Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-20111 | 1 Tecnick | 1 Tcexam | 2021-08-02 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php with a filename beggining with a period will be rendered as text/html. An attacker with access to tce_filemanager.php could upload a malicious javascript payload which would be triggered when another user views the file. | |||||
| CVE-2020-26563 | 1 Objectplanet | 1 Opinio | 2021-08-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from untrusted users.) | |||||
| CVE-2021-37742 | 1 Misp | 1 Misp | 2021-08-02 | 3.5 LOW | 5.4 MEDIUM |
| app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships. | |||||
| CVE-2021-36605 | 1 Engineercms Project | 1 Engineercms | 2021-08-02 | 3.5 LOW | 5.4 MEDIUM |
| engineercms 1.03 is vulnerable to Cross Site Scripting (XSS). There is no escaping in the nickname field on the user list page. When viewing this page, the JavaScript code will be executed in the user's browser. | |||||
| CVE-2021-37743 | 1 Misp | 1 Misp | 2021-08-02 | 3.5 LOW | 5.4 MEDIUM |
| app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format. | |||||
| CVE-2021-3159 | 1 Landray | 1 Landray Ekp | 2021-08-02 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross site scripting (XSS) vulnerability in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG, SHTML, or MHT file. | |||||
| CVE-2021-3619 | 1 Rapid7 | 1 Velociraptor | 2021-08-02 | 3.5 LOW | 4.8 MEDIUM |
| Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting (XSS) issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to Velociraptor is nearly always reserved for trusted and verified users with IT security backgrounds. | |||||
| CVE-2020-7390 | 1 Sage | 2 Syracuse, X3 | 2021-08-02 | 3.5 LOW | 5.4 MEDIUM |
| Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 (components shipped with Syracuse 12.10.0 and later) of Sage X3. Other on-premises versions of Sage X3 are unaffected or unsupported by the vendor. | |||||
| CVE-2021-22522 | 1 Microfocus | 1 Verastream Host Integrator | 2021-08-02 | 6.8 MEDIUM | 7.1 HIGH |
| Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier versions. The vulnerability could allow disclosure of confidential data. | |||||
| CVE-2021-37463 | 1 Nchsoftware | 1 Quorum | 2021-07-30 | 3.5 LOW | 5.4 MEDIUM |
| In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored). | |||||
| CVE-2021-37464 | 1 Nchsoftware | 1 Quorum | 2021-07-30 | 3.5 LOW | 5.4 MEDIUM |
| In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored). | |||||
| CVE-2021-26224 | 1 Fantastic Blog Project | 1 Fantastic Blog | 2021-07-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the search field to search.php. | |||||
| CVE-2021-37465 | 1 Nchsoftware | 1 Quorum | 2021-07-30 | 3.5 LOW | 5.4 MEDIUM |
| In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected). | |||||
| CVE-2021-37466 | 1 Nchsoftware | 1 Quorum | 2021-07-30 | 3.5 LOW | 5.4 MEDIUM |
| In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected). | |||||
| CVE-2021-25197 | 1 Content Management System Project | 1 Content Management System | 2021-07-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in SourceCodester Content Management System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter to content_management_system\admin\new_content.php | |||||
| CVE-2021-27332 | 1 Casap Automated Enrollment System Project | 1 Casap Automated Enrollment System | 2021-07-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php. | |||||
| CVE-2021-37467 | 1 Nchsoftware | 1 Quorum | 2021-07-30 | 3.5 LOW | 5.4 MEDIUM |
| In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected). | |||||
| CVE-2021-37470 | 1 Nchsoftware | 1 Webdictate | 2021-07-30 | 3.5 LOW | 5.4 MEDIUM |
| In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript. | |||||
| CVE-2021-30049 | 1 Sysaid | 1 Sysaid | 2021-07-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI. | |||||
| CVE-2021-26230 | 1 Casap Automated Enrollment System Project | 1 Casap Automated Enrollment System | 2021-07-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the user information to save_user.php. | |||||