Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-35571 | 1 Mantisbt | 1 Mantisbt | 2021-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom field name is not sanitized. This may be problematic depending on CSP settings. | |||||
| CVE-2020-35664 | 1 Acronis | 1 Cyber Protect | 2021-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting (XSS) in the console. | |||||
| CVE-2021-23342 | 1 Docsifyjs | 1 Docsify | 2021-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters | |||||
| CVE-2021-3210 | 1 Bloodhound Project | 1 Bloodhound | 2021-02-25 | 9.3 HIGH | 9.6 CRITICAL |
| components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter. | |||||
| CVE-2021-27403 | 1 Asus | 2 Askey Rtf8115vw, Askey Rtf8115vw Firmware | 2021-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS. | |||||
| CVE-2020-18724 | 1 Altn | 1 Mdaemon Webmail | 2021-02-25 | 3.5 LOW | 5.4 MEDIUM |
| Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attacker to executes code and perform a XSS attack while opening a contact list. | |||||
| CVE-2020-18723 | 1 Altn | 1 Mdaemon Webmail | 2021-02-25 | 3.5 LOW | 5.4 MEDIUM |
| Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipient side while forwarding an email to perform potentially malicious activities. | |||||
| CVE-2020-28001 | 1 Solarwinds | 1 Serv-u | 2021-02-25 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS. | |||||
| CVE-2021-26746 | 1 Chamilo | 1 Chamilo | 2021-02-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI. | |||||
| CVE-2020-35128 | 1 Acquia | 1 Mautic | 2021-02-24 | 6.0 MEDIUM | 9.0 CRITICAL |
| Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an externally crafted JavaScript file, an attacker could eventually perform actions as the target user. These actions include changing the user passwords, altering user or email addresses, or adding a new administrator to the system. | |||||
| CVE-2020-7680 | 1 Docsifyjs | 1 Docsify | 2021-02-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page. | |||||
| CVE-2019-9576 | 1 Adenion | 1 Blog2social | 2021-02-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS. | |||||
| CVE-2020-35592 | 1 Pi-hole | 1 Pi-hole | 2021-02-24 | 3.5 LOW | 5.4 MEDIUM |
| Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie. | |||||
| CVE-2021-3271 | 1 Pressbooks | 1 Pressbooks | 2021-02-24 | 3.5 LOW | 4.8 MEDIUM |
| PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or preview the books page will result in the triggering the stored XSS. | |||||
| CVE-2021-22978 | 1 F5 | 14 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Advanced Web Application Firewall and 11 more | 2021-02-24 | 5.1 MEDIUM | 8.3 HIGH |
| On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. | |||||
| CVE-2021-27559 | 1 Monicahq | 1 Monica | 2021-02-23 | 3.5 LOW | 5.4 MEDIUM |
| The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field. | |||||
| CVE-2021-27371 | 1 Monicahq | 1 Monica | 2021-02-23 | 3.5 LOW | 5.4 MEDIUM |
| The Contact page in Monica 2.19.1 allows stored XSS via the Description field. | |||||
| CVE-2021-27369 | 1 Monicahq | 1 Monica | 2021-02-23 | 3.5 LOW | 5.4 MEDIUM |
| The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field. | |||||
| CVE-2021-27368 | 1 Monicahq | 1 Monica | 2021-02-23 | 3.5 LOW | 5.4 MEDIUM |
| The Contact page in Monica 2.19.1 allows stored XSS via the First Name field. | |||||
| CVE-2017-14753 | 1 Eyesofnetwork | 1 Eyesofnetwork | 2021-02-23 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/module_filters/index.php. | |||||