ByteOS Network

Vulnerability Details :

CVE-2014-1820

Assigner Org ID-f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At-12 Aug, 2014 | 21:00

Updated At-06 Aug, 2024 | 09:50

Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "SQL Master Data Services XSS Vulnerability."

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:microsoft

Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At:12 Aug, 2014 | 21:00

Updated At:06 Aug, 2024 | 09:50

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://secunia.com/advisories/60676	third-party-advisory x_refsource_SECUNIA
http://www.securitytracker.com/id/1030716	vdb-entry x_refsource_SECTRACK
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-044	vendor-advisory x_refsource_MS
http://www.securityfocus.com/bid/69071	vdb-entry x_refsource_BID

Hyperlink: http://secunia.com/advisories/60676

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.securitytracker.com/id/1030716

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-044

Resource:

vendor-advisory

x_refsource_MS

Hyperlink: http://www.securityfocus.com/bid/69071

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://secunia.com/advisories/60676	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.securitytracker.com/id/1030716	vdb-entry x_refsource_SECTRACK x_transferred
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-044	vendor-advisory x_refsource_MS x_transferred
http://www.securityfocus.com/bid/69071	vdb-entry x_refsource_BID x_transferred

Hyperlink: http://secunia.com/advisories/60676

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://www.securitytracker.com/id/1030716

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-044

Resource:

vendor-advisory

x_refsource_MS

x_transferred

Hyperlink: http://www.securityfocus.com/bid/69071

Resource:

vdb-entry

x_refsource_BID

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:12 Aug, 2014 | 21:55

Updated At:12 Apr, 2025 | 10:46

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

Microsoft Corporation

>>sql_server>>2012

cpe:2.3:a:microsoft:sql_server:2012:sp1:x64:*:*:*:*:*

Microsoft Corporation

>>sql_server>>2014

cpe:2.3:a:microsoft:sql_server:2014:-:x64:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://secunia.com/advisories/60676	secure@microsoft.com	N/A
http://www.securityfocus.com/bid/69071	secure@microsoft.com	N/A
http://www.securitytracker.com/id/1030716	secure@microsoft.com	N/A
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-044	secure@microsoft.com	N/A
http://secunia.com/advisories/60676	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/69071	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securitytracker.com/id/1030716	af854a3a-2127-422b-91ae-364da2661108	N/A
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-044	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: http://secunia.com/advisories/60676

Source: secure@microsoft.com

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/69071

Source: secure@microsoft.com

Resource: N/A

Hyperlink: http://www.securitytracker.com/id/1030716

Source: secure@microsoft.com

Resource: N/A

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-044

Source: secure@microsoft.com

Resource: N/A

Hyperlink: http://secunia.com/advisories/60676

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/69071

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securitytracker.com/id/1030716

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-044

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Similar CVEs

12853Records found

CVE-2006-0032

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.3||MEDIUM

EPSS-66.59% / 98.47%

7 Day CHG~0.00%

Published-12 Sep, 2006 | 23:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.

Vendor-n/a Microsoft Corporation

Product-windows_xp windows_2000 windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-1823

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.3||MEDIUM

EPSS-25.98% / 96.07%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID, aka "Lync Server Content Sanitization Vulnerability."

Vendor-n/a Microsoft Corporation

Product-lync_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2005-0563

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.3||MEDIUM

EPSS-22.96% / 95.70%

7 Day CHG~0.00%

Published-14 Jun, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL ("jav&#X41sc
ript:") in an IMG tag.

Vendor-n/a Microsoft Corporation

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2004-2704

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-25.15% / 95.97%

7 Day CHG~0.00%

Published-06 Oct, 2007 | 21:00

Updated-03 Apr, 2025 | 01:03

Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.

Vendor-hastymail n/a Microsoft Corporation

Product-hastymail internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-3212

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-5.22% / 89.57%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, aka "Internet Explorer XSS Filter Vulnerability."

