CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 3 and 3.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1020007 79 XSS 2019-07-29 2019-07-30
3.5
None Remote Medium Single system None Partial None
Dependency-Track before 3.5.1 allows XSS.
2 CVE-2019-1020005 79 XSS 2019-07-29 2019-08-01
3.5
None Remote Medium Single system None Partial None
invenio-communities before 1.0.0a20 allows XSS.
3 CVE-2019-1020003 79 XSS 2019-07-29 2019-08-01
3.5
None Remote Medium Single system None Partial None
invenio-records before 1.2.2 allows XSS.
4 CVE-2019-1010310 255 2019-07-12 2019-07-18
3.5
None Remote Medium Single system None Partial None
GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools > Reminder > Description .. Set the description to any iframe/form tags and apply. The attack vector is: The attacker puts a login form, the user fills it and clicks on submit .. the request is sent to the attacker domain saving the data. The fixed version is: 9.4.1.
5 CVE-2019-1010307 79 XSS 2019-07-15 2019-07-18
3.5
None Remote Medium Single system None Partial None
GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and executes it.
6 CVE-2019-1010235 79 XSS 2019-07-22 2019-07-23
3.5
None Remote Medium Single system None Partial None
Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.
7 CVE-2019-1010147 79 XSS 2019-07-25 2019-08-05
3.5
None Remote Medium Single system None Partial None
Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access admin functionality through their browser and control browser. The component is: MIAdminStyles.i4. The attack vector is: Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. The fixed version is: 7.4 and later.
8 CVE-2019-1010008 79 Exec Code XSS 2019-07-14 2019-07-18
3.5
None Remote Medium Single system None Partial None
OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting (XSS). The impact is: Theoretically low, but might potentially enable persistent XSS (user could embed mal. code). The component is: Javascript code execution in "Name", "Location", "Bio" and "Starting Page" fields in the "My Account" page. File: Lib/listjs/list.js, line 67. The attack vector is: unknown, victim must open profile page if persistent was possible.
9 CVE-2019-1010003 79 XSS 2019-07-11 2019-07-12
3.5
None Remote Medium Single system None Partial None
Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).
10 CVE-2019-1003050 79 XSS 2019-04-10 2019-04-12
3.5
None Remote Medium Single system None Partial None
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
11 CVE-2019-1003043 255 2019-03-28 2019-04-02
3.5
None Remote Medium Single system Partial None None
A missing permission check in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
12 CVE-2019-1003042 79 XSS 2019-03-28 2019-06-10
3.5
None Remote Medium Single system None Partial None
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
13 CVE-2019-1003014 79 XSS 2019-02-06 2019-04-26
3.5
None Remote Medium Single system None Partial None
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
14 CVE-2019-1003013 79 XSS 2019-02-06 2019-04-26
3.5
None Remote Medium Single system None Partial None
An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
15 CVE-2019-14987 79 XSS 2019-08-13 2019-08-15
3.5
None Remote Medium Single system None Partial None
Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions.
16 CVE-2019-14948 79 XSS 2019-08-12 2019-08-16
3.5
None Remote Medium Single system None Partial None
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
17 CVE-2019-14947 79 XSS 2019-08-12 2019-08-14
3.5
None Remote Medium Single system None Partial None
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.
18 CVE-2019-14946 79 XSS 2019-08-12 2019-08-14
3.5
None Remote Medium Single system None Partial None
The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
19 CVE-2019-14945 79 XSS 2019-08-12 2019-08-14
3.5
None Remote Medium Single system None Partial None
The ultimate-member plugin before 2.0.54 for WordPress has XSS.
20 CVE-2019-14805 79 XSS 2019-08-09 2019-08-14
3.5
None Remote Medium Single system None Partial None
studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.
21 CVE-2019-14804 79 XSS 2019-08-09 2019-08-14
3.5
None Remote Medium Single system None Partial None
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.
22 CVE-2019-14797 79 XSS 2019-08-09 2019-08-14
3.5
None Remote Medium Single system None Partial None
The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
23 CVE-2019-14796 79 XSS 2019-08-09 2019-08-14
3.5
None Remote Medium Single system None Partial None
The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.
24 CVE-2019-14792 79 XSS 2019-08-09 2019-08-14
3.5
None Remote Medium Single system None Partial None
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.
25 CVE-2019-14787 79 XSS 2019-08-09 2019-08-15
3.5
None Remote Medium Single system None Partial None
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
26 CVE-2019-14785 79 XSS 2019-08-09 2019-08-15
3.5
None Remote Medium Single system None Partial None
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
27 CVE-2019-14748 434 XSS 2019-08-07 2019-08-14
3.5
None Remote Medium Single system None Partial None
An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attachment.
