Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-17891 | 1 Tp-link | 2 Archer C1200, Archer C1200 Firmware | 2021-05-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| TP-Link Archer C1200 firmware version 1.13 Build 2018/01/24 rel.52299 EU has a XSS vulnerability allowing a remote attacker to execute arbitrary code. | |||||
| CVE-2020-16632 | 1 Dedecms | 1 Dedecms | 2021-05-21 | 3.5 LOW | 5.4 MEDIUM |
| A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter. | |||||
| CVE-2018-12981 | 1 Wago | 8 762-3000, 762-3000 Firmware, 762-3001 and 5 more | 2021-05-20 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability can be exploited by authenticated and unauthenticated users by sending special crafted requests to the web server allowing injecting code within the WBM. The code will be rendered and/or executed in the browser of the user's browser. | |||||
| CVE-2021-20994 | 1 Wago | 10 0852-0303, 0852-0303 Firmware, 0852-1305 and 7 more | 2021-05-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malicious code into the Web-Based Management. | |||||
| CVE-2021-20392 | 1 Ibm | 1 Qradar User Behavior Analytics | 2021-05-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM QRadar User Behavior Analytics 1.0.0 through 4.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | |||||
| CVE-2021-31537 | 1 Sisinformatik | 1 Sis-rewe Go | 2021-05-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters). | |||||
| CVE-2020-28722 | 1 Deskpro | 1 Deskpro | 2021-05-19 | 3.5 LOW | 5.4 MEDIUM |
| Deskpro Cloud Platform and on-premise 2020.2.3.48207 from 2020-07-30 contains a cross-site scripting (XSS) vulnerability that can lead to an account takeover via custom email templates. | |||||
| CVE-2016-8359 | 1 Moxa | 19 Iologik E1200 Series Firmware, Iologik E1210, Iologik E1211 and 16 more | 2021-05-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware Version V2.3 and prior, ioLogik E1241, firmware Version V2.4 and prior, ioLogik E1242, firmware Version V2.4 and prior, ioLogik E1260, firmware Version V2.4 and prior, ioLogik E1262, firmware Version V2.4 and prior, ioLogik E2210, firmware versions prior to V3.13, ioLogik E2212, firmware versions prior to V3.14, ioLogik E2214, firmware versions prior to V3.12, ioLogik E2240, firmware versions prior to V3.12, ioLogik E2242, firmware versions prior to V3.12, ioLogik E2260, firmware versions prior to V3.13, and ioLogik E2262, firmware versions prior to V3.12. The web application fails to sanitize user input, which may allow an attacker to inject script or execute arbitrary code (CROSS-SITE SCRIPTING). | |||||
| CVE-2020-18165 | 1 Laobancms | 1 Laobancms | 2021-05-18 | 3.5 LOW | 4.8 MEDIUM |
| Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu". | |||||
| CVE-2020-19274 | 1 Dhcms Project | 1 Dhcms | 2021-05-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Cross SIte Scripting (XSS) vulnerability exists in Dhcms 2017-09-18 in guestbook via the message board, which could let a remote malicious user execute arbitrary code. | |||||
| CVE-2020-18102 | 1 Hotels Server Project | 1 Hotels Server | 2021-05-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php". | |||||
| CVE-2021-30174 | 1 Ruiyanai | 1 Cloudiso | 2021-05-17 | 3.5 LOW | 5.4 MEDIUM |
| RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks. | |||||
| CVE-2021-27733 | 1 Jetbrains | 1 Youtrack | 2021-05-17 | 3.5 LOW | 5.4 MEDIUM |
| In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment. | |||||
| CVE-2021-31903 | 1 Jetbrains | 1 Youtrack | 2021-05-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS. | |||||
| CVE-2021-28461 | 1 Microsoft | 1 Dynamics 365 | 2021-05-17 | 3.5 LOW | 5.4 MEDIUM |
| Dynamics Finance and Operations Cross-site Scripting Vulnerability | |||||
| CVE-2020-35438 | 1 Kk Star Ratings Project | 1 Kk Star Ratings | 2021-05-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in the kk Star Ratings plugin before 4.1.5. | |||||
| CVE-2021-20717 | 1 Ec-cube | 1 Ec-cube | 2021-05-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser. | |||||
| CVE-2020-22428 | 1 Solarwinds | 2 Serv-u Ftp Server, Serv-u Mft Server | 2021-05-17 | 3.5 LOW | 4.8 MEDIUM |
| SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a JavaScript payload. | |||||
| CVE-2021-20577 | 1 Ibm | 1 Cloud Pak For Security | 2021-05-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199281. | |||||
| CVE-2021-20559 | 1 Ibm | 1 Control Desk | 2021-05-14 | 3.5 LOW | 5.4 MEDIUM |
| IBM Control Desk 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199228. | |||||