Search
Total
20468 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-15273 | 1 Basercms | 1 Basercms | 2020-11-03 | 3.5 LOW | 8.1 HIGH |
| baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1. | |||||
| CVE-2020-15276 | 1 Basercms | 1 Basercms | 2020-11-03 | 3.5 LOW | 8.7 HIGH |
| baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1. | |||||
| CVE-2020-23989 | 1 Nedi | 1 Nedi | 2020-11-03 | 3.5 LOW | 5.4 MEDIUM |
| NeDi 1.9C allows pwsec.php oid XSS. | |||||
| CVE-2020-23868 | 1 Nedi | 1 Nedi | 2020-11-03 | 3.5 LOW | 5.4 MEDIUM |
| NeDi 1.9C allows inc/rt-popup.php d XSS. | |||||
| CVE-2020-8262 | 1 Pulsesecure | 2 Pulse Connect Secure, Pulse Policy Secure | 2020-11-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface. | |||||
| CVE-2020-21266 | 1 Broadleafcommerce | 1 Broadleaf Commerce | 2020-11-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting (XSS) due to a slow HTTP post vulnerability. | |||||
| CVE-2020-15676 | 1 Mozilla | 3 Firefox, Firefox Esr, Thunderbird | 2020-11-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. | |||||
| CVE-2020-10803 | 2 Debian, Phpmyadmin | 2 Debian Linux, Phpmyadmin | 2020-11-02 | 3.5 LOW | 5.4 MEDIUM |
| In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results (in tbl_get_field.php and libraries/classes/Display/Results.php). The attacker must be able to insert crafted data into certain database tables, which when retrieved (for instance, through the Browse tab) can trigger the XSS attack. | |||||
| CVE-2019-11556 | 1 Redhat | 1 Pagure | 2020-11-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Pagure before 5.6 allows XSS via the templates/blame.html blame view. | |||||
| CVE-2018-19951 | 1 Qnap | 2 Music Station, Qts | 2020-11-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11. | |||||
| CVE-2018-19954 | 1 Qnap | 1 Photo Station | 2020-11-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. | |||||
| CVE-2018-19955 | 1 Qnap | 1 Photo Station | 2020-11-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. | |||||
| CVE-2018-19956 | 1 Qnap | 1 Photo Station | 2020-11-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. | |||||
| CVE-2020-24712 | 1 Getgophish | 1 Gophish | 2020-10-30 | 3.5 LOW | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page. | |||||
| CVE-2020-15274 | 1 Requarks | 1 Wiki.js | 2020-10-30 | 3.5 LOW | 5.4 MEDIUM |
| In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit a57d9af34c15adbf460dde6553d964efddf433de fixes this vulnerability (version 2.5.162) by properly escaping the text content displayed in the search results. | |||||
| CVE-2020-6876 | 1 Zte | 1 Evdc | 2020-10-30 | 3.5 LOW | 5.4 MEDIUM |
| A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEB module. By inserting malicious scripts into the web module, a remote attacker could trigger an XSS attack when the user browses the web page. Then the attacker could use the vulnerability to steal user cookies or destroy the page structure. This affects: eVDC ZXCLOUD-iROSV6.03.04 | |||||
| CVE-2020-16140 | 1 Thembay | 1 Greenmart | 2020-10-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS. | |||||
| CVE-2020-3997 | 1 Vmware | 1 Horizon | 2020-10-30 | 3.5 LOW | 5.4 MEDIUM |
| VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed. | |||||
| CVE-2019-8762 | 1 Apple | 6 Icloud, Ipad Os, Iphone Os and 3 more | 2020-10-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| A validation issue was addressed with improved logic. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPadOS 13.1, iCloud for Windows 10.7, tvOS 13, iCloud for Windows 7.14, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to universal cross site scripting. | |||||
| CVE-2015-8766 | 1 Getsymphony | 1 Symphony | 2020-10-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in content/content.systempreferences.php in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) email_sendmail[from_name], (2) email_sendmail[from_address], (3) email_smtp[from_name], (4) email_smtp[from_address], (5) email_smtp[host], (6) email_smtp[port], (7) jit_image_manipulation[trusted_external_sites], or (8) maintenance_mode[ip_whitelist] parameters to system/preferences. | |||||
| CVE-2015-8606 | 1 Silverstripe | 1 Silverstripe | 2020-10-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm. | |||||
| CVE-2019-20434 | 1 Wso2 | 1 Api Manager | 2020-10-29 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Datasource creation page of the Management Console. | |||||
| CVE-2019-20437 | 1 Wso2 | 2 Api Manager, Identity Server | 2020-10-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration, that payload gets executed, if a user picks up that dialect's URI as the provisioning claim in the advanced claim configuration of the same Identity Provider. The attacker also needs to have privileges to log in to the management console, and to add and update identity provider configurations. | |||||
| CVE-2019-19306 | 1 Zoho | 1 Lead Magnet | 2020-10-29 | 3.5 LOW | 5.4 MEDIUM |
| The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName. | |||||
| CVE-2019-20436 | 1 Wso2 | 2 Api Manager, Identity Server | 2020-10-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI, and a user picks up this dialect's URI and adds it as the service provider claim dialect while configuring the service provider, that payload gets executed. The attacker also needs to have privileges to log in to the management console, and to add and configure claim dialects. | |||||
| CVE-2019-20435 | 1 Wso2 | 1 Api Manager | 2020-10-29 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in WSO2 API Manager 2.6.0. A reflected XSS attack could be performed in the inline API documentation editor page of the API Publisher by sending an HTTP GET request with a harmful docName request parameter. | |||||
