Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,467 results · page 62 of 70
Aug 27, 2019The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.CVE-2015-9349 · WordPress plugins & themes · reported by MITREMedium 6.1
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
- Product
- ckeditor-for-wordpress
- Fixed in
- 4.5.3.1
- What to do
- Update ckeditor-for-wordpress to 4.5.3.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 26, 2019Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.CVE-2019-15501 · Other software · Lsoft · reported by MITREMedium 6.1
Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.
- Product
- Listserv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Aug 26, 2019Status Board 1.1.81 has reflected XSS via dashboard.ts.CVE-2019-15479 · Other software · Status Board Project · reported by MITREMedium 6.1
Status Board 1.1.81 has reflected XSS via dashboard.ts.
- Product
- Status Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019Status Board 1.1.81 has reflected XSS via logic.ts.CVE-2019-15478 · Other software · Status Board Project · reported by MITREMedium 6.1
Status Board 1.1.81 has reflected XSS via logic.ts.
- Product
- Status Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).CVE-2016-6154 · Network & remote access · Watchguard · reported by MITREMedium 6.1
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
- Product
- Fireware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.CVE-2019-15492 · Other software · It-novum · reported by MITREMedium 6.1
openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.
- Product
- Openitcockpit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2019Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.CVE-2019-15488 · Other software · Igniterealtime · reported by MITREMedium 6.1
Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.
- Product
- Openfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2019The clean-login plugin before 1.5.1 for WordPress has reflected XSS.CVE-2015-9336 · WordPress plugins & themes · reported by MITREMedium 6.1
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
- Product
- clean-login
- Fixed in
- 1.5.1
- What to do
- Update clean-login to 1.5.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.CVE-2017-18534 · WordPress plugins & themes · reported by MITREMedium 6.1
The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.
- Product
- share-on-diaspora
- Fixed in
- 0.7.2
- What to do
- Update share-on-diaspora to 0.7.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 20, 2019In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter.CVE-2019-3966 · Other software · Open-emr · reported by vulnreport@tenable.comMedium 6.1
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 20, 2019In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter.CVE-2019-3965 · Other software · Open-emr · reported by vulnreport@tenable.comMedium 6.1
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 20, 2019In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter.CVE-2019-3964 · Other software · Open-emr · reported by vulnreport@tenable.comMedium 6.1
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 20, 2019In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter.CVE-2019-3963 · Other software · Open-emr · reported by vulnreport@tenable.comMedium 6.1
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.CVE-2015-9329 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
- Product
- wp-all-import
- Fixed in
- 3.2.5
- What to do
- Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 20, 2019The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.CVE-2019-15082 · WordPress plugins & themes · reported by MITREMedium 6.1
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.
- Product
- 360-product-rotation
- Fixed in
- 1.4.8
- What to do
- Update 360-product-rotation to 1.4.8 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 15, 2019DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter.CVE-2019-15095 · Other software · Diaowen · reported by MITREMedium 6.1
DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter.
- Product
- Dwsurvey
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2019SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected inCVE-2018-19386 · Other software · Solarwinds · reported by MITREMedium 6.1
SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI.
- Product
- Database Performance Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2019The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.CVE-2015-9311 · WordPress plugins & themes · reported by MITREMedium 6.1
The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
- Product
- newstatpress
- Fixed in
- 1.0.6
- What to do
- Update newstatpress to 1.0.6 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 13, 2019The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.CVE-2017-18498 · WordPress plugins & themes · reported by MITREMedium 6.1
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.
- Product
- simple-job-board
- Fixed in
- 2.4.4
- What to do
- Update simple-job-board to 2.4.4 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 9, 2019In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter.CVE-2019-11776 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgMedium 6.1
In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.
- Product
- Eclipse BIRT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.eclipse.orgbugs.eclipse.org
Aug 7, 2019A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into wCVE-2019-10376 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
- Product
- Jenkins Wall Display Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Aug 5, 2019cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).CVE-2017-18472 · Websites & servers · Cpanel · reported by MITREMedium 6.1
cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.cpanel.netnews.cpanel.com
Aug 2, 2019A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3CVE-2019-7939 · Websites & servers · Magento · reported by AdobeMedium 6.1
A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's browser.
- Product
- Magento
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagento.commagento.com
Aug 2, 2019A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, MagentCVE-2019-7887 · Websites & servers · Magento · reported by AdobeMedium 4.8
A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is disabled.
- Product
- Magento
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagento.commagento.com
Aug 2, 2019A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.CVE-2019-7862 · Websites & servers · Magento · reported by AdobeMedium 4.8
A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
- Product
- Magento
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmagento.commagento.com
Aug 2, 2019The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected.CVE-2019-6968 · Other software · Dlink · reported by MITREMedium 6.1
The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected.
- Product
- Dva-5592 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhaidiz.netrhaidiz.net
Jul 26, 2019Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/includes/adminprocess.CVE-2019-14228 · Other software · Angry-frog · reported by MITREMedium 6.1
Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/includes/adminprocess.php. If there is an error when registering the user, the unsanitized username will reflect via the error page. Due to the lack of CSRF protection on the admin/includes/adminprocess.php endpoint, an attacker is able to chain the XSS with CSRF in order to cause remote exploitation.
