Search
Total
20468 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-11627 | 2 Redhat, Sinatrarb | 2 Cloudforms, Sinatra | 2019-02-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception. | |||||
| CVE-2018-19506 | 1 Zurmo | 1 Zurmo | 2019-02-26 | 3.5 LOW | 4.8 MEDIUM |
| Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI. | |||||
| CVE-2018-19596 | 1 Zurmo | 1 Zurmo | 2019-02-26 | 3.5 LOW | 4.8 MEDIUM |
| Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506. | |||||
| CVE-2018-19508 | 1 Cmsimple | 1 Cmsimple | 2019-02-26 | 3.5 LOW | 4.8 MEDIUM |
| CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI. | |||||
| CVE-2018-19597 | 1 Cmsmadesimple | 1 Cms Made Simple | 2019-02-26 | 3.5 LOW | 4.8 MEDIUM |
| CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798. | |||||
| CVE-2009-0239 | 1 Microsoft | 3 Windows Search, Windows Server 2003, Windows Xp | 2019-02-26 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in Windows Search 4.0 for Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted file that appears in a preview in a search result, aka "Script Execution in Windows Search Vulnerability." | |||||
| CVE-2010-2265 | 1 Microsoft | 3 Windows 2003 Server, Windows Server 2003, Windows Xp | 2019-02-26 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to sysinfo/sysinfomain.htm. NOTE: this can be leveraged with CVE-2010-1885 to execute arbitrary commands without user interaction. | |||||
| CVE-2012-2005 | 2 Hp, Microsoft | 4 Insight Management Agents, Windows 2003 Server, Windows Server 2003 and 1 more | 2019-02-26 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |||||
| CVE-2018-19905 | 1 Razorcms | 1 Razorcms | 2019-02-26 | 3.5 LOW | 5.4 MEDIUM |
| HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter. | |||||
| CVE-2018-19904 | 1 Xsltcms.org Project | 1 Xsltcms.org | 2019-02-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field. | |||||
| CVE-2015-5454 | 1 Nucleuscms | 1 Nucleus Cms | 2019-02-26 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in Nucleus CMS allows remote attackers to inject arbitrary web script or HTML via the title parameter when adding a new item. | |||||
| CVE-2018-19903 | 1 Xsltcms.org Project | 1 Xsltcms.org | 2019-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field. | |||||
| CVE-2018-19507 | 1 Cmsimple | 1 Cmsimple | 2019-02-25 | 3.5 LOW | 4.8 MEDIUM |
| CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI. | |||||
| CVE-2018-19844 | 1 Frogcms Project | 1 Frogcms | 2019-02-25 | 3.5 LOW | 4.8 MEDIUM |
| FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319. | |||||
| CVE-2018-17302 | 1 Espocrm | 1 Espocrm | 2019-02-25 | 3.5 LOW | 5.4 MEDIUM |
| Stored XSS exists in views/fields/wysiwyg.js in EspoCRM 5.3.6 via a /#Email/view saved draft message. | |||||
| CVE-2018-19845 | 1 Get-simple | 1 Getsimple Cms | 2019-02-25 | 3.5 LOW | 5.4 MEDIUM |
| There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php "post-menu" parameter, a related issue to CVE-2018-16325. | |||||
| CVE-2018-19901 | 1 No-cms Project | 1 No-cms | 2019-02-25 | 3.5 LOW | 4.8 MEDIUM |
| No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter. | |||||
| CVE-2018-19902 | 1 No-cms Project | 1 No-cms | 2019-02-25 | 3.5 LOW | 4.8 MEDIUM |
| No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter. | |||||
| CVE-2018-19918 | 1 Cuppacms | 1 Cuppacms | 2019-02-25 | 3.5 LOW | 5.4 MEDIUM |
| CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI. | |||||
| CVE-2018-19600 | 1 Rhymix | 1 Rhymix | 2019-02-25 | 3.5 LOW | 4.8 MEDIUM |
| Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload. | |||||
| CVE-2018-17301 | 1 Espocrm | 1 Espocrm | 2019-02-25 | 3.5 LOW | 5.4 MEDIUM |
| Reflected XSS exists in client/res/templates/global-search/name-field.tpl in EspoCRM 5.3.6 via /#Account in the search panel. | |||||
| CVE-2019-9142 | 1 B3log | 1 Symphony | 2019-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java. | |||||
| CVE-2018-19906 | 1 Razorcms | 1 Razorcms | 2019-02-25 | 3.5 LOW | 5.4 MEDIUM |
| Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter. | |||||
| CVE-2019-9078 | 1 Zzcms | 1 Zzcms | 2019-02-25 | 3.5 LOW | 5.4 MEDIUM |
| zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT. | |||||
