Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 52 of 73
Mar 21, 2019JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi)CVE-2019-7440 · Other software · JIO · reported by MITREMedium 6.5
JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi).
- Product
- Jiofi 4g M2s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgkaim.com
Mar 21, 2019PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting (XSS) via the Search field.CVE-2019-7437 · Other software · Opensource Classified ADS Script Project · reported by MITREMedium 6.1
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting (XSS) via the Search field.
- Product
- Opensource Classified ADS Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section.CVE-2019-7432 · Other software · Rental Bike Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Rental Bike Script 2.0.3 has HTML injection via the STREET field in the Profile Edit section.
- Product
- Rental Bike Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option.CVE-2019-7223 · Other software · Invoiceplane · reported by MITREMedium 5.4
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/## URI. NOTE: this is different from CVE-2018-12255.
- Product
- Invoiceplane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comcxsecurity.com
Mar 21, 2019PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field.CVE-2018-20645 · Other software · Basic B2b Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field.
- Product
- Basic B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has stored Cross-Site Scripting (XSS) via the Full Name field.CVE-2018-20640 · Other software · Entrepreneur JOB Portal Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has stored Cross-Site Scripting (XSS) via the Full Name field.
- Product
- Entrepreneur JOB Portal Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has HTML injection via the First Name field.CVE-2018-20636 · Other software · Chartered Accountant \ · reported by MITREMedium 5.4
PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has HTML injection via the First Name field.
- Product
- Auditor Website Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting (XSS) via the FIRST NAME or LAST NAME field.CVE-2018-20632 · Other software · Advance B2b Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting (XSS) via the FIRST NAME or LAST NAME field.
- Product
- Advance B2b Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Machine Host Name" or "Server Serial Number" field in theCVE-2018-17167 · Other software · Printeron · reported by MITREMedium 5.4
PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Machine Host Name" or "Server Serial Number" field in the clustering configuration, (2) "name" field in the Edit Group configuration, (3) "Rule Name" field in the Access Control configuration, (4) "Service Name" in the Service Configuration, or (5) First Name or Last Name field in the Edit Account configuration.
- Product
- Printeron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2019The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting.CVE-2019-9725 · Other software · Korenix · reported by MITREMedium 6.1
The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting.
- Product
- Jetport Web Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI.CVE-2018-17426 · Other software · Wuzhicms · reported by MITREMedium 5.4
WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2019WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.CVE-2018-17425 · Other software · Wuzhicms · reported by MITREMedium 5.4
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2019phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, becaCVE-2019-9581 · Other software · Twinkletoessoftware · reported by MITREHigh 8.8
phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension.
- Product
- Booked
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compentest.com.tr
Mar 4, 2019The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.CVE-2019-9567 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.
- Product
- Forminator Contact Form, Poll & Quiz Builder
- Fixed in
- 1.6
- What to do
- Update Forminator Contact Form, Poll & Quiz Builder to 1.6 or newer.
Full record and what to do →NVD recordlists.openwall.netsecurity-consulting.icu
Feb 28, 2019Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to CVE-2018-18497 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to open privileged about: or file: locations. This vulnerability affects Firefox < 64.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugzilla.mozilla.org
Feb 21, 2019A vulnerability in field-programmable gate array (FPGA) ingress buffer management for the Cisco Firepower 9000 Series with the Cisco Firepower 2-port 100G doublCVE-2019-1700 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in field-programmable gate array (FPGA) ingress buffer management for the Cisco Firepower 9000 Series with the Cisco Firepower 2-port 100G double-width network module (PID: FPR9K-DNM-2X100G) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. Manual intervention may be required before a device will resume normal operations. The vulnerability is due to a logic error in the FPGA related to the processing of different types of input packets. An attacker could exploit this vulnerability by being on the adjacent subnet and sending a crafted sequence of input packets to a specific interface on an affected device. A successful exploit could allow the attacker to cause a queue wedge condition on the interface. When a wedge occurs, the affected device will stop processing any additional packets that are received on the wedged interface. Version 2.2 is affected.
- Product
- Cisco Firepower Extensible Operating System (FXOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Feb 21, 2019A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacCVE-2019-1698 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.9
A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by importing a crafted XML file with malicious entries, which could allow the attacker to read files within the affected application. Versions prior to 4.4(0.26) are affected.
- Product
- Cisco IoT Field Network Director (IoT-FND)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Feb 11, 2019In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uriCVE-2019-7732 · Other software · Live555 · reported by MITREHigh 7.5
In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uri, or response), only the last instance can ever be freed.
- Product
- Streaming Media
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.CVE-2018-20777 · Other software · Frog CMS Project · reported by MITREMedium 5.4
Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.CVE-2018-20774 · Other software · Frog CMS Project · reported by MITREMedium 5.4
Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2019In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name field.CVE-2019-7545 · Other software · Dbninja · reported by MITREMedium 5.4
In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name field.
- Product
- Dbninja
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2019MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.CVE-2018-20757 · Other software · Modx · reported by MITREMedium 6.1
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2019MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.CVE-2018-20755 · Other software · Modx · reported by MITREMedium 6.1
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.
- Product
- Modx Revolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2019In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format.CVE-2018-20251 · Network & remote access · Check Point Software Technologies Ltd. · reported by cve@checkpoint.comMedium 5.5
In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system.
- Product
- WinRAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comresearch.checkpoint.com
Feb 4, 2019Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check color" (monitor.php).CVE-2019-7331 · Other software · Zoneminder · reported by MITREMedium 6.1
Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named "signal check color" (monitor.php). There exists no input validation or output filtration, leaving it vulnerable to HTML Injection and an XSS attack.
