Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,467 results · page 60 of 70
Mar 10, 2020SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages.CVE-2020-6206 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.3
SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross Site Request Forgery.
- Product
- SAP Cloud Platform Integration for Data Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Mar 9, 2020MISP 2.4.122 has reflected XSS via unsanitized URL parameters.CVE-2020-10246 · Other software · Misp-project · reported by MITREMedium 6.1
MISP 2.4.122 has reflected XSS via unsanitized URL parameters. This is related to app/View/Users/statistics_orgs.ctp.
- Product
- Misp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2020Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflectCVE-2020-2152 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation, resulting in a reflected cross-site scripting vulnerability.
- Product
- Jenkins Subversion Release Manager Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 9, 2020Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scrCVE-2020-2140 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
- Product
- Jenkins Audit Trail Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 6, 2020Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices.CVE-2019-19772 · Other software · Lexmark · reported by MITREMedium 5.4
Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US.
- Product
- Cs31x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lexmark.comsupport.lexmark.com
Mar 2, 2020InfluxDB 0.9.5 has Reflected XSS in the Write Data module.CVE-2018-17572 · Other software · Influxdata · reported by MITREMedium 4.8
InfluxDB 0.9.5 has Reflected XSS in the Write Data module.
- Product
- Influxdb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 28, 2020A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token.CVE-2020-6804 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system.
- Product
- WebThings Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2020IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.CVE-2020-9405 · Other software · Iblsoft · reported by MITREMedium 6.1
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
- Product
- Online Weather
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2020SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms.CVE-2019-19325 · Other software · Silverstripe · reported by MITREMedium 6.1
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input.
- Product
- Silverstripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsilverstripe.orgsilverstripe.org
Feb 14, 2020Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/CVE-2019-13965 · Other software · Combodo · reported by MITREMedium 6.1
Because of a lack of sanitization around error messages, multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php, webservices/cron.php, or env-production/itop-backup/backup.php. By default, any XSS sent to the administrator can be transformed to remote command execution because of CVE-2018-10642 (still working through 2.6.0) The Reflective XSS can also become a stored XSS within the same account because of another vulnerability.
- Product
- Itop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.CVE-2020-8840 · Other software · Fasterxml · reported by MITRECritical 9.8
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
- Product
- Jackson-databind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2020A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.CVE-2019-19661 · Other software · Maxum · reported by MITREMedium 6.1
A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName and snp.
- Product
- Rumpus FTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2020htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.CVE-2020-8823 · Other software · Sockjs Project · reported by MITREMedium 6.1
htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
- Product
- Sockjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2020A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.CVE-2020-8120 · Other software · Nextcloud · reported by support@hackerone.comMedium 6.1
A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.
- Product
- Nextcloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comnextcloud.com
Feb 4, 2020A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi.CVE-2020-8115 · Other software · Revive-adserver · reported by support@hackerone.comMedium 6.1
A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.
- Product
- Revive Adserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comrevive-adserver.com
Feb 4, 2020Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.CVE-2019-15618 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.8
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
- Product
- Nextcloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comnextcloud.com
Jan 29, 2020Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.CVE-2020-2100 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.8
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Jan 28, 2020The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page.CVE-2020-8426 · WordPress plugins & themes · reported by MITREMedium 5.4
The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.
- Product
- Elementor
- Fixed in
- 2.8.5
- What to do
- Update Elementor to 2.8.5 or newer.
Full record and what to do →NVD recordblog.impenetrable.techwordpress.org
Jan 17, 2020The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.CVE-2020-7104 · WordPress plugins & themes · reported by MITREMedium 6.1
The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.
- Affected
- 1.1.8.1 to 1.1.8.1
- What to do
- Affects 1.1.8.1 to 1.1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Jan 17, 2020A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms.CVE-2019-17125 · Other software · Solarwinds · reported by MITREMedium 6.1
A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS.
- Product
- Orion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.solarwinds.comsupport.solarwinds.com
Jan 15, 2020Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability.CVE-2019-16467 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jan 15, 2020Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability.CVE-2019-16466 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jan 15, 2020Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.CVE-2020-2096 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.
- Product
- Jenkins Gitlab Hook Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Jan 13, 2020Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTMCVE-2020-5195 · Other software · Cerberusftp · reported by MITREMedium 6.1
Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folder_up.png IMG element not properly sanitizing user-inserted directory paths. The path modification must be done on a publicly shared folder for a remote attacker to insert arbitrary JavaScript or HTML. The vulnerability impacts anyone who clicks the malicious link crafted by the attacker.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.cerberusftp.comcerberusftp.com
Jan 13, 2020The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.CVE-2019-20210 · WordPress plugins & themes · reported by MITREMedium 6.1
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.
- Fixed in
- 2.3.4
- What to do
- Update the plugin to 2.3.4 or newer.
Full record and what to do →NVD recordcxsecurity.comcxsecurity.com
Dec 31, 2019openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.CVE-2019-10227 · Other software · It-novum · reported by MITREMedium 6.1
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenitcockpit.ioopenitcockpit.io
Dec 26, 2019The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.CVE-2019-19540 · WordPress plugins & themes · reported by MITREMedium 6.1
The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.
- Product
- ListingPro
- Fixed in
- 2.0.14.2
- What to do
- Update ListingPro to 2.0.14.2 or newer.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Dec 20, 2019phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL.CVE-2019-19908 · Other software · Ciprianmp · reported by MITREMedium 6.1
phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmc_username parameter to pass_reset.php is vulnerable.