Vendor-n/a Microsoft Corporation

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-17070

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.44% / 62.23%

7 Day CHG~0.00%

Published-10 Oct, 2019 | 10:51

Updated-05 Aug, 2024 | 01:33

The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.

Vendor-lqd n/a Microsoft Corporation

Product-liquid_speech_balloon internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0532

Matching Score-10

Assigner-Adobe Systems Incorporated

View Details

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-3.47% / 87.09%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0531 and CVE-2014-0533.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0562

Matching Score-10

Assigner-Adobe Systems Incorporated

View Details

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 69.88%

7 Day CHG~0.00%

Published-17 Sep, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-6905

Matching Score-10

Assigner-JPCERT/CC

View Details

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.24%

7 Day CHG~0.00%

Published-05 Dec, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Mozilla Corporation Cybozu, Inc.Microsoft Corporation

Product-garoon firefox internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-6903

Matching Score-10

Assigner-JPCERT/CC

View Details

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.24%

7 Day CHG~0.00%

Published-05 Dec, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Mozilla Corporation Cybozu, Inc.Microsoft Corporation

Product-garoon firefox internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2004-0203

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-25.67% / 96.03%

7 Day CHG~0.00%

Published-12 Aug, 2004 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query.

Vendor-n/a Microsoft Corporation

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1467

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 69.90%

7 Day CHG~0.00%

Published-24 Oct, 2007 | 23:00

Updated-03 Apr, 2025 | 01:03

Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

Vendor-phorum unix n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel all_windows unix phorum n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-5072

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.3||MEDIUM

EPSS-6.93% / 91.03%

7 Day CHG~0.00%

Published-11 Dec, 2013 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability."

Vendor-n/a Microsoft Corporation

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-0712

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-18.97% / 95.08%

7 Day CHG~0.00%

Published-17 Oct, 2003 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access (OWA) allows remote attackers to execute arbitrary web script.

Vendor-n/a Microsoft Corporation

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-3648

Matching Score-10

Assigner-JPCERT/CC

View Details

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 52.55%

7 Day CHG~0.00%

Published-28 Jun, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in KENT-WEB POST-MAIL before 6.7, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.

Vendor-kent-web n/a Microsoft Corporation

Product-post-mail internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1372

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.35% / 56.41%

7 Day CHG~0.00%

Published-17 Oct, 2007 | 01:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in links.php script in myPHPNuke 1.8.8, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the (1) ratenum or (2) query parameters.

Vendor-myphpnuke unix n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel all_windows myphpnuke unix n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-26582

Matching Score-10

Assigner-Hewlett Packard Enterprise (HPE)

View Details

Matching Score-10

Assigner-Hewlett Packard Enterprise (HPE)

CVSS Score-6.1||MEDIUM

EPSS-0.30% / 52.82%

7 Day CHG~0.00%

Published-15 Apr, 2021 | 17:50

Updated-03 Aug, 2024 | 20:26

A security vulnerability in HPE IceWall SSO Domain Gateway Option (Dgfw) module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windows and 11.0 on Windows could be exploited remotely to allow cross-site scripting (XSS).

Vendor-n/a Microsoft Corporation HP Inc.Red Hat, Inc.

Product-icewall_sso_dgfw windows enterprise_linux hp-ux IceWall SSO Dgfw

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7280

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-10.39% / 92.92%

7 Day CHG+1.30%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7206.

Vendor-n/a Microsoft Corporation

Product-edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7206

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-2.54% / 84.87%

7 Day CHG+0.35%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Microsoft Corporation

Product-edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-8160

Matching Score-10

Assigner-Adobe Systems Incorporated

View Details

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.30% / 78.91%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:11

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to information disclosure.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-0942

Matching Score-10

Assigner-Dell

View Details

Matching Score-10

Assigner-Dell

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 51.61%

7 Day CHG~0.00%

Published-22 May, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a The Apache Software Foundation ELAN Microelectronics Corporation Microsoft Corporation

Product-http_server internet_information_server rsa_authentication_agent n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2002-1700

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-30.37% / 96.54%

7 Day CHG~0.00%

Published-21 Jun, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.

