Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-25325 | 1 Misp | 1 Misp | 2021-01-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs. | |||||
| CVE-2021-1130 | 1 Cisco | 1 Dna Center | 2021-01-21 | 3.5 LOW | 4.8 MEDIUM |
| A vulnerability in the web-based management interface of Cisco DNA Center software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker would need to have administrative credentials on the affected device. | |||||
| CVE-2020-6777 | 1 Bosch | 4 Praesensa, Praesensa Firmware, Praesideo and 1 more | 2021-01-21 | 3.5 LOW | 4.8 MEDIUM |
| A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an authenticated remote attacker with admin privileges to mount a stored Cross-Site-Scripting (XSS) attack against another user. When the victim logs into the management interface, the stored script code is executed in the context of his browser. A successful exploit would allow an attacker to interact with the management interface with the privileges of the victim. However, as the attacker already needs admin privileges, there is no additional impact on the management interface itself. | |||||
| CVE-2020-29587 | 1 Simplcommerce | 1 Simplcommerce | 2021-01-21 | 3.5 LOW | 5.4 MEDIUM |
| SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html() function to directly append the payload to a dialog. | |||||
| CVE-2020-35748 | 1 Foliovision | 1 Fv Flowplayer Video Player | 2021-01-21 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter. | |||||
| CVE-2020-27219 | 1 Eclipse | 1 Hawkbit | 2021-01-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client. | |||||
| CVE-2020-16255 | 1 Owncloud | 1 Owncloud | 2021-01-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.' | |||||
| CVE-2019-16961 | 1 Solarwinds | 1 Web Help Desk | 2021-01-21 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name. | |||||
| CVE-2020-26733 | 1 Skyworth | 2 Gn542vf, Gn542vf Firmware | 2021-01-20 | 3.5 LOW | 5.4 MEDIUM |
| Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section. | |||||
| CVE-2021-1238 | 1 Cisco | 1 Firepower Management Center | 2021-01-20 | 3.5 LOW | 4.8 MEDIUM |
| Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. | |||||
| CVE-2021-1239 | 1 Cisco | 1 Firepower Management Center | 2021-01-20 | 3.5 LOW | 4.8 MEDIUM |
| Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. | |||||
| CVE-2021-1245 | 1 Cisco | 1 Finesse | 2021-01-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack and obtain potentially confidential information by leveraging a flaw in the authentication mechanism. For more information about these vulnerabilities, see the Details section of this advisory. | |||||
| CVE-2021-1246 | 1 Cisco | 1 Finesse | 2021-01-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack and obtain potentially confidential information by leveraging a flaw in the authentication mechanism. For more information about these vulnerabilities, see the Details section of this advisory. | |||||
| CVE-2021-1127 | 1 Cisco | 1 Enterprise Nfv Infrastructure Software | 2021-01-19 | 3.5 LOW | 5.4 MEDIUM |
| A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to improper input validation of log file content stored on the affected device. An attacker could exploit this vulnerability by modifying a log file with malicious code and getting a user to view the modified log file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information. | |||||
| CVE-2020-16046 | 2 Apple, Google | 2 Iphone Os, Chrome | 2021-01-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted HTML page. | |||||
| CVE-2020-7776 | 1 Phpspreadsheet Project | 1 Phpspreadsheet | 2021-01-19 | 3.5 LOW | 6.4 MEDIUM |
| This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch. | |||||
| CVE-2021-21613 | 1 Jenkins | 1 Tics | 2021-01-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content. | |||||
| CVE-2021-23124 | 1 Joomla | 1 Joomla\! | 2021-01-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks. | |||||
| CVE-2021-23125 | 1 Joomla | 1 Joomla\! | 2021-01-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors. | |||||
| CVE-2021-21608 | 1 Jenkins | 1 Jenkins | 2021-01-15 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels. | |||||