Search
Total
20468 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-20139 | 1 Flexmonster | 1 Pivot Table \& Charts | 2020-12-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17. | |||||
| CVE-2020-20142 | 1 Flexmonster | 1 Pivot Table \& Charts | 2020-12-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table & Charts 2.7.17. | |||||
| CVE-2019-16955 | 1 Solarwinds | 1 Webhelpdesk | 2020-12-18 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request. | |||||
| CVE-2019-16957 | 1 Solarwinds | 1 Webhelpdesk | 2020-12-18 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account. | |||||
| CVE-2019-11776 | 1 Eclipse | 1 Business Intelligence And Reporting Tools | 2020-12-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context. | |||||
| CVE-2020-35416 | 1 Stivasoft | 1 Phpjabbers Appointment Scheduler | 2020-12-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request parameters), allows remote attackers to inject arbitrary web script or HTML. | |||||
| CVE-2020-4845 | 1 Ibm | 1 Security Key Lifecycle Manager | 2020-12-17 | 3.5 LOW | 5.4 MEDIUM |
| IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190289. | |||||
| CVE-2020-4657 | 5 Hp, Ibm, Linux and 2 more | 7 Hp-ux, Aix, I and 4 more | 2020-12-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186094. | |||||
| CVE-2020-4658 | 5 Hp, Ibm, Linux and 2 more | 7 Hp-ux, Aix, I and 4 more | 2020-12-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM Sterling File Gateway 2.2.0.0 through 6.0.3.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186095. | |||||
| CVE-2018-16243 | 1 Solarwinds | 1 Database Performance Analyzer | 2020-12-17 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen, userAdministration.iwc, database.iwc, alertManagement.iwc, eventAnnotations.iwc, and central.cen. | |||||
| CVE-2019-14478 | 1 Adremsoft | 1 Netcrunch | 2020-12-17 | 3.5 LOW | 5.4 MEDIUM |
| AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript code in the context of the user's browser if the victim opens or searches for a node whose "Display Name" contains an XSS payload. | |||||
| CVE-2020-28930 | 1 Epson | 2 Eps Tse Server 8, Eps Tse Server 8 Firmware | 2020-12-17 | 3.5 LOW | 5.4 MEDIUM |
| A Cross-Site Scripting (XSS) issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 (21.0.11) allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator. | |||||
| CVE-2020-23957 | 1 Pega | 1 Pega Platform | 2020-12-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI. | |||||
| CVE-2020-28457 | 1 S-cart | 1 S-cart | 2020-12-16 | 3.5 LOW | 4.8 MEDIUM |
| This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS. | |||||
| CVE-2020-35395 | 1 Egavilanmedia | 1 Expense Management System | 2020-12-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS in the Add Expense Component of EGavilan Media Expense Management System 1.0 allows an attacker to permanently store malicious JavaScript code via the 'description' field | |||||
| CVE-2020-35396 | 1 Egavilanmedia | 1 Barcodes Generator | 2020-12-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting (XSS) via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website. | |||||
| CVE-2019-14670 | 1 Firefly-iii | 1 Firefly Iii | 2020-12-16 | 3.5 LOW | 5.4 MEDIUM |
| Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation. | |||||
| CVE-2019-14672 | 1 Firefly-iii | 1 Firefly Iii | 2020-12-16 | 3.5 LOW | 5.4 MEDIUM |
| Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page. | |||||
| CVE-2019-14668 | 1 Firefly-iii | 1 Firefly Iii | 2020-12-16 | 3.5 LOW | 5.4 MEDIUM |
| Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link. | |||||
| CVE-2019-14669 | 1 Firefly-iii | 1 Firefly Iii | 2020-12-16 | 3.5 LOW | 5.4 MEDIUM |
| Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page. | |||||
| CVE-2019-14667 | 1 Firefly-iii | 1 Firefly Iii | 2020-12-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action. | |||||
| CVE-2020-28456 | 1 S-cart | 1 S-cart | 2020-12-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel. | |||||
| CVE-2020-10012 | 1 Apple | 1 Macos | 2020-12-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously crafted document may lead to a cross site scripting attack. | |||||
| CVE-2020-29304 | 1 Directoriespro | 1 Directories Pro | 2020-12-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim is proceeding through the file import workflow. | |||||
