Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-1724 | 1 Microsoft | 2 Dynamics 365 Business Central, Dynamics Nav | 2021-03-03 | 2.3 LOW | 4.8 MEDIUM |
| Microsoft Dynamics Business Central Cross-site Scripting Vulnerability | |||||
| CVE-2021-23959 | 1 Mozilla | 1 Firefox | 2021-03-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85. | |||||
| CVE-2021-27330 | 1 Triconsole | 1 Datepicker Calendar | 2021-03-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents. | |||||
| CVE-2021-27671 | 1 Comrak Project | 1 Comrak | 2021-03-02 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack. | |||||
| CVE-2021-26678 | 1 Arubanetworks | 1 Clearpass Policy Manager | 2021-03-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the web-based management interface of ClearPass could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the affected interface. | |||||
| CVE-2019-18942 | 1 Microfocus | 1 Solutions Business Manager | 2021-03-01 | 2.3 LOW | 4.8 MEDIUM |
| Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without encoding. | |||||
| CVE-2019-18944 | 1 Microfocus | 1 Solutions Business Manager | 2021-03-01 | 2.3 LOW | 4.8 MEDIUM |
| Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS. | |||||
| CVE-2021-20660 | 1 Contec | 2 Sv-cpt-mc310, Sv-cpt-mc310 Firmware | 2021-03-01 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to inject an arbitrary script via unspecified vectors. | |||||
| CVE-2021-21616 | 1 Jenkins | 1 Active Choices | 2021-02-26 | 3.5 LOW | 4.6 MEDIUM |
| Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | |||||
| CVE-2021-21618 | 1 Jenkins | 1 Repository Connector | 2021-02-26 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2021-21619 | 1 Jenkins | 1 Claim | 2021-02-26 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins. | |||||
| CVE-2021-21622 | 1 Jenkins | 1 Artifact Repository Parameter | 2021-02-26 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. | |||||
| CVE-2020-35852 | 1 Getgist | 1 Chatbox | 2021-02-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| Chatbox is affected by cross-site scripting (XSS). An attacker has to upload any XSS payload with SVG, XML file in Chatbox. There is no restriction on file upload in Chatbox which leads to stored XSS. | |||||
| CVE-2021-26682 | 1 Arubanetworks | 1 Clearpass Policy Manager | 2021-02-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, 6.7.14-HF1. A vulnerability in the guest portal interface of ClearPass could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the portal. A successful exploit could allow an attacker to execute arbitrary script code in a victim’s browser in the context of the guest portal interface. | |||||
| CVE-2020-13697 | 1 Nanohttpd | 1 Nanohttpd | 2021-02-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization. | |||||
| CVE-2020-19762 | 1 Carrier | 1 Webctrl System | 2021-02-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request. | |||||
| CVE-2021-27564 | 1 Appspace | 1 Appspace | 2021-02-26 | 3.5 LOW | 5.4 MEDIUM |
| A stored XSS issue exists in Appspace 6.2.4. After a user is authenticated and enters an XSS payload under the groups section of the network tab, it is stored as the group name. Whenever another member visits that group, this payload executes. | |||||
| CVE-2021-27279 | 1 Mybb | 1 Mybb | 2021-02-26 | 3.5 LOW | 5.4 MEDIUM |
| MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode). | |||||
| CVE-2021-26544 | 1 Apache | 1 Livy | 2021-02-26 | 3.5 LOW | 5.4 MEDIUM |
| Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating. | |||||
| CVE-2021-26716 | 1 Openenergymonitor | 1 Emoncms | 2021-02-26 | 4.3 MEDIUM | 6.1 MEDIUM |
| Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter. | |||||