Search
Total
13741 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-7913 | 1 Jetbrains | 1 Youtrack | 2020-01-31 | 4.3 MEDIUM | 6.1 MEDIUM |
| JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description. | |||||
| CVE-2013-3320 | 1 Netapp | 1 Oncommand System Manager | 2020-01-31 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site Scripting (XSS) vulnerability in NetApp OnCommand System Manager before 2.2 allows remote attackers to inject arbitrary web script or HTML via the 'full-name' and 'comment' fields. | |||||
| CVE-2020-8426 | 1 Elementor | 1 Elementor Page Builder | 2020-01-31 | 3.5 LOW | 5.4 MEDIUM |
| The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user. | |||||
| CVE-2012-5776 | 1 Dokeos | 1 Dokeos | 2020-01-31 | 3.5 LOW | 5.4 MEDIUM |
| Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php. | |||||
| CVE-2013-0738 | 1 Chamilo | 1 Chamilo | 2020-01-31 | 4.3 MEDIUM | 6.1 MEDIUM |
| Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php. | |||||
| CVE-2013-0739 | 1 Chamilo | 1 Chamilo | 2020-01-31 | 4.3 MEDIUM | 6.1 MEDIUM |
| Chamilo 1.9.4 has XSS due to improper validation of user-supplied input by the chat.php script. | |||||
| CVE-2013-0161 | 1 Havalite | 1 Havalite | 2020-01-30 | 3.5 LOW | 5.4 MEDIUM |
| Havalite CMS 1.1.7 has a stored XSS vulnerability | |||||
| CVE-2020-3715 | 1 Magento | 1 Magento | 2020-01-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | |||||
| CVE-2020-3758 | 1 Magento | 1 Magento | 2020-01-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | |||||
| CVE-2020-5226 | 1 Simplesamlphp | 1 Simplesamlphp | 2020-01-30 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp 1.18.0, a new SimpleSAML\Utils\EMail class was introduced to handle sending emails, implemented as a wrapper of an external dependency. This new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of the free-text field in www/errorreport.php was removed to avoid double escaping. However, for those not using the new user interface yet, an email template is hardcoded into the class itself in plain PHP. Since no escaping is provided in this template, it is then possible to inject HTML inside the template by manually crafting the contents of the free-text field. | |||||
| CVE-2012-6494 | 1 Rapid7 | 1 Nexpose | 2020-01-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Rapid7 Nexpose before 5.5.4 contains a session hijacking vulnerability which allows remote attackers to capture a user's session and gain unauthorized access. | |||||
| CVE-2013-6451 | 1 Mediawiki | 1 Mediawiki | 2020-01-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values. | |||||
| CVE-2013-2714 | 1 Podpress Project | 1 Podpress | 2020-01-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site Scripting (XSS) in WordPress podPress Plugin 8.8.10.13 could allow remote attackers to inject arbitrary web script or html via the 'playerID' parameter. | |||||
| CVE-2014-8490 | 1 Tennisconnect | 1 Components | 2020-01-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in TennisConnect COMPONENTS 9.927 allows remote attackers to inject arbitrary web script or HTML via the pid parameter to index.cfm. | |||||
| CVE-2020-2106 | 1 Jenkins | 1 Code Coverage Api | 2020-01-30 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations. | |||||
| CVE-2019-4632 | 1 Ibm | 1 Security Secret Server | 2020-01-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170004. | |||||
| CVE-2018-5376 | 1 Discuz | 1 Discuzx | 2020-01-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| Discuz! DiscuzX X3.4 has XSS via the include\spacecp\spacecp_upload.php op parameter. | |||||
| CVE-2012-6448 | 1 Cpanel | 1 Webhost Manager | 2020-01-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2013-4770 | 1 Eucalyptus | 1 Eucalyptus Management Console | 2020-01-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Eucalyptus Management Console (EMC) 4.0.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2020-8090 | 1 A1 | 2 Wlan Box Adb Vv2220, Wlan Box Adb Vv2220 Firmware | 2020-01-29 | 3.5 LOW | 4.8 MEDIUM |
| The Username field in the Storage Service settings of A1 WLAN Box ADB VV2220v2 devices allows stored XSS (after a successful Administrator login). | |||||
| CVE-2020-8091 | 1 Typo3 | 1 Typo3 | 2020-01-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname. | |||||
| CVE-2019-17651 | 1 Fortinet | 1 Fortisiem | 2020-01-29 | 3.5 LOW | 5.4 MEDIUM |
| An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious JavaScript code into the description field of a Device Maintenance schedule. | |||||
| CVE-2019-10779 | 1 Gchq | 1 Stroom | 2020-01-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| All versions of stroom:stroom-app before 5.5.12 and all versions of the 6.0.0 branch before 6.0.25 are affected by Cross-site Scripting. An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe, the attacker site can issue commands to the Stroom UI via an XSS vulnerability to take full control of the Stroom UI on behalf of the logged-in user. | |||||
| CVE-2020-1933 | 2 Apache, Mozilla | 2 Nifi, Firefox | 2020-01-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers. | |||||
