Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,467 results · page 56 of 70
Nov 12, 2020Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2020-24442 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Connect version 11.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Nov 8, 2020The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attaCVE-2020-28351 · Email & office · Mitel · reported by MITREMedium 6.1
The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page.
- Product
- Shoretel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 5, 2020AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting).CVE-2020-28047 · Other software · Web-audimex · reported by MITREMedium 5.4
AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting). If the recommended security configuration parameter "unique_error_numbers" is not set, remote attackers can inject arbitrary web script or HTML via 'action, cargo, panel' parameters that can lead to data leakage.
- Product
- Audimexee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface.CVE-2020-17454 · Other software · Wso2 · reported by MITREMedium 6.1
WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS payload into the owner POST parameter, which does not filter user inputs. By putting an XSS payload in place of a valid Owner Name, a modal box appears that writes an error message concatenated to the injected payload (without any form of data encoding). This can also be exploited via CSRF.
- Product
- API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wso2.comdocs.wso2.com
Oct 20, 2020There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50.CVE-2020-6367 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that the script should not be trusted, and will execute the script, resulting in sensitive information being disclosed or modified.
- Product
- SAP NetWeaver Composite Application Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Oct 7, 2020Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential iCVE-2020-13346 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.CVE-2020-26135 · Other software · Livehelperchat · reported by MITREMedium 6.1
Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.
- Product
- Live Helper Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2020SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.CVE-2020-13168 · Other software · Sysaid · reported by MITREMedium 6.1
SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.
- Product
- Sysaid On-premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2020Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct reflected cross-site scripting via a crafCVE-2020-5785 · Other software · Teltonika-networks · reported by vulnreport@tenable.comMedium 6.1
Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct reflected cross-site scripting via a crafted ‘action’ or ‘pkg_name’ parameter.
- Product
- Trb245 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Sep 25, 2020Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected input.CVE-2020-15374 · Other software · Broadcom · reported by sirt@brocade.comCritical 9.8
Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected input.
- Product
- Fabric Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Sep 25, 2020A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBNCVE-2018-6447 · Other software · Broadcom · reported by sirt@brocade.comMedium 5.4
A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, v7.4.2g could allow authenticated attackers with access to the web interface to hijack a user’s session and take over the account.
- Product
- Fabric Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Sep 24, 2020A reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execCVE-2020-8347 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.1
A reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's browser if a crafted url is visited, possibly through phishing.
- Product
- Enterprise Network Disk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cniknow.lenovo.com.cn
Sep 22, 2020Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the MailboCVE-2020-14024 · Other software · Ozeki · reported by MITREMedium 6.1
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature, (2) OZFORM_GROUPNAME field in the Group configuration of addresses, (3) listname field in the Defining address lists configuration, or (4) any GET Parameter in the /default URL of the application.
- Product
- Ozeki NG SMS Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2020SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability.CVE-2020-15183 · Other software · inunosinsi · reported by GitHubHigh 8.4
SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.
- Product
- soycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2020MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS.CVE-2020-22158 · Other software · Mediakind · reported by MITREMedium 6.1
MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker has to inject JavaScript code directly in the "path" or "Services+ID" parameters and send the URL to a user in order to exploit reflected XSS. In the case of stored XSS, an attacker must modify the "name" parameter with the malicious code.
- Product
- Rx8200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsku11army.blogspot.comsku11army.blogspot.com
Sep 9, 2020A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface.CVE-2020-2036 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 8.8
A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9.
- Product
- PAN-OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Sep 2, 2020A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1.CVE-2020-24604 · Other software · Igniterealtime · reported by MITREMedium 6.1
A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in server-properties.jsp and security-audit-viewer.jsp
- Product
- Openfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comissues.igniterealtime.org
Sep 2, 2020Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerableCVE-2020-24602 · Other software · Igniterealtime · reported by MITREMedium 6.1
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and "searchDynamic" in the Server Properties and Security Audit Viewer JSP page
- Product
- Openfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comissues.igniterealtime.org
Sep 1, 2020The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perform actions in the CVE-2020-16210 · Other software · Redlion · reported by ics-cert@hq.dhs.govCritical 9
The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute arbitrary code and perform actions in the context of an attacked user on the N-Tron 702-W / 702M12-W (all versions).
- Product
- N-tron 702-w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 1, 2020A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JCVE-2020-23839 · Other software · Get-simple · reported by MITREMedium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the login form.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 1, 2020Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.CVE-2020-2248 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins JSGames Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Aug 31, 2020The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.CVE-2020-25033 · WordPress plugins & themes · reported by MITREMedium 6.1
The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.
- Affected
- 1.3.1 to 1.3.1
- What to do
- Affects 1.3.1 to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgzeroaptitude.com
Aug 24, 2020DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php line 108 for $_GET['return_name'] parameter, A remCVE-2020-19881 · Other software · Dbhcms Project · reported by MITREMedium 4.8
DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php line 108 for $_GET['return_name'] parameter, A remote authenticated with admin user can exploit this vulnerability to hijack other users.
