Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,467 results · page 54 of 70
May 11, 2021In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.CVE-2021-31911 · Other software · Jetbrains · reported by MITREMedium 6.1
In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
May 6, 2021The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected CCVE-2021-24214 · WordPress plugins & themes · reported by WPScanMedium 6.1
The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.
- What to do
- Update the plugin to the newest version.
Apr 25, 2021Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.CVE-2021-31761 · Other software · Webmin · reported by MITRECritical 9.6
Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 23, 2021Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities wheCVE-2021-31583 · Other software · Sipwise · reported by MITREMedium 5.4
Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in callforward/time/set/save (POST tsetname); Reflected XSS in addressbook (GET filter); Stored XSS in addressbook/save (POST firstname, lastname, company); and Reflected XSS in statistics/versions (GET lang).
- Product
- Next Generation Communication Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.sipwise.compacketstormsecurity.com
Apr 22, 2021Cooked Pro: Was affected by unauthenticated reflected Cross-Site Scripting issuesCVE-2021-24233 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.
- Product
- Cooked Pro
- Fixed in
- 1.7.5.6
- What to do
- Update Cooked Pro to 1.7.5.6 or newer.
Full record and what to do →NVD recordwpscan.comgetastra.com
Apr 21, 2021Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type.CVE-2020-36324 · Other software · Wikimedia · reported by MITREMedium 6.1
Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type.
- Product
- Analytics-quarry-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comquarry.wmflabs.org
Apr 21, 2021In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entrieCVE-2021-28167 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgMedium 6.5
In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API causes the JVM in some cases to pre-resolve certain constant pool entries. This allows a user to call static methods or access static members without running the class initialization method, and may allow a user to observe uninitialized values.
- Product
- Eclipse OpenJ9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Apr 20, 2021The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues.CVE-2021-25680 · Other software · Adtran · reported by MITREMedium 6.1
The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version 10.8.1 was able to be confirmed during primary research. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched.
- Product
- Personal Phone Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 12, 2021In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `CVE-2021-25926 · Other software · Sickrage · reported by vulnerabilitylab@mend.ioMedium 6.1
In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.
- Product
- Sickrage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Apr 12, 2021The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin befoCVE-2021-24229 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.
- Fixed in
- 1.7.2
- What to do
- Update the plugin to 1.7.2 or newer.
Apr 12, 2021Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon: The WordPress login form (wp-loginCVE-2021-24228 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized.
- Product
- Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon
- Fixed in
- 1.7.2
- What to do
- Update Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon to 1.7.2 or newer.
Apr 12, 2021GiveWP – Donation Plugin and Fundraising Platform: Was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panelCVE-2021-24213 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.0
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.0 or newer.
Apr 8, 2021Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin.CVE-2021-22510 · Other software · Microfocus · reported by security@opentext.comMedium 6.1
Reflected XSS vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects all version 6.7 and earlier versions.
- Product
- Application Automation Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2021The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4.CVE-2021-27945 · Other software · Squirro · reported by MITREMedium 6.1
The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes.
- Product
- Squirro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsquirro.atlassian.netsquirro.atlassian.net
Apr 7, 2021A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web script and HTML via theCVE-2020-24135 · Other software · Wcms · reported by MITREMedium 6.1
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web script and HTML via the type parameter to wex/cssjs.php.
- Product
- Wcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2021Social Slider Widget: Allowed Authenticated Reflected XSS in the plugin settings pageCVE-2021-24196 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘token_error’ parameter can be controlled by users and it is directly echoed without being sanitized
- Product
- Social Slider Widget
- Fixed in
- 1.8.5
- What to do
- Update Social Slider Widget to 1.8.5 or newer.
Full record and what to do →NVD recordpurinechu.github.iowpscan.com
Apr 5, 2021setting page of the SEO Redirection Plugin - 301 Redirect Manager: Is vulnerable to reflected Cross-Site Scripting (XSS)CVE-2021-24187 · WordPress plugins & themes · reported by WPScanMedium 5.4
The setting page of the SEO Redirection Plugin - 301 Redirect Manager WordPress plugin before 6.4 is vulnerable to reflected Cross-Site Scripting (XSS) as user input is not properly sanitised before being output in an attribute.
- Product
- setting page of the SEO Redirection Plugin - 301 Redirect Manager
- Fixed in
- 6.4
- What to do
- Update setting page of the SEO Redirection Plugin - 301 Redirect Manager to 6.4 or newer.
Apr 5, 2021Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerabCVE-2021-24180 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.
- Fixed in
- 2.0.4
- What to do
- Update the plugin to 2.0.4 or newer.
Apr 5, 2021In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_managerCVE-2021-24177 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.
- Product
- File Manager
- Fixed in
- 7.1
- What to do
- Update File Manager to 7.1 or newer.
Full record and what to do →NVD recordn4nj0.github.ioplugins.trac.wordpress.org
Apr 5, 2021The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.CVE-2021-24152 · WordPress plugins & themes · reported by WPScanMedium 6.1
The "All Subscribers" setting page of Popup Builder was vulnerable to reflected Cross-Site Scripting.
- Fixed in
- 3.74
- What to do
- Update the plugin to 3.74 or newer.
