Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-26672 | 1 Testimonial Rotator Project | 1 Testimonial Rotator | 2020-11-19 | 3.5 LOW | 5.4 MEDIUM |
| Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database. | |||||
| CVE-2020-14240 | 1 Hcltech | 1 Notes | 2020-11-19 | 4.3 MEDIUM | 6.1 MEDIUM |
| HCL Notes versions previous to releases 9.0.1 FP10 IF8, 10.0.1 FP6 and 11.0.1 FP1 is susceptible to a Stored Cross-site Scripting (XSS) vulnerability. An attacker could use this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials. | |||||
| CVE-2020-26083 | 1 Cisco | 1 Identity Services Engine | 2020-11-19 | 3.5 LOW | 4.8 MEDIUM |
| A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker would need to have valid administrative credentials. | |||||
| CVE-2018-21030 | 1 Jupyter | 1 Notebook | 2020-11-18 | 5.0 MEDIUM | 5.3 MEDIUM |
| Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document. | |||||
| CVE-2018-19351 | 1 Jupyter | 1 Notebook | 2020-11-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this. | |||||
| CVE-2020-25832 | 1 Microfocus | 1 Filr | 2020-11-18 | 3.5 LOW | 5.4 MEDIUM |
| Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to perform Reflected XSS attack. | |||||
| CVE-2020-25833 | 1 Microfocus | 1 Idol | 2020-11-18 | 3.5 LOW | 4.8 MEDIUM |
| Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability could be exploited to perform Persistent XSS attack. | |||||
| CVE-2020-28409 | 1 Dundas | 1 Dundas Bi | 2020-11-18 | 3.5 LOW | 5.4 MEDIUM |
| The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as click, hover, etc. occur. | |||||
| CVE-2020-28408 | 1 Dundas | 1 Dundas Bi | 2020-11-18 | 3.5 LOW | 5.4 MEDIUM |
| The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard. | |||||
| CVE-2020-25267 | 1 Ilias | 1 Ilias | 2020-11-18 | 3.5 LOW | 5.4 MEDIUM |
| An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4. | |||||
| CVE-2020-28351 | 1 Mitel | 2 Shoretel, Shoretel Firmware | 2020-11-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient validation for the time_zone object in the HOME_MEETING& page. | |||||
| CVE-2020-17083 | 1 Microsoft | 1 Exchange Server | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17084. | |||||
| CVE-2020-28364 | 1 Locust | 1 Locust | 2020-11-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users. | |||||
| CVE-2020-9299 | 1 Netflix | 1 Dispatch | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user. | |||||
| CVE-2020-27990 | 1 Nagios | 1 Nagios Xi | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent). | |||||
| CVE-2020-27988 | 1 Nagios | 1 Nagios Xi | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field). | |||||
| CVE-2020-27991 | 1 Nagios | 1 Nagios Xi | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field). | |||||
| CVE-2020-27989 | 1 Nagios | 1 Nagios Xi | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard). | |||||
| CVE-2020-26221 | 1 Touchbase.ai Project | 1 Touchbase.ai | 2020-11-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action. The issue is patched in version 2.0. | |||||
| CVE-2020-26218 | 1 Touchbase.ai Project | 1 Touchbase.ai | 2020-11-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0. | |||||