| CVE-2019-15607 | 1 Nodered | 1 Node-red | 2020-01-29 | 3.5 LOW | 5.4 MEDIUM |
| A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc. | |||||
| CVE-2019-16024 | 1 Cisco | 2 Crosswork Change Automation, Crosswork Network Automation | 2020-01-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the web-based management interface of Cisco Crosswork Change Automation could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. | |||||
| CVE-2019-16008 | 1 Cisco | 38 Ip Phone 6821, Ip Phone 6821 Firmware, Ip Phone 6825 and 35 more | 2020-01-29 | 3.5 LOW | 5.4 MEDIUM |
| A vulnerability in the web-based GUI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based GUI of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. | |||||
| CVE-2019-15313 | 1 Zimbra | 1 Collaboration Server | 2020-01-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Zimbra Collaboration before 8.8.15 Patch 1, there is a non-persistent XSS vulnerability. | |||||
| CVE-2020-5223 | 1 Privatebin | 1 Privatebin | 2020-01-29 | 2.1 LOW | 4.4 MEDIUM |
| In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users. | |||||
| CVE-2020-7997 | 1 Asus | 2 Rt-ac66u, Rt-ac66u Firmware | 2020-01-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature. | |||||
| CVE-2019-10770 | 1 Ratpack | 1 Ratpack | 2020-01-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects the development mode error handler when an exception message contains untrusted data. Note the production mode error handler is not vulnerable - so for this to be utilized in production it would require users to not disable development mode. | |||||
| CVE-2013-0286 | 1 Pinboard Project | 1 Pinboard | 2020-01-29 | 3.5 LOW | 5.4 MEDIUM |
| Pinboard 1.0.6 theme for Wordpress has XSS. | |||||
| CVE-2019-15586 | 1 Gitlab | 1 Gitlab | 2020-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| A XSS exists in Gitlab CE/EE < 12.1.10 in the Mermaid plugin. | |||||
| CVE-2019-12427 | 1 Zimbra | 1 Collaboration Server | 2020-01-28 | 3.5 LOW | 4.8 MEDIUM |
| Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console. | |||||
| CVE-2019-8947 | 1 Zimbra | 1 Collaboration Server | 2020-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS. | |||||
| CVE-2019-8946 | 1 Zimbra | 1 Collaboration Server | 2020-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. | |||||
| CVE-2019-8945 | 1 Zimbra | 1 Collaboration Server | 2020-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS. | |||||
| CVE-2019-11318 | 1 Synacor | 1 Zimbra Collaboration Server | 2020-01-28 | 3.5 LOW | 5.4 MEDIUM |
| Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS. | |||||
| CVE-2015-2249 | 1 Synacor | 1 Zimbra Collaboration Server | 2020-01-28 | 3.5 LOW | 5.4 MEDIUM |
| Zimbra Collaboration before 8.6.0 patch5 has XSS. | |||||
| CVE-2014-5500 | 1 Synacor | 1 Zimbra Collaboration Server | 2020-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Synacor Zimbra Collaboration before 8.0.8 has XSS. | |||||
| CVE-2019-6036 | 1 F-revocrm | 1 F-revocrm | 2020-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2019-16015 | 1 Cisco | 1 Data Center Analytics Framework | 2020-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information on the affected system. | |||||
| CVE-2019-19592 | 1 Jamasoftware | 1 Connect | 2020-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting | |||||
| CVE-2020-3129 | 1 Cisco | 1 Unity Connection | 2020-01-28 | 3.5 LOW | 4.8 MEDIUM |
| A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by providing crafted data to a specific field within the interface. A successful exploit could allow the attacker to store an XSS attack within the interface. This stored XSS attack would then be executed on the system of any user viewing the attacker-supplied data element. | |||||
| CVE-2020-3136 | 1 Cisco | 1 Jabber Guest | 2020-01-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the web-based management interface of Cisco Jabber Guest could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because the web-based management interface of the affected device does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information. This vulnerability affects Cisco Jabber Guest releases 11.1(2) and earlier. | |||||
| CVE-2020-7989 | 1 Adive | 1 Framework | 2020-01-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| Adive Framework 2.0.8 has admin/user/add userUsername XSS. | |||||
| CVE-2020-7990 | 1 Adive | 1 Framework | 2020-01-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| Adive Framework 2.0.8 has admin/user/add userName XSS. | |||||
| CVE-2020-7249 | 1 Smc | 2 D3g0804, D3g0804 Firmware | 2020-01-27 | 3.5 LOW | 4.8 MEDIUM |
| SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a successful login to the admin account). | |||||
| CVE-2020-7996 | 1 Dolibarr | 1 Dolibarr | 2020-01-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header. | |||||
| CVE-2020-6843 | 1 Zohocorp | 1 Manageengine Servicedesk Plus | 2020-01-27 | 3.5 LOW | 4.8 MEDIUM |
| Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959. | |||||