Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
280 results · page 5 of 6
Feb 15, 2022Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.CVE-2022-0611 · Other software · snipe · reported by security@huntr.devMedium 6.3
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet GeneCVE-2022-25184 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Pipeline: Build Step Plugin 2.15 and earlier reveals password parameter default values when generating a pipeline script using the Pipeline Snippet Generator, allowing attackers with Item/Read permission to retrieve the default password parameter value from jobs.
- Product
- Jenkins Pipeline: Build Step Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.CVE-2022-0579 · Other software · snipe · reported by security@huntr.devMedium 6.5
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.CVE-2022-0569 · Other software · snipe · reported by security@huntr.devMedium 5.3
Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022Code Snippets: Does not escape the snippets-safe-mode parameter before outputting it back in attributesCVE-2021-25008 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue
- Product
- Code Snippets
- Fixed in
- 2.14.3
- What to do
- Update Code Snippets to 2.14.3 or newer.
Jan 13, 2022Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.CVE-2022-0178 · Other software · snipe · reported by security@huntr.devMedium 6.3
Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2022snipe-it is vulnerable to Missing AuthorizationCVE-2022-0179 · Other software · snipe · reported by security@huntr.devMedium 5.4
snipe-it is vulnerable to Missing Authorization
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2021snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4130 · Other software · snipe · reported by security@huntr.devHigh 8.8
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4108 · Other software · snipe · reported by security@huntr.devMedium 6.1
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021snipe-it is vulnerable to Improper Access ControlCVE-2021-4089 · Other software · snipe · reported by security@huntr.devMedium 4.3
snipe-it is vulnerable to Improper Access Control
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2021snipe-it is vulnerable to Server-Side Request Forgery (SSRF)CVE-2021-4075 · Other software · snipe · reported by security@huntr.devHigh 7.2
snipe-it is vulnerable to Server-Side Request Forgery (SSRF)
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4018 · Other software · snipe · reported by security@huntr.devMedium 5.4
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2021OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL.CVE-2021-38374 · Other software · Open-xchange · reported by MITREMedium 5.4
OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 22, 2021OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.CVE-2021-33490 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopen-xchange.com
Nov 19, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3961 · Other software · snipe · reported by security@huntr.devMedium 5.4
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3938 · Other software · snipe · reported by security@huntr.devMedium 5.4
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2021snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-3931 · Other software · snipe · reported by security@huntr.devMedium 4.3
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2021A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secretCVE-2021-25742 · Other software · Kubernetes · reported by jordan@liggitt.netHigh 7.6
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
- Product
- Kubernetes ingress-nginx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Oct 19, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3879 · Other software · snipe · reported by security@huntr.devMedium 5.4
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3863 · Other software · snipe · reported by security@huntr.devMedium 6.1
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-3858 · Other software · snipe · reported by security@huntr.devHigh 8.8
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- snipe/snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2021A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via cCVE-2020-21353 · Other software · Get-simple · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via crafted payload in the Edit Snippets module.
- Product
- Getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2021OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an AppCVE-2021-37403 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used.
- Product
- Open-xchange Appsuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgopen-xchange.com
Jul 22, 2021OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dlCVE-2021-26698 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used.
- Product
- Open-xchange Appsuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 1, 2021Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.CVE-2020-23219 · Other software · Monstra · reported by MITREHigh 8.8
Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.
- Product
- Monstra CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2021Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing anCVE-2021-20745 · Other software · Takuya Matsuyama · reported by vultures@jpcert.or.jpHigh 7.8
Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop.
- Product
- Inkdrop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.inkdrop.appjvn.jp
Jun 23, 2021Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets.CVE-2020-20391 · Other software · Get-simple · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets.
- Product
- Getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2021Cross-site scripting vulnerability in Zettlr from 0.20.0 to 1.8.8 allows an attacker to execute an arbitrary script by loading a file or code snippet containingCVE-2021-20727 · Other software · Hendrik Erz · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Zettlr from 0.20.0 to 1.8.8 allows an attacker to execute an arbitrary script by loading a file or code snippet containing an invalid iframe into Zettlr.
- Product
- Zettlr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021OX App Suite 7.10.4 and earlier allows SSRF via a snippet.CVE-2020-28943 · Other software · Open-xchange · reported by MITREMedium 6.5
OX App Suite 7.10.4 and earlier allows SSRF via a snippet.