- Product
- Zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2019Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and ldap_password fieldCVE-2019-7300 · Other software · Articatech · reported by MITREHigh 7.2
Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and ldap_password fields, using these credentials at logon.php, and then entering the commands in the admin.index.php command-line field.
- Product
- Artica Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comgithub.com
Jan 29, 2019A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/atCVE-2019-7173 · Other software · Croogo · reported by MITREMedium 4.8
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4.
- Product
- Croogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2019A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/_core/users/CVE-2019-7172 · Other software · Atutor · reported by MITREMedium 6.1
A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/_core/users/admins/my_edit.php.
- Product
- Atutor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2019A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/eCVE-2019-7171 · Other software · Croogo · reported by MITREMedium 4.8
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8.
- Product
- Croogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2019A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabuCVE-2019-7170 · Other software · Croogo · reported by MITREMedium 4.8
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies.
- Product
- Croogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2019A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/ediCVE-2019-7169 · Other software · Croogo · reported by MITREMedium 4.8
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/edit/3.
- Product
- Croogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2019A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/CVE-2019-7168 · Other software · Croogo · reported by MITREMedium 4.8
A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog.
- Product
- Croogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2019Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, poteCVE-2019-3462 · Other software · Debian GNU/Linux · reported by security@debian.orgHigh 8.1
Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.
- Product
- apt as used in Debian Stretch and Ubuntu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comlists.apache.org
Jan 23, 2019A vulnerability in the UDP protocol implementation for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to exhaust sysCVE-2019-1644 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the UDP protocol implementation for Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to exhaust system resources, resulting in a denial of service (DoS) condition. The vulnerability is due to improper resource management for UDP ingress packets. An attacker could exploit this vulnerability by sending a high rate of UDP packets to an affected system within a short period of time. A successful exploit could allow the attacker to exhaust available system resources, resulting in a DoS condition.
- Product
- Cisco IoT Field Network Director (IoT-FND)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Jan 23, 2019A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the CoCVE-2018-15614 · Other software · Avaya · reported by securityalerts@avaya.comMedium 6.8
A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Office include 10.0 through 10.1 SP3 and 11.0 versions prior to 11.0 SP1.
- Product
- IP Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownloads.avaya.comdownloads.avaya.com
Jan 16, 2019Vulnerability in the Oracle Mobile Field Service component of Oracle E-Business Suite (subcomponent: Administration).CVE-2019-2485 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Oracle Mobile Field Service component of Oracle E-Business Suite (subcomponent: Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Mobile Field Service, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Mobile Field Service accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
- Product
- Mobile Field Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Jan 15, 2019In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files.CVE-2017-6921 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.9
In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.
- Product
- Drupal Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 9, 2019Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.CVE-2018-20680 · Other software · Frog CMS Project · reported by MITREMedium 4.8
Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2019includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab theCVE-2019-5720 · Other software · Frontaccounting · reported by MITRECritical 9.8
includes/db/class.reflines_db.inc in FrontAccounting 2.4.6 contains a SQL Injection vulnerability in the reference field that can allow the attacker to grab the entire database of the application via the void_transaction.php filterType parameter.
- Product
- Frontaccounting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2019Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size CVE-2019-5009 · Other software · Vtiger · reported by MITREHigh 7.2
Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "<? ?>" tags, as demonstrated by a CompanyDetailsSave action. This bypasses the bad-file-extensions protection mechanism. It is related to actions/CompanyDetailsSave.php, actions/UpdateCompanyLogo.php, and models/CompanyDetails.php.
- Product
- Vtiger CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.vtiger.comlists.vtigercrm.com
Jan 3, 2019The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field.CVE-2018-20663 · Other software · Haulmont · reported by MITREMedium 5.4
The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field.
- Product
- Cuba Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.CVE-2018-19904 · Other software · Xsltcms.org Project · reported by MITREMedium 6.1
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.
- Product
- Xsltcms.org
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.CVE-2018-19903 · Other software · Xsltcms.org Project · reported by MITREMedium 6.1
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.
- Product
- Xsltcms.org
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2018Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.CVE-2018-16632 · Other software · Jupo · reported by MITREMedium 4.8
Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.
- Product
- Mezzanine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2018PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.CVE-2018-20530 · Other software · Website Seller Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896.
- Product
- Website Seller Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuku90.wordpress.comsuku90.wordpress.com
Dec 25, 2018Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.CVE-2018-20448 · Other software · Frog CMS Project · reported by MITREMedium 5.4
Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 22, 2018SZ NetChat before 7.9 has XSS in the MyName input field of the Options module.CVE-2018-20370 · Other software · The-sz · reported by MITREMedium 5.4
SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend.
- Product
- Netchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Dec 22, 2018The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.CVE-2018-20368 · WordPress plugins & themes · reported by MITREMedium 5.4
The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Dec 17, 2018Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.CVE-2018-19933 · Other software · Bolt · reported by MITREMedium 6.1
Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.
- Product
- Bolt CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 13, 2018Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an exisCVE-2018-5411 · Other software · Pixar · reported by cret@cert.orgMedium 5.4
Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into this note field that is then saved and displayed to the end user. An attacker might include Javascript that could execute on an authenticated user's system that could lead to website redirects, session cookie hijacking, social engineering, etc. As this is stored with the information about the node, all other authenticated users with access to this data are also vulnerable.
- Product
- Tractor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.