Vendor-n/a Macromedia, Inc.Microsoft Corporation

Product-internet_information_services coldfusion windows_2000 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-3591

Matching Score-10

Assigner-Trellix

View Details

Matching Score-10

Assigner-Trellix

CVSS Score-3.9||LOW

EPSS-0.31% / 53.79%

7 Day CHG~0.00%

Published-24 Jul, 2019 | 14:30

Updated-04 Aug, 2024 | 19:12

DLP Endpoint ePO extension vulnerable to XSS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.

Vendor-McAfee, LLC Microsoft Corporation

Product-windows data_loss_prevention_endpoint Data Loss Prevention ePO extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7251

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-7.63% / 91.52%

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."

Vendor-n/a Microsoft Corporation

Product-sql_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-18654

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.30% / 52.41%

7 Day CHG~0.00%

Published-01 Nov, 2019 | 18:25

Updated-05 Aug, 2024 | 01:54

A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.

Vendor-avg n/a Microsoft Corporation

Product-anti-virus windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-18653

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.30% / 52.41%

7 Day CHG~0.00%

Published-01 Nov, 2019 | 18:25

Updated-05 Aug, 2024 | 01:54

A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.

Vendor-avast n/a Microsoft Corporation

Product-windows antivirus n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-4142

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.42% / 61.01%

7 Day CHG~0.00%

Published-06 Aug, 2012 | 16:00

Updated-11 Apr, 2025 | 00:51

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, ignores some characters in HTML documents in unspecified circumstances, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.

Vendor-n/a Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Opera

Product-mac_os_x opera_browser linux_kernel windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-4681

Matching Score-10

Assigner-IBM Corporation

View Details

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.25% / 48.27%

7 Day CHG~0.00%

Published-24 Mar, 2020 | 15:20

Updated-16 Sep, 2024 | 20:13

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171734.

Vendor-Oracle Corporation IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-solaris linux_kernel windows aix tivoli_netcool\/impact Tivoli Netcool Impact

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-1872

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-1.31% / 78.95%

7 Day CHG~0.00%

Published-12 Jun, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_xp windows_vista windows_7 internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0132

Matching Score-10

Assigner-HP Inc.

View Details

Matching Score-10

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.75% / 72.16%

7 Day CHG~0.00%

Published-04 Apr, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-business_availability_center windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7891

Matching Score-10

Assigner-Adobe Systems Incorporated

View Details

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.99% / 75.97%

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripting attacks.

Vendor-n/a Microsoft Corporation Adobe Inc.

Product-robohelp windows Adobe RoboHelp 2015.0.3 and earlier, RoboHelp 11 and earlier

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7282

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-2.26% / 83.96%

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."

Vendor-n/a Microsoft Corporation

Product-internet_explorer edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0767

Matching Score-10

Assigner-Adobe Systems Incorporated

View Details

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-16.38% / 94.61%

7 Day CHG~0.00%

Published-16 Feb, 2012 | 19:00

Updated-30 Jul, 2025 | 01:47

Known KEV||Action Due Date - 2022-06-22||The impacted product is end-of-life and should be disconnected if still in use.

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

Vendor-n/a Linux Kernel Organization, Inc Microsoft Corporation Google LLC Adobe Inc.Apple Inc.Oracle Corporation

Product-linux_kernel windows solaris android flash_player mac_os_x n/a Flash Player

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0017

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.3||MEDIUM

EPSS-47.53% / 97.62%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in inplview.aspx Vulnerability."

Vendor-n/a Microsoft Corporation

Product-sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0007

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.3||MEDIUM

EPSS-59.16% / 98.16%

7 Day CHG~0.00%

Published-10 Jan, 2012 | 21:00

Updated-11 Apr, 2025 | 00:51

The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style Sheets (CSS) escaped character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML input, aka "AntiXSS Library Bypass Vulnerability."