28 CVE-2019-14731 79 XSS 2019-08-06 2019-08-15
3.5
None Remote Medium Single system None Partial None
An issue was discovered in ZenTao 11.5.1. There is an XSS (stored) vulnerability that leads to the capture of other people's cookies via the Rich Text Box.
29 CVE-2019-14680 352 CSRF 2019-08-08 2019-08-14
3.5
None Remote Medium Single system None Partial None
The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.
30 CVE-2019-14672 79 Exec Code XSS 2019-08-05 2019-08-09
3.5
None Remote Medium Single system None Partial None
Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.
31 CVE-2019-14670 79 Exec Code XSS 2019-08-05 2019-08-09
3.5
None Remote Medium Single system None Partial None
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.
32 CVE-2019-14669 79 Exec Code XSS 2019-08-05 2019-08-09
3.5
None Remote Medium Single system None Partial None
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page.
33 CVE-2019-14668 79 Exec Code XSS 2019-08-05 2019-08-09
3.5
None Remote Medium Single system None Partial None
Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link.
34 CVE-2019-14550 79 XSS 2019-08-05 2019-08-09
3.5
None Remote Medium Single system None Partial None
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus helping him steal victims' cookies (hence compromising their accounts).
35 CVE-2019-14549 79 XSS 2019-08-05 2019-08-09
3.5
None Remote Medium Single system None Partial None
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible link.
36 CVE-2019-14548 79 XSS 2019-08-05 2019-08-09
3.5
None Remote Medium Single system None Partial None
An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside the body of the article, thus helping him steal victims' cookies (hence compromising their accounts).
37 CVE-2019-14547 79 XSS 2019-08-05 2019-08-09
3.5
None Remote Medium Single system None Partial None
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the JavaScript inside the filename and send it to users, thus helping him steal victims' cookies (hence compromising their accounts).
38 CVE-2019-14546 79 XSS 2019-08-05 2019-08-14
3.5
None Remote Medium Single system None Partial None
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature, which fires when the victim replies or forwards the mail, thus helping him steal victims' cookies (hence compromising their accounts).
39 CVE-2019-14456 79 XSS 2019-07-31 2019-08-07
3.5
None Remote Medium Single system None Partial None
Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. If a malicious user of an external system (connected to a serial port on an Opengear console server) sends crafted text to a serial port (that has logging enabled), the text will be replayed when the logs are viewed. Exploiting this vulnerability requires access to the serial port and/or console server.
40 CVE-2019-14415 79 XSS 2019-07-29 2019-08-02
3.5
None Remote Medium Single system None Partial None
An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that an attacker has access to.
41 CVE-2019-14390 79 XSS 2019-07-30 2019-07-30
3.5
None Remote Medium Single system None Partial None
cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).
42 CVE-2019-14386 79 XSS 2019-07-30 2019-07-30
3.5
None Remote Medium Single system None Partial None
cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).
43 CVE-2019-14298 79 XSS 2019-07-27 2019-07-29
3.5
None Remote Medium Single system None Partial None
Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.
44 CVE-2019-14297 79 XSS 2019-07-27 2019-07-29
3.5
None Remote Medium Single system None Partial None
Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx.
45 CVE-2019-14221 79 XSS 2019-08-08 2019-08-16
3.5
None Remote Medium Single system None Partial None
1CRM On-Premise Software 8.5.7 allows XSS via a payload that is mishandled during a Run Report operation.
46 CVE-2019-13991 74 2019-07-19 2019-08-02
3.3
None Local Network Low Not required None Partial None
Embedded systems based on Arduino before Rev3 allow remote attackers to send data to LEDs (directly connected to GPIO pins) via a laser, because of LED photosensitivity.
47 CVE-2019-13977 79 XSS 2019-07-19 2019-07-27
3.5
None Remote Medium Single system None Partial None
index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, tg=admdir&idx=mdb&id=1, tg=notes&idx=Create, tg=admfaqs&idx=Add, or tg=admoc&idx=addoc&item=.
48 CVE-2019-13950 79 XSS 2019-07-18 2019-07-18
3.5
None Remote Medium Single system None Partial None
index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment.
49 CVE-2019-13948 79 XSS 2019-07-18 2019-07-18
3.5
None Remote Medium Single system None Partial None
SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by a crafted use of the onerror attribute of an IMG element.
50 CVE-2019-13647 79 Exec Code XSS 2019-07-17 2019-07-18
3.5
None Remote Medium Single system None Partial None
Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing.
Total number of vulnerabilities : 4305   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.