| CVE-2018-18692 | 1 Semcosoft | 1 Semcosoft | 2019-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected Cross-Site scripting (XSS) vulnerability in SEMCO Semcosoft 5.3 allows remote attackers to inject arbitrary web scripts or HTML via the username parameter to the Login Form. | |||||
| CVE-2019-9108 | 1 Wuzhicms | 1 Wuzhicms | 2019-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php. | |||||
| CVE-2019-9109 | 1 Wuzhicms | 1 Wuzhi Cms | 2019-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.php. | |||||
| CVE-2019-9110 | 1 Wuzhicms | 1 Wuzhi Cms | 2019-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/postinfo.php. | |||||
| CVE-2019-9107 | 1 Wuzhicms | 1 Wuzhi Cms | 2019-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imagecut.php. | |||||
| CVE-2019-9066 | 1 Php Appointment Booking Script Project | 1 Php Appointment Booking Script | 2019-02-25 | 3.5 LOW | 5.4 MEDIUM |
| PHP Scripts Mall PHP Appointment Booking Script 3.0.3 allows HTML injection in a user profile. | |||||
| CVE-2018-20791 | 1 Tecrail | 1 Responsive Filemanager | 2019-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mishandling of the media_preview action. | |||||
| CVE-2019-9016 | 1 Mopcms | 1 Mopcms | 2019-02-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[name] parameter in a mod=column request, as demonstrated by the /mopcms/X0AZgf(index).php?mod=column&ac=list&menuid=28&ac=add&menuid=29 URI. | |||||
| CVE-2019-5727 | 1 Splunk | 1 Splunk | 2019-02-22 | 3.5 LOW | 5.4 MEDIUM |
| Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827. | |||||
| CVE-2019-8983 | 1 Altn | 1 Mdaemon | 2019-02-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 1 of 2). | |||||
| CVE-2019-8984 | 1 Altn | 1 Mdaemon | 2019-02-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| MDaemon Webmail 14.x through 18.x before 18.5.2 has XSS (issue 2 of 2). | |||||
| CVE-2018-12409 | 1 Tibco | 1 Silver Fabric | 2019-02-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions up to and including 5.8.1. | |||||
| CVE-2016-0926 | 1 Pivotal Software | 1 Cloud Foundry Elastic Runtime | 2019-02-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Apps Manager in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework. | |||||
| CVE-2019-1000015 | 1 Chamilo | 1 Chamilo Lms | 2019-02-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03. | |||||
| CVE-2019-8435 | 1 Phpmywind | 1 Phpmywind | 2019-02-20 | 3.5 LOW | 4.8 MEDIUM |
| admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header. | |||||
| CVE-2019-8400 | 1 Ory | 1 Hydra | 2019-02-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. | |||||
| CVE-2019-0254 | 1 Sap | 1 Disclosure Management | 2019-02-20 | 3.5 LOW | 5.4 MEDIUM |
| SAP Disclosure Management (before version 10.1 Stack 1301) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | |||||
| CVE-2019-0262 | 1 Sap | 1 Businessobjects Bi Platform | 2019-02-19 | 3.5 LOW | 5.4 MEDIUM |
| SAP WebIntelligence BILaunchPad, versions 4.10, 4.20, does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in Cross-Site Scripting (XSS) vulnerability. | |||||
| CVE-2019-0251 | 1 Sap | 1 Businessobjects | 2019-02-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Fiori Launchpad of SAP BusinessObjects, before versions 4.2 and 4.3, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | |||||
| CVE-2019-8419 | 1 Vnote Project | 1 Vnote | 2019-02-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| VNote 2.2 has XSS via a new text note. | |||||
| CVE-2019-8935 | 1 O-dyn | 1 Collabtive | 2019-02-19 | 3.5 LOW | 5.4 MEDIUM |
| Collabtive 3.1 allows XSS via the manageuser.php?action=profile id parameter. | |||||
| CVE-2019-8436 | 1 Txjia | 1 Imcat | 2019-02-19 | 3.5 LOW | 5.4 MEDIUM |
| imcat 4.5 has Stored XSS via the root/run/adm.php fm[instop][note] parameter. | |||||
| CVE-2019-8911 | 1 Wtcms Project | 1 Wtcms | 2019-02-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box (for the website statistics code). | |||||
| CVE-2019-8425 | 1 Zoneminder | 1 Zoneminder | 2019-02-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages. | |||||
| CVE-2019-8426 | 1 Zoneminder | 1 Zoneminder | 2019-02-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter. | |||||
| CVE-2019-8434 | 1 Cmseasy | 1 Cmseasy | 2019-02-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter. | |||||