| CVE-2020-24709 | 1 Getgophish | 1 Gophish | 2020-10-29 | 3.5 LOW | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. | |||||
| CVE-2020-24708 | 1 Getgophish | 1 Gophish | 2020-10-29 | 3.5 LOW | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. | |||||
| CVE-2019-20439 | 1 Wso2 | 1 Api Manager | 2020-10-29 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in defining a scope in the "manage the API" page of the API Publisher. | |||||
| CVE-2020-4731 | 1 Ibm | 1 Aspera Shares | 2020-10-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM Aspera Web Application 1.9.14 PL1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188055. | |||||
| CVE-2019-8753 | 1 Apple | 4 Iphone Os, Mac Os X, Tvos and 1 more | 2020-10-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15, watchOS 6, iOS 13, tvOS 13. Processing maliciously crafted web content may lead to a cross site scripting attack. | |||||
| CVE-2020-27608 | 1 Bigbluebutton | 1 Bigbluebutton | 2020-10-29 | 4.3 MEDIUM | 6.1 MEDIUM |
| In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document. | |||||
| CVE-2020-3515 | 1 Cisco | 1 Firepower Management Center | 2020-10-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. | |||||
| CVE-2020-14445 | 1 Wso2 | 2 Identity Server, Identity Server As Key Manager | 2020-10-28 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Basic Policy Editor user Interface. | |||||
| CVE-2020-14444 | 1 Wso2 | 2 Identity Server, Identity Server As Key Manager | 2020-10-28 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Policy Administration user interface. | |||||
| CVE-2020-3553 | 1 Cisco | 1 Firepower Management Center | 2020-10-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. | |||||
| CVE-2020-12779 | 1 Combodo | 1 Itop | 2020-10-28 | 3.5 LOW | 5.4 MEDIUM |
| Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script. | |||||
| CVE-2019-13633 | 1 Blinger | 1 Blinger | 2020-10-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can send arbitrary JavaScript code via a built-in communication channel, such as Telegram, WhatsApp, Viber, Skype, Facebook, Vkontakte, or Odnoklassniki. This is mishandled within the administration panel for conversations/all, conversations/inbox, conversations/unassigned, and conversations/closed. | |||||
| CVE-2020-25470 | 1 Antsword Project | 1 Antsword | 2020-10-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site, an XSS payload can be injected in cookies view which can lead to remote code execution. | |||||
| CVE-2020-27388 | 1 Yourls | 1 Yourls | 2020-10-28 | 3.5 LOW | 5.4 MEDIUM |
| Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues. | |||||
| CVE-2020-5650 | 1 Tipsandtricks-hq | 1 Simple Download Monitor | 2020-10-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors. | |||||
| CVE-2020-18766 | 1 Antsword Project | 1 Antsword | 2020-10-27 | 6.8 MEDIUM | 9.6 CRITICAL |
| A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands. | |||||
| CVE-2020-27642 | 1 Bigbluebutton | 1 Greenlight | 2020-10-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6. | |||||
| CVE-2018-8062 | 1 Comtrend | 2 Ar-5387un, Ar-5387un Firmware | 2020-10-27 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04_R02.A2pD035g.d23i firmware allows remote attackers to inject arbitrary web script or HTML via the Service Description parameter while creating a WAN service. | |||||
| CVE-2020-26584 | 1 Sagedpw | 1 Sage Dpw | 2020-10-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. The search field "Kurs suchen" on the page Kurskatalog is vulnerable to Reflected XSS. If the attacker can lure a user into clicking a crafted link, he can execute arbitrary JavaScript code in the user's browser. The vulnerability can be used to change the contents of the displayed site, redirect to other sites, or steal user credentials. Additionally, users are potential victims of browser exploits and JavaScript malware. | |||||
| CVE-2020-13893 | 1 Sage | 1 Easypay | 2020-10-27 | 3.5 LOW | 5.4 MEDIUM |
| Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations (Best-fit Mapping), as demonstrated by the full-width variants of the less-than sign (%EF%BC%9C) and greater-than sign (%EF%BC%9E). | |||||
| CVE-2020-1673 | 1 Juniper | 1 Junos | 2020-10-27 | 7.6 HIGH | 8.8 HIGH |
| Insufficient Cross-Site Scripting (XSS) protection in Juniper Networks J-Web and web based (HTTP/HTTPS) services allows an unauthenticated attacker to hijack the target user's HTTP/HTTPS session and perform administrative actions on the Junos device as the targeted user. This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled such as J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP). Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf In order to successfully exploit this vulnerability, the attacker needs to convince the device administrator to take action such as clicking the crafted URL sent via phishing email or convince the administrator to input data in the browser console. This issue affects Juniper Networks Junos OS: 18.1 versions prior to 18.1R3-S1; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R2-S5, 18.4R3-S2; 19.1 versions prior to 19.1R2-S2, 19.1R3-S1; 19.2 versions prior to 19.2R1-S5, 19.2R2; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2; 20.1 versions prior to 20.1R1-S2, 20.1R2. This issue does not affect Juniper Networks Junos OS prior to 18.1R1. | |||||
| CVE-2020-27182 | 1 Konzept-ix | 1 Publixone | 2020-10-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, job_jacket_detail.jsp, ixedit/editor_component.jsp, or the login form. | |||||
| CVE-2020-12137 | 2 Debian, Gnu | 2 Debian Linux, Mailman | 2020-10-27 | 4.3 MEDIUM | 6.1 MEDIUM |
| GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code. | |||||
| CVE-2020-27666 | 1 Strapi | 1 Strapi | 2020-10-27 | 3.5 LOW | 5.4 MEDIUM |
| Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature. | |||||