Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-1000132 | 1 Cminds | 1 Tooltip Glossary | 2021-10-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8 | |||||
| CVE-2021-41555 | 1 Archibus | 1 Web Central | 2021-10-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| ** UNSUPPORTED WHEN ASSIGNED ** In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), XSS occurs in /archibus/dwr/call/plaincall/workflow.runWorkflowRule.dwr because the data received as input from clients is re-included within the HTTP response returned by the application without adequate validation. In this way, if HTML code or client-side executable code (e.g., Javascript) is entered as input, the expected execution flow could be altered. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020. | |||||
| CVE-2021-35506 | 1 Afian | 1 Filerun | 2021-10-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action. | |||||
| CVE-2021-39887 | 1 Gitlab | 1 Gitlab | 2021-10-08 | 3.5 LOW | 5.4 MEDIUM |
| A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to execute arbitrary JavaScript code on the victim's behalf. | |||||
| CVE-2021-35503 | 1 Afian | 1 Filerun | 2021-10-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. | |||||
| CVE-2021-24654 | 1 Wpeverest | 1 User Registration | 2021-10-08 | 3.5 LOW | 5.4 MEDIUM |
| The User Registration WordPress plugin before 2.0.2 does not properly sanitise the user_registration_profile_pic_url value when submitted directly via the user_registration_update_profile_details AJAX action. This could allow any authenticated user, such as subscriber, to perform Stored Cross-Site attacks when their profile is viewed | |||||
| CVE-2021-24676 | 1 Codesolz | 1 Better Find And Replace | 2021-10-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue | |||||
| CVE-2021-24673 | 1 Dwbooster | 1 Appointment Hour Booking | 2021-10-08 | 3.5 LOW | 4.8 MEDIUM |
| The Appointment Hour Booking WordPress plugin before 1.3.16 does not escape some of the Calendar Form settings, allowing high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2021-38822 | 1 Icehrm | 1 Icehrm | 2021-10-08 | 3.5 LOW | 5.4 MEDIUM |
| A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple pages of IceHrm 30.0.0.OS that allows for arbitrary execution of JavaScript commands. | |||||
| CVE-2021-23856 | 1 Bosch | 4 Rexroth Indramotion Mlc L20, Rexroth Indramotion Mlc L20 Firmware, Rexroth Indramotion Mlc L40 and 1 more | 2021-10-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL. | |||||
| CVE-2020-28119 | 1 53kf | 1 53kf | 2021-10-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross site scripting vulnerability in 53KF < 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted into chat window. | |||||
| CVE-2021-25964 | 1 Calibre-web Project | 1 Calibre-web | 2021-10-08 | 3.5 LOW | 5.4 MEDIUM |
| In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered. | |||||
| CVE-2021-24687 | 1 Webnus | 1 Modern Events Calendar Lite | 2021-10-08 | 3.5 LOW | 4.8 MEDIUM |
| The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2021-41101 | 1 Wire | 1 Wire Server | 2021-10-07 | 3.5 LOW | 5.7 MEDIUM |
| wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS ` Access-Control-Allow-Origin ` header set by `nginz` is set for all subdomains of `.wire.com` (including `wire.com`). This means that if somebody were to find an XSS vector in any of the subdomains, they could use it to talk to the Wire API using the user's Cookie. A patch does not exist, but a workaround does. To make sure that a compromise of one subdomain does not yield access to the cookie of another, one may limit the `Access-Control-Allow-Origin` header to apps that actually require the cookie (account-pages, team-settings and the webapp). | |||||
| CVE-2020-21228 | 1 Jizhicms | 1 Jizhicms | 2021-10-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie. | |||||
| CVE-2020-21434 | 1 Maccms | 1 Maccms | 2021-10-07 | 3.5 LOW | 5.4 MEDIUM |
| Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field. | |||||
| CVE-2020-21387 | 1 Maccms | 1 Maccms | 2021-10-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload. | |||||
| CVE-2021-25959 | 1 Opencrx | 1 Opencrx | 2021-10-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance. | |||||
| CVE-2021-41318 | 1 Progress | 1 Whatsupgold | 2021-10-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser. | |||||
| CVE-2021-25963 | 1 Shuup | 1 Shuup | 2021-10-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped. | |||||