Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-28456 | 1 S-cart | 1 S-cart | 2020-12-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel. | |||||
| CVE-2020-29304 | 1 Directoriespro | 1 Directories Pro | 2020-12-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim is proceeding through the file import workflow. | |||||
| CVE-2020-29303 | 1 Directoriespro | 1 Directories Pro | 2020-12-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with _drts_form_build_id parameter containing the XSS payload and _t_ parameter set to an invalid or non-existent CSRF token. | |||||
| CVE-2019-19284 | 1 Siemens | 1 Xhq | 2020-12-15 | 3.5 LOW | 5.4 MEDIUM |
| A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify content of particular web pages, causing the application to behave in unexpected ways for legitimate users. | |||||
| CVE-2019-19288 | 1 Siemens | 1 Xhq | 2020-12-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability has been identified in XHQ (All Versions < 6.1). The web interface could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. | |||||
| CVE-2020-35199 | 1 Igniterealtime | 1 Openfire | 2020-12-15 | 3.5 LOW | 5.4 MEDIUM |
| Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS. | |||||
| CVE-2020-35201 | 1 Igniterealtime | 1 Openfire | 2020-12-14 | 3.5 LOW | 5.4 MEDIUM |
| Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS. | |||||
| CVE-2020-35202 | 1 Igniterealtime | 1 Openfire | 2020-12-14 | 3.5 LOW | 5.4 MEDIUM |
| Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS. | |||||
| CVE-2020-28859 | 1 Openasset | 1 Digital Asset Management | 2020-12-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| OpenAsset Digital Asset Management (DAM) through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks. | |||||
| CVE-2020-28857 | 1 Openasset | 1 Digital Asset Management | 2020-12-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| OpenAsset Digital Asset Management (DAM) through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for stored cross-site scripting attacks. | |||||
| CVE-2020-35200 | 1 Igniterealtime | 1 Openfire | 2020-12-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS. | |||||
| CVE-2020-5948 | 1 F5 | 11 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 8 more | 2020-12-14 | 6.8 MEDIUM | 9.6 CRITICAL |
| On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. | |||||
| CVE-2020-29455 | 1 Smartystreets | 1 Liveaddressplugin.js | 2020-12-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country). | |||||
| CVE-2020-35126 | 1 Typesettercms | 1 Typesetter | 2020-12-14 | 3.5 LOW | 4.8 MEDIUM |
| ** DISPUTED ** Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because "admins are considered trustworthy." | |||||
| CVE-2020-26407 | 1 Gitlab | 1 Gitlab | 2020-12-11 | 3.5 LOW | 5.4 MEDIUM |
| A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project | |||||
| CVE-2020-35127 | 1 Igniterealtime | 1 Openfire | 2020-12-11 | 3.5 LOW | 5.4 MEDIUM |
| Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS. | |||||
| CVE-2020-16608 | 1 Notable | 1 Notable | 2020-12-11 | 9.3 HIGH | 9.6 CRITICAL |
| Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true). | |||||
| CVE-2020-2493 | 1 Qnap | 1 Multimedia Console | 2020-12-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later. | |||||
| CVE-2020-2491 | 1 Qnap | 2 Photo Station, Qts | 2020-12-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later | |||||
| CVE-2020-10146 | 1 Microsoft | 1 Teams | 2020-12-10 | 3.5 LOW | 5.4 MEDIUM |
| The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020. | |||||