CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Security Vulnerabilities Published In 2019(Cross Site Scripting (XSS))

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-1020019 79 XSS 2019-07-29 2019-07-31
4.3
 None Remote Medium Not required None Partial None
invenio-previewer before 1.0.0a12 allows XSS.
2 CVE-2019-1020010 79 XSS 2019-07-29 2019-09-05
4.3
 None Remote Medium Not required None Partial None
Misskey before 10.102.4 allows hijacking a user's token.
3 CVE-2019-1020008 79 XSS 2019-07-29 2019-07-31
4.3
 None Remote Medium Not required None Partial None
stacktable.js before 1.0.4 allows XSS.
4 CVE-2019-1020007 79 XSS 2019-07-29 2020-02-13
3.5
 None Remote Medium ??? None Partial None
Dependency-Track before 3.5.1 allows XSS.
5 CVE-2019-1020005 79 XSS 2019-07-29 2019-08-01
3.5
 None Remote Medium ??? None Partial None
invenio-communities before 1.0.0a20 allows XSS.
6 CVE-2019-1020003 79 XSS 2019-07-29 2019-08-01
3.5
 None Remote Medium ??? None Partial None
invenio-records before 1.2.2 allows XSS.
7 CVE-2019-1010314 79 XSS 2019-07-11 2019-07-12
4.3
 None Remote Medium Not required None Partial None
Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.
8 CVE-2019-1010311 XSS 2019-07-12 2019-07-12
0.0
 None ??? ??? ??? ??? ??? ???
Tildeslash Monit Version 5.25.2 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Execute javascript in a victim s browser; disable all monitoring for a particular host or service. The component is: In function do_viewlog() on line 910 in Monit/src/http/cervlet.c, an attacker controlled log file is copied into an HTTP response without any HTML escaping. The attack vector is: An authenticated remote attacker can exploit the vulnerability over a network. The fixed version is: Version 5.25.3 and later.
9 CVE-2019-1010307 79 XSS 2019-07-15 2019-07-18
3.5
 None Remote Medium ??? None Partial None
GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and executes it.
10 CVE-2019-1010287 79 Exec Code XSS 2019-07-17 2019-07-22
4.3
 None Remote Medium Not required None Partial None
Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the malicious url.
11 CVE-2019-1010261 79 XSS 2019-07-18 2019-07-19
4.3
 None Remote Medium Not required None Partial None
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.
12 CVE-2019-1010247 79 XSS 2019-07-19 2023-05-25
4.3
 None Remote Medium Not required None Partial None
ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.
13 CVE-2019-1010237 79 Exec Code XSS 2019-07-22 2019-10-09
4.3
 None Remote Medium Not required None Partial None
Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap (attacker) / Corrections view (victim). The fixed version is: 5.3.12.
14 CVE-2019-1010235 79 XSS 2019-07-22 2019-07-23
3.5
 None Remote Medium ??? None Partial None
Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.
15 CVE-2019-1010207 79 XSS 2019-07-23 2019-07-29
4.3
 None Remote Medium Not required None Partial None
Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting (XSS). The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login, wp-lang, and supplied URL. The attack vector is: If a victim clicks a malicious link, the attacker can steal his/her account. The fixed version is: 3.0.16.
16 CVE-2019-1010199 79 XSS Bypass 2019-07-23 2019-07-25
4.3
 None Remote Medium Not required None Partial None
ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed, the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.
17 CVE-2019-1010193 79 XSS 2019-07-24 2019-07-26
4.3
 None Remote Medium Not required None Partial None
hisiphp 1.0.8 is affected by: Cross Site Scripting (XSS).
18 CVE-2019-1010147 79 XSS 2019-07-26 2019-08-05
3.5
 None Remote Medium ??? None Partial None
Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access admin functionality through their browser and control browser. The component is: MIAdminStyles.i4. The attack vector is: Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. The fixed version is: 7.4 and later.
19 CVE-2019-1010124 79 XSS 2019-07-23 2023-02-28
3.5
 None Remote Medium ??? None Partial None
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.
20 CVE-2019-1010113 79 XSS 2019-07-19 2019-07-25
4.3
 None Remote Medium Not required None Partial None
Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a link (A) element.
21 CVE-2019-1010091 79 Exec Code XSS 2019-07-17 2020-08-04
4.3
 None Remote Medium Not required None Partial None
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.
22 CVE-2019-1010028 79 XSS 2019-07-15 2019-07-15
4.3
 None Remote Medium Not required None Partial None
phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/send_reply/. The attack vector is: <img src=x onerror=alert(document.domain) />.
23 CVE-2019-1010018 79 Exec Code XSS 2019-07-16 2019-10-09
4.3
 None Remote Medium Not required None Partial None
Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1, 2.2.2 and 2.1.3.
24 CVE-2019-1010016 79 XSS 2019-07-15 2022-11-17
4.3
 None Remote Medium Not required None Partial None
Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker.
25 CVE-2019-1010008 79 Exec Code XSS 2019-07-15 2019-07-18
3.5
 None Remote Medium ??? None Partial None
OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting (XSS). The impact is: Theoretically low, but might potentially enable persistent XSS (user could embed mal. code). The component is: Javascript code execution in "Name", "Location", "Bio" and "Starting Page" fields in the "My Account" page. File: Lib/listjs/list.js, line 67. The attack vector is: unknown, victim must open profile page if persistent was possible.