- Product
- Phpmychat-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordciprianmp.comcinzinga.github.io
Dec 18, 2019The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerabilitCVE-2019-18571 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerability in the My Access Live module [MAL]. An authenticated malicious local user could potentially exploit this vulnerability by sending crafted URL with scripts. When victim users access the module through their browsers, the malicious code gets injected and executed by the web browser in the context of the vulnerable web application.
- Product
- RSA Identity Governance & Lifecycle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.rsa.comcommunity.rsa.com
Dec 16, 2019A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1.CVE-2019-19368 · Other software · Maxum · reported by MITREMedium 6.1
A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a crafted link to end users and can execute arbitrary Javascripts
- Product
- Rumpus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 13, 2019TemaTres 3.0 has reflected XSS via the replace_string or search_string parameter to the vocab/admin.php?doAdmin=bulkReplace URI.CVE-2019-14344 · Other software · Vocabularyserver · reported by MITREMedium 6.1
TemaTres 3.0 has reflected XSS via the replace_string or search_string parameter to the vocab/admin.php?doAdmin=bulkReplace URI.
- Product
- Tematres
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2019A reflected XSS issue was discovered in DAViCal through 1.1.8.CVE-2019-18345 · Other software · Davical · reported by MITRECritical 9.3
A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an administrator, the attacker can for example add a new admin user to gain full access to the application.
- Product
- Davical
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgitlab.com
Dec 11, 2019JBossWeb Bayeux has reflected XSSCVE-2013-6495 · Other software · JBossWeb Bayeux · reported by Red HatMedium 6.1
JBossWeb Bayeux has reflected XSS
- Product
- JBossWeb Bayeux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 4, 2019In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console.CVE-2019-19587 · Other software · Wso2 · reported by MITREMedium 6.1
In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console.
- Product
- Enterprise Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wso2.comdocs.wso2.com
Dec 4, 2019The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanCVE-2019-19133 · WordPress plugins & themes · reported by MITREMedium 6.1
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.
- Product
- CSS Hero
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update CSS Hero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 25, 2019Characters in the GET url path are not properly escaped and can be reflected in the server response.CVE-2019-10771 · Other software · Iobroker · reported by report@snyk.ioMedium 6.1
Characters in the GET url path are not properly escaped and can be reflected in the server response.
- Product
- Iobroker.web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 25, 2019Nokia IMPACT < 18A: has Reflected self XSSCVE-2019-17405 · Other software · Nokia · reported by MITREMedium 6.1
Nokia IMPACT < 18A: has Reflected self XSS
- Product
- Impact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnokia.comtelecomitalia.com
Nov 25, 2019A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke privatCVE-2019-10174 · Other software · [UNKNOWN] · reported by Red HatHigh 8.8
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
- Product
- infinispan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Nov 14, 2019When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields.CVE-2019-18648 · Other software · Untangle · reported by MITREMedium 4.8
When logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields.
- Product
- NG Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 14, 2019Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS.CVE-2019-18957 · Other software · Microstrategy · reported by MITREMedium 6.1
Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS.
- Product
- Microstrategy Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 13, 2019letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in CalendarCVE-2012-4384 · Other software · letodms · reported by Red HatMedium 6.1
letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar
- Product
- letodms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurity-tracker.debian.org
Nov 12, 2019Use after free vulnerability exists in WebKit in Google Chrome before Blink M12 in RenderLayerwhen removing elements with reflections.CVE-2011-2334 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Use after free vulnerability exists in WebKit in Google Chrome before Blink M12 in RenderLayerwhen removing elements with reflections.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrac.webkit.orgbugs.chromium.org
Nov 12, 2019Systematic IRIS Standards Management (ISM) v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting (XSS).CVE-2019-18926 · Other software · Systematicinc · reported by MITREMedium 6.1
Systematic IRIS Standards Management (ISM) v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting (XSS). A user input (related to dialog information) is reflected directly in the web page, allowing a malicious user to conduct a Cross Site Scripting attack against users of the application.
- Product
- Iris Standards Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2019WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.CVE-2019-18881 · Other software · Wso2 · reported by MITREMedium 6.1
WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.
- Product
- Identity Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.wso2.comdocs.wso2.com
Nov 6, 2019A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.php component via thCVE-2019-12917 · Other software · Quest · reported by MITREMedium 6.1
A reflected XSS vulnerability exists in Quest KACE Systems Management Appliance Server Center 9.1.317 affecting the userui/software_library.php component via the PATH_INFO.
- Product
- Kace Systems Management Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.quest.comquest.com
Nov 5, 2019A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.CVE-2019-8115 · Websites & servers · Adobe Systems Incorporated · reported by AdobeMedium 4.8
A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when adding an image for during simple product creation.
- Product
- Magento 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagento.commagento.com
Nov 5, 2019A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.CVE-2019-8092 · Websites & servers · Adobe Systems Incorporated · reported by AdobeMedium 5.4
A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via email template preview.
- Product
- Magento 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagento.commagento.com
Nov 4, 2019JBoss AeroGear has reflected XSS via the password fieldCVE-2014-3649 · Other software · JBoss · reported by Red HatMedium 6.1
JBoss AeroGear has reflected XSS via the password field
- Product
- AeroGear
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 1, 2019On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP CVE-2019-6657 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.1
On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.
- Product
- BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Oct 30, 2019Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1.CVE-2019-18205 · Other software · Zucchetti · reported by MITREMedium 6.1
Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1. The browsing component did not properly sanitize user input (encoded in base64). This also applies to the search functionality for the searchKey parameter.
- Product
- Infobusiness
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hacktivesecurity.comblog.hacktivesecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.