Search
Total
13741 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-25520 | 1 Samsung | 1 Internet | 2021-12-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet. | |||||
| CVE-2021-4081 | 1 Pimcore | 1 Pimcore | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2020-25444 | 1 Bookingcore | 1 Booking Core | 2021-12-10 | 3.5 LOW | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) "About Yourself” section under the “My Profile” page, " (2) “Hotel Policy” field under the “Hotel Details” page, (3) “Pricing code” and “name” fields under the “Manage Tour” page, and (4) all the labels under the “Menu” section. | |||||
| CVE-2021-32718 | 1 Vmware | 1 Rabbitmq | 2021-12-10 | 3.5 LOW | 5.4 MEDIUM |
| RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, a new user being added via management UI could lead to the user's bane being rendered in a confirmation message without proper `<script>` tag sanitization, potentially allowing for JavaScript code execution in the context of the page. In order for this to occur, the user must be signed in and have elevated permissions (other user management). The vulnerability is patched in RabbitMQ 3.8.17. As a workaround, disable `rabbitmq_management` plugin and use CLI tools for management operations and Prometheus and Grafana for metrics and monitoring. | |||||
| CVE-2021-21043 | 1 Adobe | 1 Adobe Consulting Services Commons | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful. | |||||
| CVE-2021-43673 | 1 Dzzoffice | 1 Dzzoffice | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of the exit function is printed for the user via exit(json_encode($return)). | |||||
| CVE-2021-43682 | 1 Thinkphp-bjyblog Project | 1 Thinkphp-bjyblog | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. The exit function terminates the script and prints a message to the user that contains $_SERVER['HTTP_HOST']. | |||||
| CVE-2021-30157 | 3 Debian, Fedoraproject, Mediawiki | 3 Debian Linux, Fedora, Mediawiki | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS. | |||||
| CVE-2021-30154 | 3 Debian, Fedoraproject, Mediawiki | 3 Debian Linux, Fedora, Mediawiki | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS. | |||||
| CVE-2021-36188 | 1 Fortinet | 1 Fortiweb | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and error handlers | |||||
| CVE-2021-22220 | 1 Gitlab | 1 Gitlab | 2021-12-10 | 3.5 LOW | 5.4 MEDIUM |
| An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks. | |||||
| CVE-2021-43530 | 2 Google, Mozilla | 2 Android, Firefox | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a QR code. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 94. | |||||
| CVE-2021-43544 | 2 Google, Mozilla | 2 Android, Firefox | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the address bar might have caused the URL to load unintentionally, which could lead to XSS and spoofing attacks. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 95. | |||||
| CVE-2021-43692 | 1 Youtubephpmirroring Project | 1 Youtube-php-mirroring | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| youtube-php-mirroring (last update Jun 9, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in file ytproxy/index.php. | |||||
| CVE-2021-43697 | 1 Workerman-thinkphp-redis Project | 1 Workerman-thinkphp-redis | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file Controller.class.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET{C('VAR_JSONP_HANDLER')] then there is a XSS vulnerability. | |||||
| CVE-2021-43696 | 1 Twmap Project | 1 Twmap | 2021-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| twmap v2.91_v4.33 is affected by a Cross Site Scripting (XSS) vulnerability. In file list.php, the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST then there is a XSS vulnerability. | |||||
| CVE-2021-4050 | 1 Livehelperchat | 1 Live Helper Chat | 2021-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2021-43063 | 1 Fortinet | 1 Fortiweb | 2021-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage. | |||||
| CVE-2021-41015 | 1 Fortinet | 1 Fortiweb | 2021-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler | |||||
| CVE-2021-42752 | 1 Fortinet | 1 Fortiwlm | 2021-12-09 | 3.5 LOW | 5.4 MEDIUM |
| A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute malicious javascript code on victim's host via crafted HTTP requests | |||||
| CVE-2021-43810 | 1 Admidio | 1 Admidio | 2021-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious scripts. This issue is patched in version 4.0.12. | |||||
| CVE-2021-41029 | 1 Fortinet | 1 Fortiwlm | 2021-12-09 | 3.5 LOW | 5.4 MEDIUM |
