Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-36408 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-07-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module. | |||||
| CVE-2020-36409 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-07-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Category" parameter under the "Categories" module. | |||||
| CVE-2020-36411 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-07-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the {page_image} tag:" or "Path for thumbnail field:" parameters under the "Content Editing Settings" module. | |||||
| CVE-2020-36410 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-07-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Email address to receive notification of news submission" parameter under the "Options" module. | |||||
| CVE-2020-36412 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-07-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Search Text" field under the "Admin Search" module. | |||||
| CVE-2020-36413 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-07-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Exclude these IP addresses from the "Site Down" status" parameter under the "Maintenance Mode" module. | |||||
| CVE-2020-36414 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-07-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "URL (slug)" or "Extra" fields under the "Add Article" feature. | |||||
| CVE-2020-36415 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-07-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Stylesheet" parameter under the "Stylesheets" module. | |||||
| CVE-2020-36416 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-07-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module. | |||||
| CVE-2017-3161 | 1 Apache | 1 Hadoop | 2021-07-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter. | |||||
| CVE-2021-35959 | 1 Plone | 1 Plone | 2021-07-02 | 3.5 LOW | 5.4 MEDIUM |
| In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field. | |||||
| CVE-2021-20103 | 1 Machform | 1 Machform | 2021-07-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with forms through upload.php. | |||||
| CVE-2020-18066 | 1 Zrlog | 1 Zrlog | 2021-07-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment. | |||||
| CVE-2021-29944 | 1 Mozilla | 1 Firefox | 2021-07-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 88. | |||||
| CVE-2021-32719 | 1 Vmware | 1 Rabbitmq | 2021-07-02 | 3.5 LOW | 4.8 MEDIUM |
| RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI via the `rabbitmq_federation_management` plugin, its consumer tag was rendered without proper <script> tag sanitization. This potentially allows for JavaScript code execution in the context of the page. The user must be signed in and have elevated permissions (manage federation upstreams and policies) for this to occur. The vulnerability is patched in RabbitMQ 3.8.18. As a workaround, disable the `rabbitmq_federation_management` plugin and use [CLI tools](https://www.rabbitmq.com/cli.html) instead. | |||||
| CVE-2021-28556 | 1 Magento | 1 Magento | 2021-07-02 | 3.5 LOW | 4.8 MEDIUM |
| Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation. | |||||
| CVE-2020-22607 | 1 Limesurvey | 1 Limesurvey | 2021-07-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/admin/PermissiontemplatesController.php. | |||||
| CVE-2021-29775 | 1 Ibm | 2 Business Automation Workflow, Cloud Pak For Automation | 2021-07-02 | 4.3 MEDIUM | 5.4 MEDIUM |
| IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203029. | |||||
| CVE-2021-21084 | 1 Adobe | 2 Experience Manager, Experience Manager Cloud Service | 2021-07-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. | |||||
| CVE-2021-35303 | 1 Zammad | 1 Zammad | 2021-07-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. | |||||