Search
Total
13741 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-25933 | 1 Opennms | 2 Horizon, Meridian | 2021-05-26 | 3.5 LOW | 4.8 MEDIUM |
| In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms. | |||||
| CVE-2021-25929 | 1 Opennms | 2 Horizon, Meridian | 2021-05-26 | 3.5 LOW | 4.8 MEDIUM |
| In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files. | |||||
| CVE-2021-32561 | 1 Octoprint | 1 Octoprint | 2021-05-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters. | |||||
| CVE-2021-24245 | 1 Trumani | 1 Stop Spammers | 2021-05-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue. | |||||
| CVE-2021-3536 | 1 Redhat | 9 Build Of Quarkus, Data Grid, Descision Manager and 6 more | 2021-05-26 | 3.5 LOW | 4.8 MEDIUM |
| A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity. | |||||
| CVE-2021-3012 | 1 Esri | 1 Arcgis Enterprise | 2021-05-26 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab). | |||||
| CVE-2021-20374 | 1 Ibm | 1 Maximo Asset Management | 2021-05-26 | 3.5 LOW | 5.4 MEDIUM |
| IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195522. | |||||
| CVE-2021-29625 | 1 Adminer | 1 Adminer | 2021-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Adminer is open-source database management software. A cross-site scripting vulnerability in Adminer versions 4.6.1 to 4.8.0 affects users of MySQL, MariaDB, PgSQL and SQLite. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected. The vulnerability is patched in version 4.8.1. As workarounds, one can use a browser supporting strict CSP or enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`). | |||||
| CVE-2020-21053 | 1 Fusionpbx | 1 Fusionpbx | 2021-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "query_string" variable in app\devices\device_imports.php. | |||||
| CVE-2021-20528 | 1 Ibm | 1 Control Center | 2021-05-25 | 3.5 LOW | 5.4 MEDIUM |
| IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198761. | |||||
| CVE-2020-21054 | 1 Fusionpbx | 1 Fusionpbx | 2021-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variable in app\vars\vars_textarea.php. | |||||
| CVE-2021-3313 | 1 Plone | 1 Plone | 2021-05-25 | 3.5 LOW | 5.4 MEDIUM |
| Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload. | |||||
| CVE-2020-21345 | 1 Halo | 1 Halo | 2021-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code. | |||||
| CVE-2021-20386 | 1 Ibm | 1 Security Guardium | 2021-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195767. | |||||
| CVE-2021-31930 | 1 Concerto-signage | 1 Concerto | 2021-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the account, the XSS payload will be executed. | |||||
| CVE-2021-33041 | 1 Vmd Project | 1 Vmd | 2021-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS. | |||||
| CVE-2021-29051 | 1 Liferay | 2 Dxp, Liferay Portal | 2021-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter. | |||||
| CVE-2021-29048 | 1 Liferay | 2 Dxp, Liferay Portal | 2021-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_name parameter. | |||||
| CVE-2018-1190 | 2 Cloudfoundry, Pivotal | 3 Cf-release, Uaa, Uaa Bosh | 2021-05-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management. | |||||
| CVE-2021-29046 | 1 Liferay | 2 Dxp, Liferay Portal | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter. | |||||
| CVE-2021-29045 | 1 Liferay | 2 Dxp, Liferay Portal | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_destinationURL parameter. | |||||
| CVE-2021-29044 | 1 Liferay | 2 Dxp, Liferay Portal | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter. | |||||
| CVE-2020-24026 | 1 Tinyshop Project | 1 Tinyshop | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| TinyShop, a free and open source mall based on RageFrame2, has a stored XSS vulnerability that affects version 1.2.0. TinyShop allows XSS via the explain_first and again_explain parameters of the /evaluate/index.php page. The vulnerability may be exploited remotely, resulting in cross-site scripting (XSS) or information disclosure. | |||||
| CVE-2021-29039 | 1 Liferay | 1 Liferay Portal | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name. | |||||
| CVE-2021-24299 | 1 Catzsoft | 1 Redi Restaurant Reservation | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded. | |||||
