Total
41779 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-12438 | 1 Php-fusion | 1 Php-fusion | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags. | |||||
| CVE-2020-12432 | 1 Collaboraoffice | 1 Collabora Online Development Edition | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser, and lacks proper MIME type access control, which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtain an API access token, which can be accomplished if the attacker is able to upload a .docx or .odt file. The associated API endpoints for exploitation are /wopi/files and /wopi/getAccessToken. | |||||
| CVE-2020-12404 | 1 Mozilla | 1 Firefox | 2024-11-21 | 4.3 MEDIUM | 4.3 MEDIUM |
| For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26. | |||||
| CVE-2020-12276 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature. | |||||
| CVE-2020-12262 | 1 Intelbras | 6 Tip200, Tip200 Firmware, Tip200lite and 3 more | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TIP300 65.61.75.15 devices allow /cgi-bin/cgiServer.exx?page= XSS. | |||||
| CVE-2020-12261 | 1 Opmantek | 1 Open-audit | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| Open-AudIT 3.3.0 allows an XSS attack after login. | |||||
| CVE-2020-12259 | 1 Rconfig | 1 Rconfig | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php. | |||||
| CVE-2020-12256 | 1 Rconfig | 1 Rconfig | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php. | |||||
| CVE-2020-12245 | 1 Grafana | 1 Grafana | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip. | |||||
| CVE-2020-12137 | 5 Canonical, Debian, Fedoraproject and 2 more | 6 Ubuntu Linux, Debian Linux, Fedora and 3 more | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code. | |||||
| CVE-2020-12132 | 1 Fifthplay | 1 S.a.m.i | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request. | |||||
| CVE-2020-12131 | 1 App2pro | 1 Airdisk Pro | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo). | |||||
| CVE-2020-12130 | 1 App2pro | 1 Airdisk Pro | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function. | |||||
| CVE-2020-12129 | 1 App2pro | 1 Airdisk Pro | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function. | |||||
| CVE-2020-12113 | 1 Bigbluebutton | 1 Bigbluebutton | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used. | |||||
| CVE-2020-12082 | 1 Flexera | 1 Flexnet Code Insight | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64). | |||||
| CVE-2020-12071 | 1 Anchorcms | 1 Anchor | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| Anchor 0.12.7 allows admins to cause XSS via crafted post content. | |||||
| CVE-2020-12058 | 1 Oscommerce | 1 Ce Phoenix | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/order_status.php, catalog/admin/tax_rates.php, catalog/admin/languages.php, catalog/admin/countries.php, catalog/admin/tax_classes.php, catalog/admin/reviews.php, or catalog/admin/zones.php; or the zpage or spage parameter to catalog/admin/geo_zones.php. | |||||
| CVE-2020-12054 | 1 Catchplugins | 1 Catch Breadcrumb | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO. | |||||
| CVE-2020-12052 | 1 Grafana | 1 Grafana | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| Grafana version < 6.7.3 is vulnerable for annotation popup XSS. | |||||