| CVE-2020-29303 | 1 Directoriespro | 1 Directories Pro | 2020-12-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with _drts_form_build_id parameter containing the XSS payload and _t_ parameter set to an invalid or non-existent CSRF token. | |||||
| CVE-2019-19284 | 1 Siemens | 1 Xhq | 2020-12-15 | 3.5 LOW | 5.4 MEDIUM |
| A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify content of particular web pages, causing the application to behave in unexpected ways for legitimate users. | |||||
| CVE-2019-19288 | 1 Siemens | 1 Xhq | 2020-12-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. | |||||
| CVE-2020-35199 | 1 Igniterealtime | 1 Openfire | 2020-12-15 | 3.5 LOW | 5.4 MEDIUM |
| Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS. | |||||
| CVE-2020-35201 | 1 Igniterealtime | 1 Openfire | 2020-12-15 | 3.5 LOW | 5.4 MEDIUM |
| Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS. | |||||
| CVE-2020-35202 | 1 Igniterealtime | 1 Openfire | 2020-12-15 | 3.5 LOW | 5.4 MEDIUM |
| Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS. | |||||
| CVE-2020-28859 | 1 Openasset | 1 Digital Asset Management | 2020-12-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks. | |||||
| CVE-2020-28857 | 1 Openasset | 1 Digital Asset Management | 2020-12-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| OpenAsset Digital Asset Management (DAM) through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for stored cross-site scripting attacks. | |||||
| CVE-2020-35200 | 1 Igniterealtime | 1 Openfire | 2020-12-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS. | |||||
| CVE-2020-5948 | 1 F5 | 11 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 8 more | 2020-12-14 | 6.8 MEDIUM | 9.6 CRITICAL |
| On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. | |||||
| CVE-2020-29455 | 1 Smartystreets | 1 Liveaddressplugin.js | 2020-12-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country). | |||||
| CVE-2020-35126 | 1 Typesettercms | 1 Typesetter | 2020-12-14 | 3.5 LOW | 4.8 MEDIUM |
| ** DISPUTED ** Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because "admins are considered trustworthy." | |||||
| CVE-2020-26407 | 1 Gitlab | 1 Gitlab | 2020-12-11 | 3.5 LOW | 5.4 MEDIUM |
| A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project | |||||
| CVE-2020-35127 | 1 Igniterealtime | 1 Openfire | 2020-12-11 | 3.5 LOW | 5.4 MEDIUM |
| Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS. | |||||
| CVE-2020-2229 | 1 Jenkins | 1 Jenkins | 2020-12-11 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability. | |||||
| CVE-2020-2230 | 1 Jenkins | 1 Jenkins | 2020-12-11 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission. | |||||
| CVE-2020-16608 | 1 Notable | 1 Notable | 2020-12-11 | 9.3 HIGH | 9.6 CRITICAL |
| Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true). | |||||
| CVE-2020-2493 | 1 Qnap | 1 Multimedia Console | 2020-12-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later. | |||||
| CVE-2020-2491 | 1 Qnap | 2 Photo Station, Qts | 2020-12-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later | |||||
| CVE-2020-29259 | 1 Online Examination System Project | 1 Online Examination System | 2020-12-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the subject or feedback parameter to feedback.php. | |||||
| CVE-2020-25955 | 1 Student Management System Project In Php Project | 1 Student Management System Project In Php | 2020-12-10 | 3.5 LOW | 5.4 MEDIUM |
| SourceCodester Student Management System Project in PHP version 1.0 is vulnerable to stored a cross-site scripting (XSS) via the 'add subject' tab. | |||||
| CVE-2020-26835 | 1 Sap | 1 Netweaver As Abap | 2020-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in the URL which could be executed in the browser resulting in Reflected Cross-Site Scripting (XSS) vulnerability. | |||||
| CVE-2020-10146 | 1 Microsoft | 1 Teams | 2020-12-10 | 3.5 LOW | 5.4 MEDIUM |
| The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020. | |||||
| CVE-2020-26249 | 1 Cogboard | 1 Red-dashboard | 2020-12-10 | 3.5 LOW | 8.7 HIGH |
| Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This high severity exploit has been fixed on version 0.1.7a. There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue. | |||||
| CVE-2020-25627 | 1 Moodle | 1 Moodle | 2020-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2. | |||||
| CVE-2020-14206 | 1 Divebook Project | 1 Divebook | 2020-12-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter). | |||||