Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-6231 | 1 Sap | 1 Businessobjects Business Intelligence Platform | 2020-04-15 | 3.5 LOW | 5.4 MEDIUM |
| SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface), version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. | |||||
| CVE-2019-19913 | 1 Intland | 1 Codebeamer Application Lifecycle Management | 2020-04-14 | 3.5 LOW | 4.8 MEDIUM |
| In Intland codeBeamer ALM 9.5 and earlier, there is stored XSS via the Trackers Title parameter. | |||||
| CVE-2020-9461 | 1 Octech | 1 Oempro | 2020-04-14 | 3.5 LOW | 5.4 MEDIUM |
| Octech Oempro 4.7 through 4.11 allow stored XSS by an authenticated user. The FolderName parameter of the Media.CreateFolder command is vulnerable. | |||||
| CVE-2020-9460 | 1 Octech | 1 Oempro | 2020-04-14 | 3.5 LOW | 5.4 MEDIUM |
| Octech Oempro 4.7 through 4.11 allow XSS by an authenticated user. The parameter CampaignName in Campaign.Create is vulnerable. | |||||
| CVE-2011-3058 | 2 Apple, Google | 3 Iphone Os, Mac Os X, Chrome | 2020-04-14 | 4.3 MEDIUM | N/A |
| Google Chrome before 18.0.1025.142 does not properly handle the EUC-JP encoding system, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. | |||||
| CVE-2020-11734 | 1 Cybersolutions | 1 Cybermail | 2020-04-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter. | |||||
| CVE-2020-11702 | 1 Provideserver | 1 Provide Ftp Server | 2020-04-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter. Share is Reflected via the target parameter. Share is Stored via the displayname parameter. Waitedit is Reflected via the Host header. | |||||
| CVE-2020-11704 | 1 Provideserver | 1 Provide Ftp Server | 2020-04-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The Admin Web Interface has Multiple Stored and Reflected XSS. GetInheritedProperties is Reflected via the groups parameter. GetUserInfo is Reflected via POST data. SetUserInfo is Stored via the general parameter. | |||||
| CVE-2020-11712 | 1 Open Upload Project | 1 Open Upload | 2020-04-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| Open Upload through 0.4.3 allows XSS via index.php?action=u and the filename field. | |||||
| CVE-2020-11714 | 1 Etentech | 2 Psg-6528vm, Psg-6528vm Firmware | 2020-04-13 | 3.5 LOW | 5.4 MEDIUM |
| eten PSG-6528VM 1.1 devices allow XSS via System Contact or System Location. | |||||
| CVE-2020-11731 | 1 Media Library Assistant Project | 1 Media Library Assistant | 2020-04-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs, which allow remote authenticated users to execute arbitrary JavaScript. | |||||
| CVE-2020-9056 | 1 Periscopeholdings | 1 Buyspeed | 2020-04-13 | 3.5 LOW | 5.4 MEDIUM |
| Periscope BuySpeed version 14.5 is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to store arbitrary JavaScript within the application. This JavaScript is subsequently displayed by the application without sanitization and is executed in the browser of the user, which could possibly cause website redirection, session hijacking, or information disclosure. This vulnerability has been patched in BuySpeed version 15.3. | |||||
| CVE-2018-18245 | 2 Debian, Nagios | 2 Debian Linux, Nagios Core | 2020-04-11 | 3.5 LOW | 5.4 MEDIUM |
| Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE. | |||||
| CVE-2019-4602 | 1 Ibm | 1 Rational Quality Manager | 2020-04-10 | 3.5 LOW | 5.4 MEDIUM |
| IBM Quality Manager (RQM) 6.02, 6.06, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168293. | |||||
| CVE-2020-11516 | 1 Contact-form-7-datepicker Project | 1 Contact-form-7-datepicker | 2020-04-10 | 3.5 LOW | 5.4 MEDIUM |
| Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session. | |||||
| CVE-2019-4746 | 1 Ibm | 2 Doors Next Generation, Rational Doors Next Generation | 2020-04-10 | 3.5 LOW | 5.4 MEDIUM |
| IBM DOORS Next Generation (DNG/RRC) 6.0.2. 6.0.6, and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172885. | |||||
| CVE-2019-4740 | 1 Ibm | 2 Doors Next Generation, Rational Doors Next Generation | 2020-04-10 | 3.5 LOW | 5.4 MEDIUM |
| IBM DOORS Next Generation (DNG/RRC) 6.0.2. 6.0.6, and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172808. | |||||
| CVE-2019-4737 | 1 Ibm | 2 Doors Next Generation, Rational Doors Next Generation | 2020-04-10 | 3.5 LOW | 5.4 MEDIUM |
| IBM DOORS Next Generation (DNG/RRC) 6.0.2. 6.0.6, and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172707. | |||||
| CVE-2020-4252 | 1 Ibm | 2 Doors Next Generation, Rational Doors Next Generation | 2020-04-10 | 3.5 LOW | 5.4 MEDIUM |
| IBM DOORS Next Generation (DNG/RRC) 6.0.2. 6.0.6, and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 175490. | |||||
| CVE-2020-11556 | 1 Castlerock | 1 Snmpc Online | 2020-04-10 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There are multiple persistent (stored) and reflected XSS vulnerabilities. | |||||