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/down_resume/total/nature.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/account/safety/trade.CVE-2022-32129 · Other software · 74cms · reported by MITREMedium 6.1
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/account/safety/trade.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/im.CVE-2022-32128 · Other software · 74cms · reported by MITREMedium 6.1
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/service/increment/add/im.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/view_be_browsed/total.CVE-2022-32127 · Other software · 74cms · reported by MITREMedium 6.1
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company/view_be_browsed/total.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company.CVE-2022-32126 · Other software · 74cms · reported by MITREMedium 6.1
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /company.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /job.CVE-2022-32125 · Other software · 74cms · reported by MITREMedium 6.1
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the path /job.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /index/jobfairol/show/.CVE-2022-32124 · Other software · 74cms · reported by MITREMedium 6.1
74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /index/jobfairol/show/.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Reflected XSS.CVE-2022-23081 · Other software · openlibrary · reported by vulnerabilitylab@mend.ioMedium 4.3
In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Reflected XSS.
- Product
- openlibrary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.CVE-2022-2174 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.CVE-2022-31786 · Other software · Ideaco · reported by MITREMedium 6.1
IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.
- Product
- Idealms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.