Total
41123 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-12512 | 1 Pepperl-fuchs | 24 Io-link Master 4-eip, Io-link Master 4-eip Firmware, Io-link Master 4-pnio and 21 more | 2024-11-21 | 7.5 High |
| Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting | ||||
| CVE-2020-12472 | 1 Mono | 1 Monox | 2024-11-21 | 5.4 Medium |
| MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description. | ||||
| CVE-2020-12438 | 1 Php-fusion | 1 Php-fusion | 2024-11-21 | 5.4 Medium |
| An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags. | ||||
| CVE-2020-12432 | 1 Collaboraoffice | 1 Collabora Online Development Edition | 2024-11-21 | 6.1 Medium |
| The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtain an API access token, which can be accomplished if the attacker is able to upload a .docx or .odt file. The associated API endpoints for exploitation are /wopi/files and /wopi/getAccessToken. | ||||
| CVE-2020-12404 | 1 Mozilla | 1 Firefox | 2024-11-21 | 4.3 Medium |
| For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26. | ||||
| CVE-2020-12276 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 4.8 Medium |
| GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature. | ||||
| CVE-2020-12262 | 1 Intelbras | 6 Tip200, Tip200 Firmware, Tip200lite and 3 more | 2024-11-21 | 5.4 Medium |
| Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TIP300 65.61.75.15 devices allow /cgi-bin/cgiServer.exx?page= XSS. | ||||
| CVE-2020-12261 | 1 Opmantek | 1 Open-audit | 2024-11-21 | 5.4 Medium |
| Open-AudIT 3.3.0 allows an XSS attack after login. | ||||
| CVE-2020-12259 | 1 Rconfig | 1 Rconfig | 2024-11-21 | 5.4 Medium |
| rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php. | ||||
| CVE-2020-12256 | 1 Rconfig | 1 Rconfig | 2024-11-21 | 5.4 Medium |
| rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php. | ||||
| CVE-2020-12245 | 2 Grafana, Redhat | 4 Grafana, Enterprise Linux, Openshift and 1 more | 2024-11-21 | 6.1 Medium |
| Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip. | ||||
| CVE-2020-12137 | 6 Canonical, Debian, Fedoraproject and 3 more | 7 Ubuntu Linux, Debian Linux, Fedora and 4 more | 2024-11-21 | 6.1 Medium |
| GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code. | ||||
| CVE-2020-12132 | 1 Fifthplay | 1 S.a.m.i | 2024-11-21 | 6.1 Medium |
| Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request. | ||||
| CVE-2020-12131 | 1 App2pro | 1 Airdisk Pro | 2024-11-21 | 6.1 Medium |
| The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo). | ||||
| CVE-2020-12130 | 1 App2pro | 1 Airdisk Pro | 2024-11-21 | 6.1 Medium |
| The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function. | ||||
| CVE-2020-12129 | 1 App2pro | 1 Airdisk Pro | 2024-11-21 | 6.1 Medium |
| The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function. | ||||
| CVE-2020-12113 | 1 Bigbluebutton | 1 Bigbluebutton | 2024-11-21 | 6.1 Medium |
| BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used. | ||||
| CVE-2020-12108 | 6 Canonical, Debian, Fedoraproject and 3 more | 7 Ubuntu Linux, Debian Linux, Fedora and 4 more | 2024-11-21 | 6.5 Medium |
| /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. | ||||
| CVE-2020-12082 | 1 Flexera | 1 Flexnet Code Insight | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64). | ||||
| CVE-2020-12071 | 1 Anchorcms | 1 Anchor | 2024-11-21 | 4.8 Medium |
| Anchor 0.12.7 allows admins to cause XSS via crafted post content. | ||||