Apr 5, 2021Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS).CVE-2021-30056 · Other software · ENG · reported by MITREMedium 5.4
Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-services/publish via the 'EXEC_FROM' parameter that can lead to data leakage.
- Product
- Knowage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2021On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability.CVE-2021-23006 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.1
On all 7.x and 6.x versions (fixed in 8.0.0), undisclosed BIG-IQ pages have a reflected cross-site scripting vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- Product
- Big-iq Centralized Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Mar 25, 2021Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to CVE-2021-22889 · Other software · Revive-adserver · reported by support@hackerone.comMedium 6.1
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and pressing a certain key combination to execute injected JavaScript code.
- Product
- Revive Adserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Mar 25, 2021Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php.CVE-2021-22888 · Other software · Revive-adserver · reported by support@hackerone.comMedium 6.1
Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code.
- Product
- Revive Adserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Mar 23, 2021Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter.CVE-2021-27310 · Other software · Csphere · reported by MITREMedium 6.1
Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter.
- Product
- Clansphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2021Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter.CVE-2021-27309 · Other software · Csphere · reported by MITREMedium 6.1
Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter.
- Product
- Clansphere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2021In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly.CVE-2021-25922 · Other software · Open-emr · reported by vulnerabilitylab@mend.ioMedium 6.1
In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could trick a user to click on a malicious url and execute malicious code.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Mar 19, 2021Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsivCVE-2020-6578 · Other software · Zen-cart · reported by MITREMedium 6.1
Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to includes/templates/template_default/common/tpl_main_page.php or includes/templates/responsive_classic/common/tpl_main_page.php.
- Product
- ZEN Cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Mar 18, 2021TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).CVE-2021-28109 · Other software · Compassplus · reported by MITREMedium 6.1
TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).
- Product
- Tranzware Fimi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comtadviser.ru
Mar 18, 2021Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is displayed in the /repeCVE-2021-28160 · Other software · Acexy Wireless-n Wifi Repeater Project · reported by MITREMedium 6.1
Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is displayed in the /repeater.html page ("Repeater Wizard" homepage section).
- Product
- Acexy Wireless-n Wifi Repeater Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog-ssh3ll.medium.comamazon.com
Mar 18, 2021Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site ScriptCVE-2021-24124 · WordPress plugins & themes · reported by WPScanMedium 6.1
Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation.
- Product
- WP Shieldon
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update WP Shieldon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 12, 2021Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2021-21080 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to the page containing the vulnerable field.
- Product
- Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 12, 2021Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2021-21079 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Connect version 11.0.7 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious JavaScript content that may be executed within the context of the victim's browser when they browse to the page containing the vulnerable field.
- Product
- Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 10, 2021Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 alloCVE-2021-20672 · Other software · WESEEK, Inc. · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- GROWI (v4.2 Series)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL.CVE-2020-13959 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
- Product
- Apache Velocity Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Mar 5, 2021A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0.CVE-2021-26967 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.1
A remote reflected cross-site scripting (xss) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the web-based management interface of AirWave could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of certain components of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the AirWave management interface.
- Product
- Airwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Mar 4, 2021A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated atCVE-2020-24912 · Other software · Qcubed · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
- Product
- Qcubed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 3, 2021Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.CVE-2021-22878 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.8
Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.
- Product
- Nextcloud Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Mar 1, 2021EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.CVE-2021-26702 · Other software · Eprints · reported by MITREMedium 6.1
EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.
- Product
- Eprints
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.eprints.orggithub.com
Mar 1, 2021EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.CVE-2021-26475 · Other software · Eprints · reported by MITREMedium 6.1
EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.
- Product
- Eprints
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiles.eprints.orggithub.com
Feb 25, 2021Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.CVE-2019-18944 · Other software · Micro Focus · reported by security@opentext.comMedium 4.9
Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.
- Product
- Solutions Business Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordknowledgebase.serena.comknowledgebase.serena.com
Feb 23, 2021A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1.CVE-2021-26682 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.1
A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the guest portal interface of ClearPass could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the portal. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the guest portal interface.
- Product
- Clearpass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Feb 12, 2021On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site ScCVE-2021-22979 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.1
On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- Product
- Big-ip Access Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Feb 11, 2021Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' pCVE-2021-21029 · Websites & servers · Adobe · reported by AdobeMedium 4.8
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
- Product
- Magento Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Feb 9, 2021Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers to inject arbitrary wCVE-2020-22839 · Other software · B2evolution · reported by MITREMedium 6.1
Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers to inject arbitrary webscript or HTML code via the tab3 parameter.
- Product
- B2evolution CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsohambakore.medium.com
Feb 9, 2021Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later CVE-2020-13409 · Other software · Tufin · reported by MITREMedium 5.9
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 3 of 3)
- Product
- Securetrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2021Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later CVE-2020-13408 · Other software · Tufin · reported by MITREMedium 5.9
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 2 of 3)
- Product
- Securetrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2021Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later CVE-2020-13407 · Other software · Tufin · reported by MITREMedium 5.9
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 1 of 3)
- Product
- Securetrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CCVE-2021-26916 · Websites & servers · Nopcommerce · reported by MITREMedium 6.1
In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter.
- Product
- Nopcommerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2021LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.CVE-2021-26722 · Other software · Linkedin · reported by MITREMedium 6.1
LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.
- Product
- Oncall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.