- Product
- Xavier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netm-q-t.github.io
Jul 26, 2019In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or CVE-2019-13387 · Other software · Control-webpanel · reported by MITREMedium 6.1
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or session, or redirect to a phishing website.
- Product
- Webpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcentos-webpanel.com
Jul 18, 2019Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability.CVE-2019-7955 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jul 17, 2019Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.CVE-2019-13646 · Other software · Firefly-iii · reported by MITREMedium 5.4
Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability
- Product
- Firefly III
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2019A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller.CVE-2019-0234 · Websites & servers · Apache · reported by security@apache.orgMedium 6.1
A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to the latest version of Roller, which is now Roller 5.2.3.
- Product
- Apache Roller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jul 11, 2019A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 anCVE-2019-3889 · Other software · Red Hat · reported by Red HatMedium 5.4
A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.
- Product
- atomic-openshift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 11, 2019A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScripCVE-2019-10346 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.
- Product
- Jenkins Embeddable Build Status Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jul 10, 2019paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code executionCVE-2017-6217 · Other software · Paypal · reported by MITREMedium 6.1
paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution
- Product
- Adaptive Payments SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2019MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks.CVE-2019-12927 · Other software · Mailenable · reported by MITREMedium 6.1
MailEnable Enterprise Premium 10.23 was vulnerable to stored and reflected cross-site scripting (XSS) attacks. Because the session cookie did not use the HttpOnly flag, it was possible to hijack the session cookie by exploiting this vulnerability.
- Product
- Mailenable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmailenable.comnccgroup.trust
Jul 3, 2019A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages.CVE-2019-12842 · Other software · Jetbrains · reported by MITREMedium 6.1
A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-site scripting (XSS) vuCVE-2019-6626 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.1
On BIG-IP (AFM, Analytics, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the Configuration utility.
- Product
- BIG-IP (AFM, Analytics, ASM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Jul 3, 2019On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability exists in anCVE-2019-6625 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.1
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI) also known as the BIG-IP Configuration utility.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Jul 3, 2019novaksolutions/infusionsoft-php-sdk v2016-10-31 is vulnerable to a reflected XSS in the leadscoring.php resulting code executionCVE-2017-6216 · Other software · Novaksolutions · reported by MITREMedium 6.1
novaksolutions/infusionsoft-php-sdk v2016-10-31 is vulnerable to a reflected XSS in the leadscoring.php resulting code execution
- Product
- Infusionsoft-php-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2019A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attacCVE-2019-12581 · Network & remote access · Zyxel · reported by MITREMedium 6.1
A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.
- Product
- Uag2100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordn-thumann.desec-consult.com
Jun 25, 2019Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input.CVE-2019-3961 · Other software · Tenable · reported by vulnreport@tenable.comMedium 6.1
Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a users browser session.
- Product
- Tenable Nessus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtenable.com
Jun 18, 2019In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting (XSS) vulnerability allows remote authenticatCVE-2018-18880 · Other software · Columbiaweather · reported by MITREMedium 5.4
In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting (XSS) vulnerability allows remote authenticated users to inject arbitrary web script.
- Product
- Weather Microserver Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapplied-risk.comics-cert.us-cert.gov
Jun 14, 2019SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter CVE-2019-0303 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP BusinessObjects Business Intelligence Platform (Administration Console), versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript code when the url is accessed.
- Product
- SAP BusinessObjects Business Intelligence Platform (Administration Console)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jun 13, 2019There is a reflection XSS vulnerability in the HedEx products.CVE-2019-5286 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
There is a reflection XSS vulnerability in the HedEx products. Remote attackers send malicious links to users and trick users to click. Successfully exploit cloud allow the attacker to initiate XSS attacks. Affects HedEx Lite versions earlier than V200R006C00SPC007.
- Product
- Hedex Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2019Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potentiaCVE-2019-0130 · Other software · Intel · reported by secure@intel.comHigh 7.4
Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potentially enable denial of service via network access.
- Product
- Rapid Storage Technology Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsupport.lenovo.com
Jun 11, 2019A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlowCVE-2019-10336 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.
- Product
- Jenkins ElectricFlow Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jun 6, 2019vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions.CVE-2018-8047 · Other software · Vtiger · reported by MITREMedium 6.1
vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List (app parameter).
- Product
- Vtiger CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwizlynxgroup.comwizlynxgroup.com
Jun 4, 2019A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized mCVE-2019-5588 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.1
A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests.
- Product
- Fortinet FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comfortiguard.com
Jun 4, 2019A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execuCVE-2019-5586 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.1
A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "param" parameter of the error process HTTP requests.
- Product
- Fortinet FortiOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comfortiguard.com
Jun 3, 2019VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.CVE-2019-9839 · Other software · Vfront · reported by MITREMedium 6.1
VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.
- Product
- Vfront
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnetsparker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.