WordPress Qwizcards plugin <= 3.36 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by Ricardo Sanchez in WordPress Qwizcards plugin versions = 3.36. Solution 10 September 2019 - we were unable to find a patched version of this plugin...

WordPress Ellipsis Human Presence Technology 2.0.8 Cross Site Scripting

Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Ellipsis human presence technology 2.0.8 Ellipsis human presence technology is prone to a reflected cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage...

Greenbone OS 5.0.x < 5.0.10 XSS Vulnerability - Version Check

Greenbone OS is prone to a reflected cross-site scripting XSS vulnerability in the Greenbone Security Assistant GSA web user interface. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

WordPress Portrait-Archiv.com Photostore 5.0.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications WordPress Portrait-Archiv.com Photostore 5.0.4 Cross Site Scripting Vulnerability Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Portrait-Archiv.com Photostore 5.0.4 Portrait-Archiv.com is prone to a reflected...

CVE-2019-6181

A reflected cross-site scripting XSS vulnerability was reported in Lenovo XClarity Administrator LXCA versions prior to 2.5.0 that could allow a crafted URL, if visited, to cause JavaScript code to be executed in the user's web browser. The JavaScript code is not executed on LXCA itself...

CVE-2019-6181

Lenovo XClarity Administrator (LXCA) – CVE-2019-6181 – is a reflected XSS vulnerability present in LXCA versions prior to 2.5.0. A crafted URL can cause JavaScript to execute in the user’s browser, while the JavaScript code is not executed on LXCA itself. The issue is addressed by updating LXCA t...

PT-2019-18009 · Lenovo · Lenovo Xclarity Administrator

Name of the Vulnerable Software and Affected Versions: Lenovo XClarity Administrator versions prior to 2.5.0 Description: A reflected cross-site scripting issue was reported that could allow a crafted URL to cause JavaScript code to be executed in the user's web browser. The JavaScript code is no...

CVE-2019-13407

A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly...

CVE-2019-15501

Reflected cross site scripting XSS in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter...

WordPress Plugin UserPro 4.9.32 - Cross-Site Scripting

Exploit Title: UserPro https://github.com/cosenary/Instagram-PHP-API/blob/master/example/success.phpL36 Proof-of-Concept: https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&errordescription=...

CVE-2019-0337

Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting XSS vulnerability...

CVE-2019-0337

Java Proxy Runtime of SAP NetWeaver Process Integration, versions 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs and allows an attacker to execute malicious scripts in the url thereby resulting in Reflected Cross-Site Scripting XSS vulnerability...

Security Bulletin: IBM Cloud Private is Vulnerable to Reflected Cross-Site Scripting attacks (CVE-2019-4120)

Summary IBM Cloud Private is vulnerable to reflected cross-site scripting attacks. Vulnerability Details CVEID: CVE-2019-4120 DESCRIPTION: IBM Cloud Private is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

CVE-2019-10376

A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin...

CVE-2019-7887

A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is...

CVE-2019-7862

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2...

CVE-2019-7887

A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is...

Cross site scripting

A Reflected Cross-site Scripting XSS vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting XSS. The mitigation for this vulnerability is to upgrade to the latest version of...

PT-2019-13425 · Ping Identity · Ping Identity Agentless Integration Kit

Name of the Vulnerable Software and Affected Versions: Ping Identity Agentless Integration Kit versions prior to 1.5 Description: The issue is related to a Reflected Cross-site Scripting XSS problem. There is no information provided about the estimated number of potentially affected devices...

CVE-2019-6626

On BIG-IP AFM, Analytics, ASM 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.3.4, A reflected cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface TMUI, also known as the Configuration utility...