| A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests | |||||
| CVE-2021-42567 | 1 Apereo | 1 Central Authentication Service | 2021-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints. | |||||
| CVE-2021-36760 | 1 Wso2 | 4 Api Manager, Identity Server, Identity Server As Key Manager and 1 more | 2021-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.) | |||||
| CVE-2021-44148 | 1 Gl-inet | 2 Gl-ar150, Gl-ar150 Firmware | 2021-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name. | |||||
| CVE-2021-3370 | 1 Douco | 1 Douphp | 2021-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| DouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud.php. | |||||
| CVE-2021-29002 | 1 Plone | 1 Plone | 2021-12-08 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter. | |||||
| CVE-2021-28796 | 1 Increments | 1 Qiita\ | 2021-12-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| Increments Qiita::Markdown before 0.33.0 allows XSS in transformers. | |||||
| CVE-2021-30458 | 1 Wikimedia | 1 Parsoid | 2021-12-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS. | |||||
| CVE-2021-43808 | 1 Laravel | 1 Framework | 2021-12-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed. This vulnerability has been patched in versions 8.75.0, 7.30.6, and 6.20.42 by determining the parent placeholder at runtime and using a random hash that is unique to each request. | |||||
| CVE-2020-27356 | 1 Debug Meta Data Project | 1 Debug Meta Data | 2021-12-08 | 3.5 LOW | 5.4 MEDIUM |
| The debug-meta-data plugin 1.1.2 for WordPress allows XSS. | |||||
| CVE-2021-44726 | 1 Knime | 1 Knime Server | 2021-12-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| KNIME Server before 4.13.4 allows XSS via the old WebPortal login page. | |||||
| CVE-2020-22421 | 1 74cms | 1 74cms | 2021-12-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| 74CMS v6.0.4 was discovered to contain a cross-site scripting (XSS) vulnerability via /index.php?m=&c=help&a=help_list&key. | |||||
| CVE-2021-27190 | 1 Peel | 1 Peel Shopping | 2021-12-07 | 3.5 LOW | 5.4 MEDIUM |
| A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc. | |||||
| CVE-2021-24768 | 1 Wprssaggregator | 1 Wp Rss Aggregator | 2021-12-07 | 3.5 LOW | 4.8 MEDIUM |
| The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues. | |||||
| CVE-2020-19611 | 1 Racktables Project | 1 Racktables | 2021-12-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter. | |||||
| CVE-2021-40094 | 1 Squaredup | 1 Squaredup | 2021-12-07 | 3.5 LOW | 5.4 MEDIUM |
| A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device. | |||||
| CVE-2021-40093 | 1 Squaredup | 1 Squaredup | 2021-12-07 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via dashboard actions. | |||||
| CVE-2021-40092 | 1 Squaredup | 1 Squaredup | 2021-12-07 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an SVG file. | |||||
| CVE-2021-24930 | 1 Bookly Project | 1 Bookly | 2021-12-07 | 3.5 LOW | 5.4 MEDIUM |
| The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue | |||||
| CVE-2021-25041 | 1 10web | 1 Photo Gallery | 2021-12-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action | |||||
| CVE-2021-28957 | 5 Debian, Fedoraproject, Lxml and 2 more | 5 Debian Linux, Fedora, Lxml and 2 more | 2021-12-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3. | |||||
| CVE-2021-24939 | 1 Profilepress | 1 Loginwp | 2021-12-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue | |||||
| CVE-2021-24935 | 1 Wp Google Fonts Project | 1 Wp Google Fonts | 2021-12-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues | |||||
| CVE-2021-24938 | 1 Woocommerce | 1 Woocommerce Currency Switcher | 2021-12-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue | |||||
| CVE-2021-24714 | 1 Soflyy | 1 Wp All Import | 2021-12-06 | 3.5 LOW | 4.8 MEDIUM |
| The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2016-10925 | 1 Profilepress | 1 Loginwp | 2021-12-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs. | |||||
| CVE-2021-24718 | 1 Reputeinfosystems | 1 Contact Form\, Survey \& Popup Form Plugin For Wordpress - Arforms Form Builder | 2021-12-06 | 3.5 LOW | 4.8 MEDIUM |
| The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-24759 | 1 Pdf.js Viewer Project | 1 Pdf.js Viewer | 2021-12-06 | 3.5 LOW | 5.4 MEDIUM |
| The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, which could allow users with a role as low as Contributor to to perform Cross-Site Scripting attacks | |||||
| CVE-2021-24924 | 1 Email Log Project | 1 Email Log | 2021-12-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue | |||||