Total
41415 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-32602 | 1 Fortinet | 1 Fortiportal | 2024-11-21 | 5.8 Medium |
| An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1.2 and below, 5.0.3 and below, 4.2.2 and below, 4.1.2 and below, 4.0.4 and below may allow a remote and unauthenticated attacker to perform an XSS attack via sending a crafted request with an invalid lang parameter or with an invalid org.springframework.web.servlet.i18n.CookieLocaleResolver.LOCALE value. | ||||
| CVE-2021-32597 | 1 Fortinet | 2 Fortianalyzer, Fortimanager | 2024-11-21 | 4.6 Medium |
| Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface, may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious payload in GET parameters. | ||||
| CVE-2021-32585 | 1 Fortinet | 1 Fortiwan | 2024-11-21 | 7.2 High |
| An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perform a stored cross-site scripting attack via specifically crafted HTTP requests. | ||||
| CVE-2021-32573 | 1 Express-cart Project | 1 Express-cart | 2024-11-21 | 4.8 Medium |
| The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website. | ||||
| CVE-2021-32569 | 1 Ericsson | 2 Operations Support System-radio And Core, Operations Support System-radio And Core Firmware | 2024-11-21 | 6.1 Medium |
| In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. This problem is completely resolved in new Ericsson library browsing tool ELEX used in systems like Ericsson Network Manager. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Ericsson Network Manager is a new generation OSS system which OSS-RC customers shall upgrade to | ||||
| CVE-2021-32561 | 1 Octoprint | 1 Octoprint | 2024-11-21 | 6.1 Medium |
| OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters. | ||||
| CVE-2021-32544 | 1 Igt\+ Project | 1 Igt\+ | 2024-11-21 | 5.4 Medium |
| Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS (Cross-site scripting) attacks. | ||||
| CVE-2021-32542 | 1 Sysjust | 1 Cts Web | 2024-11-21 | 4.7 Medium |
| The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack. | ||||
| CVE-2021-32540 | 1 Hundredplus | 1 101eip | 2024-11-21 | 5.4 Medium |
| Add announcement function in the 101EIP system does not filter special characters, which allows authenticated users to inject JavaScript and perform a stored XSS attack. | ||||
| CVE-2021-32539 | 1 Hundredplus | 1 101eip | 2024-11-21 | 5.4 Medium |
| Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavaScript and perform a stored XSS attack. | ||||
| CVE-2021-32536 | 1 Mcusystem | 1 Mcusystem | 2024-11-21 | 6.1 Medium |
| The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaScript without privilege and thus perform reflected XSS attacks. | ||||
| CVE-2021-32482 | 1 Cloudera | 1 Cloudera Manager | 2024-11-21 | 6.1 Medium |
| Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter. | ||||
| CVE-2021-32481 | 1 Cloudera | 1 Hue | 2024-11-21 | 6.1 Medium |
| Cloudera Hue 4.6.0 allows XSS via the type parameter. | ||||
| CVE-2021-32478 | 1 Moodle | 1 Moodle | 2024-11-21 | 6.1 Medium |
| The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected. | ||||
| CVE-2021-32475 | 1 Moodle | 1 Moodle | 2024-11-21 | 5.4 Medium |
| ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected. | ||||
| CVE-2021-32470 | 1 Craftcms | 1 Craft Cms | 2024-11-21 | 6.1 Medium |
| Craft CMS before 3.6.13 has an XSS vulnerability. | ||||
| CVE-2021-32426 | 1 Trendnet | 2 Tw100-s4w1ca, Tw100-s4w1ca Firmware | 2024-11-21 | 6.1 Medium |
| In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "echo" command. | ||||
| CVE-2021-32245 | 1 Pagekit | 1 Pagekit | 2024-11-21 | 5.4 Medium |
| In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack. | ||||
| CVE-2021-32244 | 1 Moodle | 1 Moodle | 2024-11-21 | 5.4 Medium |
| Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field. | ||||
| CVE-2021-32233 | 1 Smartertools | 1 Smartermail | 2024-11-21 | 6.1 Medium |
| SmarterTools SmarterMail before Build 7776 allows XSS. | ||||