Total
21765 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-3933 | 1 G5theme | 1 Essential Real Estate | 2022-12-14 | N/A | 5.4 MEDIUM |
| The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks. | |||||
| CVE-2022-3935 | 1 Collne | 1 Welcart E-commerce | 2022-12-14 | N/A | 5.4 MEDIUM |
| The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2022-3609 | 1 Getyourguide Ticketing Project | 1 Getyourguide Ticketing | 2022-12-14 | N/A | 4.8 MEDIUM |
| The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-3862 | 1 Livemeshelementor | 1 Addons For Elementor | 2022-12-14 | N/A | 4.8 MEDIUM |
| The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2022-3853 | 1 Supra-csv-parser Project | 1 Supra-csv-parser | 2022-12-14 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application. | |||||
| CVE-2022-3919 | 1 Automattic | 1 Jetpack Crm | 2022-12-14 | N/A | 4.8 MEDIUM |
| The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2022-3908 | 1 Helloprint | 1 Helloprint | 2022-12-14 | N/A | 6.1 MEDIUM |
| The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2022-3906 | 1 Whitestudio | 1 Easy Form Builder | 2022-12-14 | N/A | 4.8 MEDIUM |
| The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2022-45970 | 1 Alist Project | 1 Alist | 2022-12-14 | N/A | 5.4 MEDIUM |
| Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board. | |||||
| CVE-2021-25086 | 1 Advanced Page Visit Counter Project | 1 Advanced Page Visit Counter | 2022-12-14 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it | |||||
| CVE-2021-46846 | 2 Hp, Hpe | 45 3par Service Processor, Apollo R2000 Chassis, Integrated Lights-out 5 Firmware and 42 more | 2022-12-13 | N/A | 6.1 MEDIUM |
| Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5. | |||||
| CVE-2022-37926 | 1 Arubanetworks | 1 Edgeconnect Enterprise | 2022-12-13 | N/A | 5.4 MEDIUM |
| A vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface by uploading a specially crafted file. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below. | |||||
| CVE-2022-37925 | 1 Arubanetworks | 1 Edgeconnect Enterprise | 2022-12-13 | N/A | 6.1 MEDIUM |
| A vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below. | |||||
| CVE-2016-8719 | 1 Moxa | 2 Awk-3131a, Awk-3131a Firmware | 2022-12-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| An exploitable reflected Cross-Site Scripting vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. Specially crafted input, in multiple parameters, can cause a malicious scripts to be executed by a victim. | |||||
| CVE-2019-3638 | 1 Mcafee | 1 Web Gateway | 2022-12-13 | 4.3 MEDIUM | 9.6 CRITICAL |
| Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway (MWG) 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive information or execute commands with the MWG administrator's credentials via tricking the administrator to click on a carefully constructed malicious link. | |||||
| CVE-2018-4848 | 1 Siemens | 6 Scalance X-200, Scalance X-200 Firmware, Scalance X-200 Irt and 3 more | 2022-12-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. At the stage of publishing this security advisory no public exploitation is known. The vendor has confirmed the vulnerability and provides mitigations to resolve it. | |||||
| CVE-2018-4842 | 1 Siemens | 6 Scalance X200, Scalance X200 Firmware, Scalance X200 Irt and 3 more | 2022-12-13 | 3.5 LOW | 4.8 MEDIUM |
| A vulnerability has been identified in SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). A remote, authenticated attacker with access to the configuration web server could be able to store script code on the web site, if the HRP redundancy option is set. This code could be executed in the web browser of victims visiting this web site (XSS), affecting its confidentiality, integrity and availability. User interaction is required for successful exploitation, as the user needs to visit the manipulated web site. At the stage of publishing this security advisory no public exploitation is known. The vendor has confirmed the vulnerability and provides mitigations to resolve it. | |||||
| CVE-2022-4401 | 1 Pallidlight Online Course Selection System Project | 1 Pallidlight Online Course Selection System | 2022-12-13 | N/A | 5.4 MEDIUM |
| A vulnerability was found in pallidlight online-course-selection-system. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-215268. | |||||
| CVE-2020-8238 | 1 Pulsesecure | 2 Pulse Connect Secure, Pulse Policy Secure | 2022-12-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS). | |||||
| CVE-2022-4408 | 1 Phpmyfaq | 1 Phpmyfaq | 2022-12-13 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9. | |||||