Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-26918 | 1 Netgear | 20 Ex7000, Ex7000 Firmware, R6250 and 17 more | 2020-10-19 | 3.5 LOW | 4.8 MEDIUM |
| Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.66, R6700v3 before 1.0.2.66, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.8, R8300 before 1.0.2.128, and R8500 before 1.0.2.128. | |||||
| CVE-2020-7015 | 1 Elastic | 1 Kibana | 2020-10-19 | 3.5 LOW | 5.4 MEDIUM |
| Kibana versions before 6.8.9 and 7.7.0 contains a stored XSS flaw in the TSVB visualization. An attacker who is able to edit or create a TSVB visualization could allow the attacker to obtain sensitive information from, or perform destructive actions, on behalf of Kibana users who edit the TSVB visualization. | |||||
| CVE-2019-7621 | 1 Elastic | 1 Kibana | 2020-10-19 | 3.5 LOW | 5.4 MEDIUM |
| Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboard containing the visualization it could execute JavaScript in the victim�s browser. | |||||
| CVE-2020-25271 | 1 Phpgurukul | 1 Hospital Management System In Php | 2020-10-16 | 3.5 LOW | 5.4 MEDIUM |
| PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appointment.php, doctor/appointment-history.php, or admin/appointment-history.php. | |||||
| CVE-2020-4775 | 1 Ibm | 1 Curam Social Program Management | 2020-10-16 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user's device, restricted to a single location. IBM X-Force ID: 189153. | |||||
| CVE-2020-26917 | 1 Netgear | 18 Ex7000, Ex7000 Firmware, R6250 and 15 more | 2020-10-16 | 3.5 LOW | 4.8 MEDIUM |
| Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.66, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.8, R8300 before 1.0.2.128, and R8500 before 1.0.2.128. | |||||
| CVE-2020-26915 | 1 Netgear | 22 D7800, D7800 Firmware, R7500v2 and 19 more | 2020-10-16 | 3.5 LOW | 4.8 MEDIUM |
| Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, XR500 before 2.3.2.56, and XR700 before 1.0.1.10. | |||||
| CVE-2020-25272 | 1 Online Bus Booking System Project | 1 Online Bus Booking System | 2020-10-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book_now.php. | |||||
| CVE-2020-8820 | 1 Webmin | 1 Webmin | 2020-10-16 | 3.5 LOW | 5.4 MEDIUM |
| An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field and execute it. Then, after revisiting the Cluster Shell Commands Menu, the XSS Payload will be rendered and executed. | |||||
| CVE-2020-12670 | 1 Webmin | 1 Webmin | 2020-10-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements, as opposed to the View function, which sanitizes the input correctly. A malicious user can send any JavaScript payload into the message body and execute it if the user decides to save that email. | |||||
| CVE-2020-15177 | 1 Glpi-project | 1 Glpi | 2020-10-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2. | |||||
| CVE-2020-15217 | 1 Glpi-project | 1 Glpi | 2020-10-16 | 5.0 MEDIUM | 5.3 MEDIUM |
| In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ. | |||||
| CVE-2020-26923 | 1 Netgear | 8 Wc7500, Wc7500 Firmware, Wc7600 and 5 more | 2020-10-15 | 3.5 LOW | 4.8 MEDIUM |
| Certain NETGEAR devices are affected by stored XSS. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 before 6.5.5.24, and WC9500 before 6.5.5.24. | |||||
| CVE-2020-2292 | 1 Jenkins | 1 Release | 2020-10-15 | 3.5 LOW | 5.4 MEDIUM |
| Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Release/Release permission. | |||||
| CVE-2020-24301 | 1 Hapifhir | 1 Testpage Overlay | 2020-10-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testing and not believed to be widely used for any production purposes. | |||||
| CVE-2020-13345 | 1 Gitlab | 1 Gitlab | 2020-10-15 | 3.5 LOW | 5.4 MEDIUM |
| An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes | |||||
| CVE-2020-25343 | 1 Getsymphony | 1 Symphony | 2020-10-14 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['body'] param via events\event.publish_article.php | |||||
| CVE-2020-24627 | 1 Hpe | 2 Kvm Ip Console Switch G2, Kvm Ip Console Switch G2 Firmware | 2020-10-14 | 3.5 LOW | 5.4 MEDIUM |
| A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3. | |||||
| CVE-2020-13340 | 1 Gitlab | 1 Gitlab | 2020-10-13 | 3.5 LOW | 8.7 HIGH |
| An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log | |||||
| CVE-2020-17551 | 1 Impresscms | 1 Impresscms | 2020-10-13 | 3.5 LOW | 4.8 MEDIUM |
| ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution. | |||||