Total
41118 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-11702 | 1 Provideserver | 1 Provide Ftp Server | 2024-11-21 | 6.1 Medium |
| An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter. Share is Reflected via the target parameter. Share is Stored via the displayname parameter. Waitedit is Reflected via the Host header. | ||||
| CVE-2020-11697 | 1 Combodo | 1 Itop | 2024-11-21 | 6.1 Medium |
| In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4. | ||||
| CVE-2020-11696 | 1 Combodo | 1 Itop | 2024-11-21 | 6.1 Medium |
| In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4. | ||||
| CVE-2020-11626 | 1 Primekey | 1 Ejbca | 2024-11-21 | 6.1 Medium |
| An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. Two Cross Side Scripting (XSS) vulnerabilities have been found in the Public Web and the Certificate/CRL download servlets. | ||||
| CVE-2020-11584 | 2 Linux, Plesk | 2 Linux Kernel, Onyx | 2024-11-21 | 6.1 Medium |
| A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. | ||||
| CVE-2020-11583 | 2 Microsoft, Plesk | 2 Windows, Obsidian | 2024-11-21 | 6.1 Medium |
| A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. | ||||
| CVE-2020-11556 | 1 Castlerock | 1 Snmpc Online | 2024-11-21 | 5.4 Medium |
| An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There are multiple persistent (stored) and reflected XSS vulnerabilities. | ||||
| CVE-2020-11516 | 1 Contact-form-7-datepicker Project | 1 Contact-form-7-datepicker | 2024-11-21 | 5.4 Medium |
| Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session. | ||||
| CVE-2020-11512 | 1 Idxbroker | 1 Impress For Idx Broker | 2024-11-21 | 5.4 Medium |
| Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter, which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts. | ||||
| CVE-2020-11509 | 1 Wpleadplus | 1 Wp Lead Plus X | 2024-11-21 | 6.1 Medium |
| An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page). | ||||
| CVE-2020-11508 | 1 Wpleadplus | 1 Wp Lead Plus X | 2024-11-21 | 5.4 Medium |
| An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pages with a malicious page containing arbitrary JavaScript via the wp_ajax_core37_lp_save_page (aka core37_lp_save_page) AJAX action. | ||||
| CVE-2020-11499 | 1 Firmware Analysis And Comparison Tool Project | 1 Firmware Analysis And Comparison Tool | 2024-11-21 | 6.1 Medium |
| Firmware Analysis and Comparison Tool (FACT) 3 has Stored XSS when updating analysis details via a localhost web request, as demonstrated by mishandling of the tags and version fields in helperFunctions/mongo_task_conversion.py. | ||||
| CVE-2020-11457 | 1 Netgate | 1 Pfsense | 2024-11-21 | 5.4 Medium |
| pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user. | ||||
| CVE-2020-11456 | 1 Limesurvey | 1 Limesurvey | 2024-11-21 | 5.4 Medium |
| LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups). | ||||
| CVE-2020-11454 | 1 Microstrategy | 1 Microstrategy Web | 2024-11-21 | 5.4 Medium |
| Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowing for the creation of a new dashboard. In order to exploit this vulnerability, a user needs to get access to a shared dashboard or have the ability to create a dashboard on the application. | ||||
| CVE-2020-11448 | 1 Bell | 2 Home Hub 3000, Home Hub 3000 Firmware | 2024-11-21 | 6.1 Medium |
| An issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the email field and the login page. | ||||
| CVE-2020-11436 | 1 Librehealth | 1 Librehealth Ehr | 2024-11-21 | 9.0 Critical |
| LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including administrators. | ||||
| CVE-2020-11416 | 1 Jetbrains | 1 Space | 2024-11-21 | 5.4 Medium |
| JetBrains Space through 2020-04-22 allows stored XSS in Chats. | ||||
| CVE-2020-11110 | 3 Grafana, Netapp, Redhat | 4 Grafana, E-series Performance Analyzer, Enterprise Linux and 1 more | 2024-11-21 | 5.4 Medium |
| Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. | ||||
| CVE-2020-11106 | 1 Tecrail | 1 Responsive Filemanager | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Responsive Filemanager through 9.14.0. In the dialog.php page, the session variable $_SESSION['RF']["view_type"] wasn't sanitized if it was already set. This made stored XSS possible if one opens ajax_calls.php and uses the "view" action and places a payload in the type parameter, and then returns to the dialog.php page. This occurs because ajax_calls.php was also able to set the $_SESSION['RF']["view_type"] variable, but there it wasn't sanitized. | ||||