26 CVE-2019-1010005 79 Exec Code XSS 2019-07-15 2019-07-16
4.3
 None Remote Medium Not required None Partial None
HexoEditor v1.1.8-beta is affected by: XSS to code execution.
27 CVE-2019-1010003 79 XSS 2019-07-11 2019-07-12
3.5
 None Remote Medium ??? None Partial None
Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).
28 CVE-2019-1003050 79 XSS 2019-04-10 2022-06-13
3.5
 None Remote Medium ??? None Partial None
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
29 CVE-2019-1003042 79 XSS 2019-03-28 2020-06-23
3.5
 None Remote Medium ??? None Partial None
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
30 CVE-2019-1003023 79 XSS 2019-02-06 2019-10-09
4.3
 None Remote Medium Not required None Partial None
A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML.
31 CVE-2019-1003014 79 XSS 2019-02-06 2019-10-09
3.5
 None Remote Medium ??? None Partial None
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
32 CVE-2019-1003013 79 XSS 2019-02-06 2019-10-09
3.5
 None Remote Medium ??? None Partial None
An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
33 CVE-2019-1000024 79 XSS 2019-02-04 2019-02-06
4.3
 None Remote Medium Not required None Partial None
OPT/NET BV NG-NetMS version v3.6-2 and earlier versions contains a Cross Site Scripting (XSS) vulnerability in /js/libs/jstree/demo/filebrowser/index.php page. The "id" and "operation" GET parameters can be used to inject arbitrary JavaScript which is returned in the page's response that can result in Cross-site scripting.This attack appear to be exploitable via network connectivity.
34 CVE-2019-1000015 79 XSS 2019-02-04 2019-02-20
4.3
 None Remote Medium Not required None Partial None
Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.
35 CVE-2019-1000010 79 XSS 2019-02-04 2019-02-06
4.3
 None Remote Medium Not required None Partial None
phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims browser. This attack appears to be exploitable via victim visits link crafted by an attacker. This vulnerability appears to have been fixed in 1.4.
36 CVE-2019-1000004 79 XSS 2019-02-04 2019-02-06
4.3
 None Remote Medium Not required None Partial None
yugandhargangu JspMyAdmin2 version 1.0.6 and earlier contains a Cross Site Scripting (XSS) vulnerability in sidebar and table data that can result in Database fields aren't properly sanitized and allow code injection (Cross-Site Scripting). This attack appears to be exploitable via the payload needs to be stored in the database and the victim must see the db value in question.
37 CVE-2019-20141 79 XSS 2019-12-30 2023-01-20
4.3
 None Remote Medium Not required None Partial None
An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.
38 CVE-2019-20139 79 XSS 2019-12-30 2020-01-03
3.5
 None Remote Medium ??? None Partial None
In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.
39 CVE-2019-20076 79 XSS 2019-12-30 2020-01-02
4.3
 None Remote Medium Not required None Partial None
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration).
40 CVE-2019-20075 79 XSS 2019-12-30 2020-01-02
4.3
 None Remote Medium Not required None Partial None
On Netis DL4323 devices, pingrtt_v6.html has XSS (Ping6 Diagnostic).
41 CVE-2019-20073 79 XSS 2019-12-30 2020-01-02
4.3
 None Remote Medium Not required None Partial None
On Netis DL4323 devices, XSS exists via the form2userconfig.cgi username parameter (User Account Configuration).
42 CVE-2019-20072 79 XSS 2019-12-30 2020-01-02
4.3
 None Remote Medium Not required None Partial None
On Netis DL4323 devices, XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration).
43 CVE-2019-20070 79 XSS 2019-12-30 2020-01-02
4.3
 None Remote Medium Not required None Partial None
On Netis DL4323 devices, XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration).
44 CVE-2019-20058 79 XSS 2019-12-29 2020-01-08
4.3
 None Remote Medium Not required None Partial None
** DISPUTED ** Bolt 3.7.0, if Symfony Web Profiler is used, allows XSS because unsanitized search?search= input is shown on the _profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is related to CVE-2018-12040.
45 CVE-2019-20042 79 XSS 2019-12-27 2023-01-19
4.3
 None Remote Medium Not required None Partial None
In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.
46 CVE-2019-20008 79 XSS 2019-12-26 2020-01-02
3.5
 None Remote Medium ??? None Partial None
In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will result in stored XSS on the vulnerability-scan scheduling page.
47 CVE-2019-19979 352 XSS CSRF 2019-12-26 2020-08-24
6.8
 None Remote Medium Not required Partial Partial Partial
A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS.
48 CVE-2019-19916 79 XSS 2019-12-20 2020-01-14
4.3
 None Remote Medium Not required None Partial None
In Midori Browser 0.5.11 (on Windows 10), Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type. This could result in script running where CSP should have blocked it, allowing for cross-site scripting (XSS) and other attacks when the product renders the content as HTML. Remediating this would also need to consider the polyglot case, e.g., a file that is a valid GIF image and also valid JavaScript.
49 CVE-2019-19915 352 XSS CSRF 2019-12-19 2020-08-24
6.0
 None Remote Medium ??? Partial Partial Partial
The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.
50 CVE-2019-19910 79 XSS 2019-12-19 2019-12-31
4.3
 None Remote Medium Not required None Partial None
The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes, as demonstrated by IMG onmouseover= (impact is XSS) and IMG src=http (impact is disclosing the client's IP address). This can occur within a talk page topical header that is viewed within a mobile (MobileFrontend) context.
Total number of vulnerabilities : 2391   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.