- Product
- Open-xchange Appsuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopen-xchange.com
Mar 11, 2021Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.CVE-2021-27678 · Other software · Batflat · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
- Product
- Batflat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2020Spamsniper 5.0 ~ 5.2.7 contain a stack-based buffer overflow vulnerability caused by improper boundary checks when parsing MAIL FROM command.CVE-2020-7845 · Other software · Jiransecurity · reported by vuln@krcert.or.krHigh 8.1
Spamsniper 5.0 ~ 5.2.7 contain a stack-based buffer overflow vulnerability caused by improper boundary checks when parsing MAIL FROM command. It leads remote attacker to execute arbitrary code via crafted packet.
- Product
- Spamsniper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjiransecurity.comkrcert.or.kr
Aug 31, 2020OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.CVE-2020-12643 · Other software · Open-xchange · reported by MITREMedium 4.3
OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address.
- Product
- Open-xchange Appsuite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgopen-xchange.com
Jun 8, 2020An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets.CVE-2020-6110 · Other software · Zoom · reported by talos-cna@cisco.comHigh 8.8
An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs to send a specially crafted message to a target user or a group to trigger this vulnerability. For the most severe effect, target user interaction is required.
- Product
- Zoom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 4, 2020rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection.CVE-2020-10549 · Other software · Rconfig · reported by MITRECritical 9.8
rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
- Product
- Rconfig
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtheguly.github.io
May 27, 2020ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.CVE-2020-13632 · Other software · Siemens · reported by MITREMedium 5.5
ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orgcert-portal.siemens.com
May 27, 2020ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.CVE-2020-13630 · Other software · Siemens · reported by MITREHigh 7
ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Apr 29, 2020GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API.CVE-2020-12275 · Websites & servers · Gitlab · reported by MITREMedium 5.3
GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API.
- Product
- Gitlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comabout.gitlab.com
Mar 12, 2020A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party sCVE-2020-0872 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party source files into its HTML output, aka 'Remote Code Execution Vulnerability in Application Inspector'.
- Product
- Application Inspector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Feb 12, 2020The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailinCVE-2020-7957 · Other software · Dovecot · reported by MITREMedium 5.3
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
- Product
- Dovecot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comdovecot.org
Jan 28, 2020The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.CVE-2020-8417 · WordPress plugins & themes · reported by MITREHigh 8.8
The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.
- Product
- Code Snippets
- Fixed in
- 2.14.0
- What to do
- Update Code Snippets to 2.14.0 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Sep 13, 2019The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.CVE-2019-16289 · WordPress plugins & themes · reported by MITREMedium 5.4
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.
- Product
- insert-php (aka Woody ad snippets)
- Fixed in
- 2.2.8
- What to do
- Update insert-php (aka Woody ad snippets) to 2.2.8 or newer.
Full record and what to do →NVD recordgeneraleg0x01.comwordpress.org
Sep 3, 2019admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by sCVE-2019-15858 · WordPress plugins & themes · reported by MITREHigh 8.8
admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.
- Product
- admin/includes/class.import.snippet.php in the "Woody ad snippets
- Fixed in
- 2.2.5
- What to do
- Update admin/includes/class.import.snippet.php in the "Woody ad snippets to 2.2.5 or newer.
Full record and what to do →NVD recordblog.nintechnet.comwpvulndb.com
Aug 21, 2019The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.CVE-2018-20977 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.
- Product
- all-in-one-schemaorg-rich-snippets
- Fixed in
- 1.5.0
- What to do
- Update all-in-one-schemaorg-rich-snippets to 1.5.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 8, 2019admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletioCVE-2019-14773 · WordPress plugins & themes · reported by MITREHigh 7.5
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.
- Product
- admin/includes/class.actions.snippet.php in the "Woody ad snippets
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update admin/includes/class.actions.snippet.php in the "Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgpluginvulnerabilities.com
Jul 23, 2019Activity Stream can display content from sent from the Snippet Service website.CVE-2019-11718 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised. This vulnerability affects Firefox < 68.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Mar 29, 2019Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add).CVE-2019-10646 · Other software · Wolfcms · reported by MITREMedium 6.1
Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded.
- Product
- Wolf CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2019Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.CVE-2019-10118 · Other software · Snipeitapp · reported by MITREMedium 6.1
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2019In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS.CVE-2016-10744 · Other software · Select2 · reported by MITREMedium 6.1
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
- Product
- Select2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2019GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring.CVE-2019-10016 · Other software · Gforge · reported by MITREMedium 6.1
GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring.
- Product
- Advanced Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2019Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.CVE-2018-20777 · Other software · Frog CMS Project · reported by MITREMedium 5.4
Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.
- Product
- Frog CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.