| CVE-2021-24292 | 1 Wedevs | 1 Happy Addons For Elementor | 2021-05-24 | 3.5 LOW | 5.4 MEDIUM |
| The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter. | |||||
| CVE-2021-24315 | 1 Givewp | 1 Give | 2021-05-24 | 3.5 LOW | 4.8 MEDIUM |
| The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues. | |||||
| CVE-2021-33513 | 1 Plone | 1 Plone | 2021-05-24 | 3.5 LOW | 5.4 MEDIUM |
| Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. | |||||
| CVE-2021-33512 | 1 Plone | 1 Plone | 2021-05-24 | 3.5 LOW | 5.4 MEDIUM |
| Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. | |||||
| CVE-2021-33508 | 1 Plone | 1 Plone | 2021-05-24 | 3.5 LOW | 5.4 MEDIUM |
| Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item. | |||||
| CVE-2021-24323 | 1 Woocommerce | 1 Woocommerce | 2021-05-24 | 3.5 LOW | 4.8 MEDIUM |
| When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled | |||||
| CVE-2021-24290 | 1 De-baat | 1 Store Locator Plus | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages. | |||||
| CVE-2020-24993 | 1 Cmswing | 1 Cmswing | 2021-05-24 | 3.5 LOW | 5.4 MEDIUM |
| There is a cross site scripting vulnerability on CmsWing 1.3.7. This vulnerability (stored XSS) is triggered when visitors access the article module. | |||||
| CVE-2021-24327 | 1 Clogica | 1 Seo Redirection Plugin | 2021-05-24 | 3.5 LOW | 4.8 MEDIUM |
| The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users (even with the unfiltered_html disabled) to set XSS payloads | |||||
| CVE-2019-10062 | 1 Bluespire | 1 Aurelia Framework | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed by splitting and nesting them for example. | |||||
| CVE-2021-24326 | 1 Clogica | 1 All 404 Redirect To Homepage | 2021-05-24 | 3.5 LOW | 5.4 MEDIUM |
| The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issue as user input was not properly sanitised before being output in an attribute. | |||||
| CVE-2021-24325 | 1 Clogica | 1 Seo Redirection Plugin | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as user input is not properly sanitised or escaped before being output in an attribute. | |||||
| CVE-2020-19924 | 1 Issuehunt | 1 Boostnote | 2021-05-24 | 3.5 LOW | 5.4 MEDIUM |
| In Boostnote 0.12.1, exporting to PDF contains opportunities for XSS attacks. | |||||
| CVE-2020-18194 | 1 Emlog | 1 Emlog | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post. | |||||
| CVE-2020-29205 | 1 Projectworlds | 1 Travel Management System | 2021-05-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field | |||||
| CVE-2020-24992 | 1 Cmswing | 1 Cmswing | 2021-05-24 | 3.5 LOW | 5.4 MEDIUM |
| There is a cross site scripting vulnerability on CmsWing 1.3.7. This vulnerability (stored XSS) is triggered when an administrator accesses the content management module. | |||||
| CVE-2021-24291 | 1 10web | 1 Photo Gallery | 2021-05-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users) | |||||
| CVE-2021-24277 | 1 Wpuslugi | 1 Rss For Yandex Turbo | 2021-05-21 | 3.5 LOW | 5.4 MEDIUM |
| The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues | |||||
| CVE-2021-24283 | 1 Pickplugins | 1 Accordion | 2021-05-21 | 3.5 LOW | 5.4 MEDIUM |
| The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue. | |||||
| CVE-2021-32573 | 1 Express-cart Project | 1 Express-cart | 2021-05-21 | 3.5 LOW | 4.8 MEDIUM |
| ** DISPUTED ** The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website." | |||||
| CVE-2021-24271 | 1 Brainstormforce | 1 Ultimate Addons For Elementor | 2021-05-21 | 3.5 LOW | 5.4 MEDIUM |
| The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method. | |||||
| CVE-2020-18167 | 1 Laobancms | 1 Laobancms | 2021-05-21 | 3.5 LOW | 4.8 MEDIUM |
| Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu". | |||||
| CVE-2020-23689 | 1 Yfcmf | 1 Yfcmf | 2021-05-21 | 3.5 LOW | 4.8 MEDIUM |
| In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page. | |||||
| CVE-2020-17891 | 1 Tp-link | 2 Archer C1200, Archer C1200 Firmware | 2021-05-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| TP-Link Archer C1200 firmware version 1.13 Build 2018/01/24 rel.52299 EU has a XSS vulnerability allowing a remote attacker to execute arbitrary code. | |||||
| CVE-2020-16632 | 1 Dedecms | 1 Dedecms | 2021-05-21 | 3.5 LOW | 5.4 MEDIUM |
| A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter. | |||||