- Product
- Dbhcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2020Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.CVE-2020-12759 · Other software · Zulip · reported by MITREMedium 6.1
Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.
- Product
- Zulip Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.zulip.comblog.zulip.com
Aug 17, 2020Reflected Cross Site Scripting in Teradici PCoIP Management Console prior to 20.07 could allow an attacker to take over the user's active session if the user isCVE-2020-13183 · Other software · Teradici · reported by security@teradici.comMedium 6.1
Reflected Cross Site Scripting in Teradici PCoIP Management Console prior to 20.07 could allow an attacker to take over the user's active session if the user is exposed to a malicious payload.
- Product
- Pcoip Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.teradici.comadvisory.teradici.com
Aug 12, 2020search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.CVE-2020-17362 · WordPress plugins & themes · reported by MITREMedium 6.1
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.
- Product
- search.php in the Nova Lite
- Fixed in
- 1.3.9
- What to do
- Update search.php in the Nova Lite to 1.3.9 or newer.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Aug 12, 2020Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web scCVE-2020-13278 · Other software · RosarioSIS · reported by cve@gitlab.comMedium 6.1
Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request.
- Product
- RosarioSIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2020JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.CVE-2020-15831 · Other software · Jetbrains · reported by MITREMedium 6.1
JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 5, 2020LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters.CVE-2020-16192 · Other software · Limesurvey · reported by MITREMedium 6.1
LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters.
- Product
- Limesurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2020Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.CVE-2020-13819 · Other software · Extremenetworks · reported by MITREMedium 6.1
Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
- Product
- Extreme Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.extremenetworks.comgtacknowledge.extremenetworks.com
Aug 4, 2020Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.CVE-2020-16847 · Other software · Extremenetworks · reported by MITREMedium 6.1
Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.
- Product
- Extreme Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.extremenetworks.comgtacknowledge.extremenetworks.com
Aug 3, 2020A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parametCVE-2020-11584 · Websites & servers · Plesk · reported by MITREMedium 6.1
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
- Product
- Onyx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2020A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parCVE-2020-11583 · Websites & servers · Plesk · reported by MITREMedium 6.1
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
- Product
- Obsidian
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2020Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.CVE-2020-13820 · Other software · Extremenetworks · reported by MITREMedium 6.1
Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.
- Product
- Extreme Management Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.extremenetworks.comgtacknowledge.extremenetworks.com
Aug 3, 2020A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF_EMOTICON_CELL.tpl FIELD_NAME field to data/emoticons.php.CVE-2015-9549 · Other software · Ocportal · reported by MITREMedium 6.1
A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF_EMOTICON_CELL.tpl FIELD_NAME field to data/emoticons.php.
- Product
- Ocportal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comgithub.com
Jul 23, 2020A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0.CVE-2020-15919 · Other software · Midasolutions · reported by MITREMedium 6.1
A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0.
- Product
- Eframework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelbae.github.ioelbae.github.io
Jul 14, 2020SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in CroCVE-2020-6281 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting reflected in Cross-Site Scripting.
- Product
- SAP Business Objects Business Intelligence Platform (BI Launchpad)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jul 10, 2020Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP CVE-2020-8194 · Network & remote access · Citrix · reported by support@hackerone.comMedium 6.5
Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download.
- Product
- Application Delivery Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Jul 9, 2020A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submiCVE-2020-15299 · WordPress plugins & themes · reported by MITREMedium 6.1
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is executed in the victim's browser.
- Product
- A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jul 2, 2020In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS.CVE-2020-15083 · Websites & servers · PrestaShop · reported by GitHubMedium 4.7
In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem is fixed in 1.7.6.6
- Product
- PrestaShop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2020Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scrCVE-2020-2207 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins VncViewer Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 2, 2020Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site CVE-2020-2206 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins VncRecorder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 1, 2020In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack.CVE-2020-5901 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.6
In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.
- Product
- Nginx Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.CVE-2020-15364 · WordPress plugins & themes · reported by MITREMedium 6.1
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
- Product
- Nexos
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 26, 2020NeDi 1.9C is vulnerable to reflected cross-site scripting.CVE-2020-15017 · Other software · Nedi · reported by MITREMedium 6.1
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter.
- Product
- Nedi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 26, 2020NeDi 1.9C is vulnerable to reflected cross-site scripting.CVE-2020-15016 · Other software · Nedi · reported by MITREMedium 6.1
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter.
- Product
- Nedi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 22, 2020The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.CVE-2020-14973 · Other software · Webtareas Project · reported by MITREMedium 6.1
The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.
- Product
- Webtareas
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsourceforge.net
Jun 19, 2020A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (rCVE-2020-14475 · Other software · Dolibarr · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2020Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL information.CVE-2020-14210 · Other software · Monitorapp · reported by MITREMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL information. It provides a function to response to Request URL information when blocking.
- Product
- Application Insight Web Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2020Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected) vulnerability.CVE-2020-9651 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.