Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-20677 | 1 Getbootstrap | 1 Bootstrap | 2021-07-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property. | |||||
| CVE-2018-14042 | 1 Getbootstrap | 1 Bootstrap | 2021-07-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. | |||||
| CVE-2016-10735 | 1 Getbootstrap | 1 Bootstrap | 2021-07-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041. | |||||
| CVE-2018-20816 | 1 Salesagility | 1 Suitecrm | 2021-07-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed. | |||||
| CVE-2021-3111 | 1 Concretecms | 1 Concrete Cms | 2021-07-22 | 3.5 LOW | 4.8 MEDIUM |
| The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI. | |||||
| CVE-2020-4740 | 1 Ibm | 1 Infosphere Information Server | 2021-07-21 | 4.3 MEDIUM | 5.2 MEDIUM |
| IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 188150. | |||||
| CVE-2020-25399 | 1 Mind | 1 Imind Server | 2021-07-21 | 6.8 MEDIUM | 7.8 HIGH |
| Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat. | |||||
| CVE-2020-8821 | 1 Webmin | 1 Webmin | 2021-07-21 | 3.5 LOW | 5.4 MEDIUM |
| An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command field and submit it. Then, after visiting the Action Logs Menu and displaying logs, the HTML code will be rendered (however, JavaScript is not executed). Changes are kept across users. | |||||
| CVE-2020-7749 | 1 Osm-static-maps Project | 1 Osm-static-maps | 2021-07-21 | 6.5 MEDIUM | 7.6 HIGH |
| This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read. | |||||
| CVE-2020-35942 | 1 Imagely | 1 Nextgen Gallery | 2021-07-21 | 6.8 MEDIUM | 8.8 HIGH |
| A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.) | |||||
| CVE-2020-35944 | 1 Pagelayer | 1 Pagelayer | 2021-07-21 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, which can lead to XSS. | |||||
| CVE-2020-9092 | 1 Huawei | 2 Mate 20, Mate 20 Firmware | 2021-07-21 | 2.1 LOW | 4.6 MEDIUM |
| HUAWEI Mate 20 versions earlier than 10.1.0.163(C00E160R3P8) have a JavaScript injection vulnerability. A module does not verify a specific input. This could allow attackers to bypass filter mechanism to launch JavaScript injection. This could compromise normal service of the affected module. | |||||
| CVE-2020-35947 | 1 Pagelayer | 1 Pagelayer | 2021-07-21 | 6.5 MEDIUM | 7.4 HIGH |
| An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization, but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur. | |||||
| CVE-2020-9314 | 1 Oracle | 1 Iplanet Web Server | 2021-07-21 | 4.9 MEDIUM | 4.8 MEDIUM |
| ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE. | |||||
| CVE-2020-26049 | 1 Niftypm | 1 Nifty-pm | 2021-07-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution. | |||||
| CVE-2020-5728 | 1 Openmrs | 1 Openmrs | 2021-07-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting. | |||||
| CVE-2020-28470 | 1 Scully | 1 Scully | 2021-07-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page. | |||||
| CVE-2020-5905 | 1 F5 | 11 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 8 more | 2021-07-21 | 6.0 MEDIUM | 4.3 MEDIUM |
| In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display. | |||||
| CVE-2020-5950 | 1 F5 | 1 Big-ip Advanced Firewall Manager | 2021-07-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| On BIG-IP 14.1.0-14.1.2.6, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. | |||||
| CVE-2020-25611 | 1 Mitel | 1 Micollab | 2021-07-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input validation, aka XSS. Successful exploitation could allow an attacker to view user conference information. | |||||