Vendor-n/a Microsoft Corporation

Product-anti-cross_site_scripting_library n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4726

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.21%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain other files.

Vendor-n/a Parallels International Gmbh Red Hat, Inc.Microsoft Corporation

Product-enterprise_linux windows parallels_plesk_panel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-3379

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-7.16% / 91.20%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability."

Vendor-n/a Microsoft Corporation

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-2078

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.21% / 43.32%

7 Day CHG~0.00%

Published-08 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter.

Vendor-n/a VMware (Broadcom Inc.)Microsoft Corporation

Product-windows vcenter_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-8559

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.79% / 72.95%

7 Day CHG~0.00%

Published-11 Jul, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8560.

Vendor-Microsoft Corporation

Product-exchange_server Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1976

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.3||MEDIUM

EPSS-79.01% / 99.02%

7 Day CHG~0.00%

Published-10 Aug, 2011 | 21:16

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote attackers to inject arbitrary web script or HTML via a parameter in a data source, aka "Report Viewer Controls XSS Vulnerability."

Vendor-n/a Microsoft Corporation

Product-report_viewer visual_studio n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2107

Matching Score-10

Assigner-Adobe Systems Incorporated

View Details

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-1.08% / 76.92%

7 Day CHG~0.00%

Published-07 Jun, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

Product-linux_kernel windows acrobat_reader acrobat flash_player android sunos mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-8642

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.90% / 74.68%

7 Day CHG~0.00%

Published-08 Aug, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to elevate privileges due to the way that Microsoft Edge validates JavaScript under specific conditions, aka "Microsoft Edge Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-8503.

Vendor-Microsoft Corporation

Product-edge windows_10 Microsoft Edge

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-29712

Matching Score-10

Assigner-IBM Corporation

View Details

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.15% / 36.11%

7 Day CHG~0.00%

Published-09 Jul, 2021 | 16:55

Updated-16 Sep, 2024 | 16:18

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 200966.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1264

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.98% / 85.99%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Active Directory Certificate Services Web Enrollment in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Active Directory Certificate Services Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_server_2003 windows_server_2008 windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-35222

Matching Score-10

Assigner-SolarWinds

View Details

Matching Score-10

Assigner-SolarWinds

CVSS Score-8||HIGH

EPSS-0.66% / 70.02%

7 Day CHG~0.00%

Published-31 Aug, 2021 | 12:14

Updated-04 Aug, 2024 | 00:33

Resource.aspx Reflected Cross-Site Scripting Vulnerability

This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.

Vendor-SolarWinds Worldwide, LLC.Microsoft Corporation

Product-windows orion_platform Orion Platform

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1891

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.64%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in a request to a script, aka "Contact Details Reflected XSS Vulnerability."

Vendor-n/a Microsoft Corporation

Product-sharepoint_services sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1896

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-4.3||MEDIUM

EPSS-10.69% / 93.03%

7 Day CHG~0.00%

Published-12 Oct, 2011 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "ExcelTable Reflected XSS Vulnerability."

Vendor-n/a Microsoft Corporation

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0242

Matching Score-10

Assigner-Apple Inc.

View Details

Matching Score-10

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 50.77%

7 Day CHG~0.00%

Published-21 Jul, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via vectors involving a URL that contains a username.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-1266

Matching Score-10

Assigner-Microsoft Corporation

View Details

Matching Score-10

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.46% / 62.96%

7 Day CHG~0.00%

Published-11 Sep, 2019 | 21:24

Updated-04 Aug, 2024 | 18:13

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'.

Vendor-Microsoft Corporation

Product-exchange_server Microsoft Exchange Server 2016 Microsoft Exchange Server 2019

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-4183

Matching Score-10

Assigner-MITRE Corporation

View Details

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 49.44%

7 Day CHG~0.00%

Published-05 Nov, 2010 | 16:28

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.

Vendor-htmlpurifier n/a Microsoft Corporation

Product-htmlpurifier internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-1820

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs