Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-39499 | 1 Eyoucms | 1 Eyoucms | 2021-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` parameter in bind_email function. | |||||
| CVE-2021-38704 | 1 Cliniccases | 1 Cliniccases | 2021-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft. | |||||
| CVE-2020-19855 | 1 Phpwcms | 1 Phpwcms | 2021-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php. | |||||
| CVE-2021-34759 | 1 Cisco | 1 Identity Services Engine | 2021-09-10 | 3.5 LOW | 4.8 MEDIUM |
| A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker would need valid administrative credentials. | |||||
| CVE-2021-34732 | 1 Cisco | 1 Prime Collaboration Provisioning | 2021-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. | |||||
| CVE-2021-27911 | 1 Acquia | 1 Mautic | 2021-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc. | |||||
| CVE-2021-27910 | 1 Acquia | 1 Mautic | 2021-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information. | |||||
| CVE-2021-27909 | 1 Acquia | 1 Mautic | 2021-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized. | |||||
| CVE-2017-17933 | 1 Netwin | 1 Surgeftp | 2021-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid, domainid, or username parameter. | |||||
| CVE-2021-39285 | 1 Versa-networks | 1 Versa Director | 2021-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8. An attacker can use the administration web interface URL to create a XSS based attack. | |||||
| CVE-2021-39496 | 1 Eyoucms | 1 Eyoucms | 2021-09-09 | 3.5 LOW | 5.4 MEDIUM |
| Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS. | |||||
| CVE-2021-39278 | 1 Moxa | 24 Oncell G3470a-lte-eu, Oncell G3470a-lte-eu-t, Oncell G3470a-lte-eu-t Firmware and 21 more | 2021-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3. | |||||
| CVE-2021-35238 | 1 Solarwinds | 1 Orion Platform | 2021-09-09 | 3.5 LOW | 4.8 MEDIUM |
| User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website. | |||||
| CVE-2021-36094 | 1 Otrs | 1 Otrs | 2021-09-09 | 3.5 LOW | 5.4 MEDIUM |
| It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions. | |||||
| CVE-2021-40509 | 1 Jforum | 1 Jforum | 2021-09-09 | 3.5 LOW | 5.4 MEDIUM |
| ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature. | |||||
| CVE-2021-24435 | 1 Gambit | 1 Titan Framework | 2021-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues | |||||
| CVE-2021-24517 | 1 Trumani | 1 Stop Spammers | 2021-09-09 | 3.5 LOW | 5.4 MEDIUM |
| The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-24513 | 1 Web-settler | 1 Form Builder | 2021-09-09 | 3.5 LOW | 5.4 MEDIUM |
| The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-24568 | 1 Addtoany | 1 Addtoany Share Buttons | 2021-09-09 | 3.5 LOW | 5.4 MEDIUM |
| The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-24601 | 1 Wpfront | 1 Wpfront Notification Bar | 2021-09-09 | 3.5 LOW | 5.4 MEDIUM |
| The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||