Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-8924 | 1 Apachefriends | 1 Xampp | 2019-05-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued. | |||||
| CVE-2019-12139 | 1 Ez | 2 Ezplatform-admin-ui, Ezplatform-page-builder | 2019-05-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4. | |||||
| CVE-2019-11033 | 1 Applaudsolutions | 1 Applaud Hcm | 2019-05-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the <iframe./> substring. | |||||
| CVE-2019-12136 | 1 Boostio | 1 Boostnote | 2019-05-16 | 3.5 LOW | 5.4 MEDIUM |
| There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element. | |||||
| CVE-2019-0298 | 1 Sap | 1 E-commerce | 2019-05-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| SAP E-Commerce (Business-to-Consumer) application does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Fixed in the following components SAP-CRMJAV SAP-CRMWEB SAP-SHRWEB SAP-SHRJAV SAP-CRMAPP SAP-SHRAPP, versions 7.30, 7.31, 7.32, 7.33, 7.54. | |||||
| CVE-2016-10719 | 1 Tp-link | 2 Archer Cr700, Archer Cr700 Firmware | 2019-05-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password. | |||||
| CVE-2019-6341 | 3 Debian, Drupal, Fedoraproject | 3 Debian Linux, Drupal, Fedora | 2019-05-15 | 3.5 LOW | 5.4 MEDIUM |
| In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability. | |||||
| CVE-2019-10111 | 1 Gitlab | 1 Gitlab | 2019-05-15 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page. | |||||
| CVE-2018-16138 | 1 Ipbrick | 1 Ipbrick Os | 2019-05-15 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities. | |||||
| CVE-2014-9917 | 1 Bilboplanet | 1 Bilboplanet | 2019-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Bilboplanet 2.0. There is a stored XSS vulnerability when adding a tag via the user/?page=tribes tags parameter. | |||||
| CVE-2014-9919 | 1 Bilboplanet | 1 Bilboplanet | 2019-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the fullname parameter to signup.php. | |||||
| CVE-2014-9918 | 1 Bilboplanet | 1 Bilboplanet | 2019-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the user_id parameter to signup.php. | |||||
| CVE-2019-8390 | 1 Qdpm | 1 Qdpm | 2019-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. | |||||
| CVE-2019-8391 | 1 Qdpm | 1 Qdpm | 2019-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter. | |||||
| CVE-2018-16139 | 1 Bibliosoft | 1 Bibliopac | 2019-05-15 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/. | |||||
| CVE-2019-4204 | 1 Ibm | 2 Business Automation Workflow, Business Process Manager | 2019-05-15 | 3.5 LOW | 5.4 MEDIUM |
| IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, and 19.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159125. | |||||
| CVE-2018-20838 | 1 Magazine3 | 1 Amp For Wp | 2019-05-14 | 3.5 LOW | 5.4 MEDIUM |
| ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS. | |||||
| CVE-2019-6514 | 1 Wso2 | 1 Dashboard Server | 2019-05-14 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS. | |||||
| CVE-2018-14664 | 1 Theforeman | 1 Foreman | 2019-05-14 | 3.5 LOW | 5.4 MEDIUM |
| A flaw was found in foreman from versions 1.18. A stored cross-site scripting vulnerability exists due to an improperly escaped HTML code in the breadcrumbs bar. This allows a user with permissions to edit which attribute is used in the breadcrumbs bar to store code that will be executed on the client side. | |||||
| CVE-2018-16887 | 2 Redhat, Theforeman | 2 Satellite, Katello | 2019-05-14 | 3.5 LOW | 5.4 MEDIUM |
| A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable. | |||||