Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-29496 | 1 Dell | 1 Wyse Management Suite | 2021-01-06 | 3.5 LOW | 4.8 MEDIUM |
| Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with high privileges could exploit this vulnerability to store malicious HTML or JavaScript code while creating the Enduser. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. | |||||
| CVE-2021-3026 | 1 Invisioncommunity | 1 Ips Community Suite | 2021-01-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment. | |||||
| CVE-2020-26296 | 1 Vega Project | 1 Vega | 2021-01-06 | 3.5 LOW | 8.7 HIGH |
| Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could execute arbitrary javascript on a victim's machine. This is fixed in version 5.17.3 | |||||
| CVE-2019-16960 | 1 Solarwinds | 1 Web Help Desk | 2021-01-06 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field. | |||||
| CVE-2019-16956 | 1 Solarwinds | 1 Web Help Desk | 2021-01-06 | 3.5 LOW | 5.4 MEDIUM |
| SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket. | |||||
| CVE-2019-25011 | 1 Netbox Project | 1 Netbox | 2021-01-06 | 3.5 LOW | 5.4 MEDIUM |
| NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments. | |||||
| CVE-2020-35930 | 1 Seopanel | 1 Seo Panel | 2021-01-05 | 3.5 LOW | 5.4 MEDIUM |
| Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI. | |||||
| CVE-2021-3002 | 1 Seopanel | 1 Seo Panel | 2021-01-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter. | |||||
| CVE-2016-6418 | 1 Cisco | 1 Videoscape Distribution Suite Service Manager | 2021-01-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Cisco Videoscape Distribution Suite Service Manager (VDS-SM) 3.0 through 3.4.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCva14552. | |||||
| CVE-2020-4916 | 1 Ibm | 1 Cloud Pak System | 2021-01-05 | 3.5 LOW | 4.8 MEDIUM |
| IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191390. | |||||
| CVE-2020-4910 | 1 Ibm | 1 Cloud Pak System | 2021-01-05 | 3.5 LOW | 4.8 MEDIUM |
| IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191274. | |||||
| CVE-2020-4909 | 1 Ibm | 1 Cloud Pak System | 2021-01-05 | 3.5 LOW | 4.8 MEDIUM |
| IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191273. | |||||
| CVE-2020-25797 | 1 Limesurvey | 1 Limesurvey | 2021-01-05 | 3.5 LOW | 5.4 MEDIUM |
| LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser. | |||||
| CVE-2020-25799 | 1 Limesurvey | 1 Limesurvey | 2021-01-05 | 3.5 LOW | 5.4 MEDIUM |
| LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser. | |||||
| CVE-2020-35841 | 1 Netgear | 36 D6200, D6200 Firmware, D7000 and 33 more | 2021-01-04 | 3.5 LOW | 7.6 HIGH |
| Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JNR1010v2 before 1.1.0.62, JR6150 before 1.0.1.24, JWNR2010v5 before 1.1.0.62, R6020 before 1.0.0.42, R6050 before 1.0.1.24, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6260 before 1.1.0.76, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, WNR1000v4 before 1.1.0.62, WNR2020 before 1.1.0.62, and WNR2050 before 1.1.0.62. | |||||
| CVE-2020-5810 | 1 Umbraco | 1 Umbraco Cms | 2021-01-04 | 3.5 LOW | 5.4 MEDIUM |
| A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS payload. | |||||
| CVE-2020-5809 | 1 Umbraco | 1 Umbraco Cms | 2021-01-04 | 3.5 LOW | 5.4 MEDIUM |
| A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS. | |||||
| CVE-2020-29231 | 1 Egavilanmedia | 1 User Registration And Login System With Admin Panel | 2021-01-04 | 3.5 LOW | 5.4 MEDIUM |
| EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page. This vulnerability can result in the attacker injecting the XSS payload in Admin Full Name and each time admin visits the Profile page from the admin panel, the XSS triggers. | |||||
| CVE-2020-29230 | 1 Egavilanmedia | 1 User Registration And Login System With Admin Panel | 2021-01-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Panel - Manage User tab using the Full Name of the user. This vulnerability can result in the attacker injecting the XSS payload in the User Registration section and each time admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie according to the crafted payload. | |||||
| CVE-2020-35831 | 1 Netgear | 22 D7800, D7800 Firmware, R7500v2 and 19 more | 2021-01-04 | 3.5 LOW | 8.1 HIGH |
| Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, XR500 before 2.3.2.56, and XR700 before 1.0.1.10. | |||||