ByteOS

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://koha-community.org/koha-3-16-6-release/	x_refsource_CONFIRM x_transferred
http://www.securityfocus.com/bid/71803	vdb-entry x_refsource_BID x_transferred
http://koha-community.org/koha-3-18-2-release/	x_refsource_CONFIRM x_transferred
http://secunia.com/advisories/61187	third-party-advisory x_refsource_SECUNIA x_transferred
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425	x_refsource_CONFIRM x_transferred

Hyperlink: http://koha-community.org/koha-3-16-6-release/

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securityfocus.com/bid/71803

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: http://koha-community.org/koha-3-18-2-release/

Resource:

x_refsource_CONFIRM

x_transferred

cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:02 Jan, 2015 | 20:59

Updated At:12 Apr, 2025 | 10:46

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

koha>>koha>>Versions up to 3.16.05(inclusive)

koha>>koha>>3.18.0

cpe:2.3:a:koha:koha:3.18.0:*:*:*:*:*:*:*

koha>>koha>>3.18.1

cpe:2.3:a:koha:koha:3.18.1:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425	cve@mitre.org	N/A
http://koha-community.org/koha-3-16-6-release/	cve@mitre.org	Patch Vendor Advisory
http://koha-community.org/koha-3-18-2-release/	cve@mitre.org	Patch Vendor Advisory
http://secunia.com/advisories/61187	cve@mitre.org	N/A
http://www.securityfocus.com/bid/71803	cve@mitre.org	Exploit
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425	af854a3a-2127-422b-91ae-364da2661108	N/A
http://koha-community.org/koha-3-16-6-release/	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
http://koha-community.org/koha-3-18-2-release/	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
http://secunia.com/advisories/61187	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/71803	af854a3a-2127-422b-91ae-364da2661108	Exploit

Hyperlink: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://koha-community.org/koha-3-16-6-release/

Source: cve@mitre.org

Resource:

Patch

Vendor Advisory

Hyperlink: http://koha-community.org/koha-3-18-2-release/

Source: cve@mitre.org

Resource:

Patch

Vendor Advisory

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/71803

Source: cve@mitre.org

Resource:

Exploit

Hyperlink: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://koha-community.org/koha-3-16-6-release/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Hyperlink: http://koha-community.org/koha-3-18-2-release/

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/71803

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Similar CVEs

12244Records found

CVE-2008-1168

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 70.58%

7 Day CHG~0.00%

Published-05 Mar, 2008 | 23:00

Updated-07 Aug, 2024 | 08:08

Cross-site scripting (XSS) vulnerability in Squid Analysis Report Generator (Sarg) 2.2.3.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent header, which is not properly handled when displaying the Squid proxy log. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-sarg n/a

Product-squid_analysis_report_generator n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1234

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-7.19% / 91.48%

7 Day CHG~0.00%

Published-27 Mar, 2008 | 10:00

Updated-07 Aug, 2024 | 08:17

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to inject arbitrary web script or HTML via event handlers, aka "Universal XSS using event handlers."

Vendor-n/a Mozilla Corporation

Product-firefox thunderbird seamonkey n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1222

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.47% / 64.59%

7 Day CHG~0.00%

Published-10 Mar, 2008 | 17:00

Updated-07 Aug, 2024 | 08:17

Cross-site scripting (XSS) vulnerability in Dokeos 1.8.4 before SP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-dokeos n/a

Product-open_source_learning_and_knowledge_management_tool n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-5731

Matching Score-4

Matching Score-4

CVSS Score-6.1||MEDIUM

EPSS-0.33% / 55.44%

7 Day CHG~0.00%

Published-17 Apr, 2020 | 18:30

Updated-04 Aug, 2024 | 08:39

In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting.

Vendor-openmrs n/a

Product-openmrs OpenMRS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0700

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 52.30%

7 Day CHG~0.00%

Published-12 Feb, 2008 | 00:00

Updated-17 Sep, 2024 | 04:25

Cross-site scripting (XSS) vulnerability in search.php in Crux Software CruxCMS 3.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-crux_software n/a

Product-cruxcms n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-5927

Matching Score-4

Assigner-F5, Inc.

Matching Score-4

Assigner-F5, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.35% / 57.23%

7 Day CHG~0.00%

Published-26 Aug, 2020 | 15:14

Updated-04 Aug, 2024 | 08:47

In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, BIG-IP ASM Configuration utility Stored-Cross Site Scripting.

Vendor-n/a F5, Inc.

Product-big-ip_application_security_manager BIG-IP ASM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1047

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.56%

7 Day CHG~0.00%

Published-27 Feb, 2008 | 19:00

Updated-07 Aug, 2024 | 08:08

Cross-site scripting (XSS) vulnerability in tiki-edit_article.php in TikiWiki before 1.9.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-tiki n/a

Product-tikiwiki_cms\/groupware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0618

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.40% / 60.36%

7 Day CHG~0.00%

Published-06 Feb, 2008 | 11:00

Updated-17 Sep, 2024 | 01:46

Multiple cross-site scripting (XSS) vulnerabilities in the DMSGuestbook 1.8.0 and 1.7.0 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) gbname, (2) gbemail, (3) gburl, and (4) gbmsg parameters to unspecified programs. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-dmsguestbook_project n/a

Product-dmsguestbook n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0940

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 52.76%

7 Day CHG~0.00%

Published-25 Feb, 2008 | 20:00

Updated-16 Sep, 2024 | 22:14

Cross-site scripting (XSS) vulnerability in Plain Black WebGUI before 7.4.24 allows remote attackers to inject arbitrary web script or HTML when creating a username, a different vulnerability than CVE-2007-0407.

Vendor-webgui n/a

Product-webgui n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0455

Matching Score-4

Assigner-MITRE Corporation

Product-enterprise_linux_server http_server enterprise_linux_workstation enterprise_linux jboss_enterprise_application_platform enterprise_linux_desktop n/a

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-47.80% / 97.66%

7 Day CHG-4.17%

Published-25 Jan, 2008 | 00:00

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

Vendor-n/a Red Hat, Inc.The Apache Software Foundation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1036

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.64% / 85.53%

7 Day CHG~0.00%

Published-02 Jun, 2008 | 14:00

Updated-07 Aug, 2024 | 08:08

The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.

Vendor-n/a Red Hat, Inc.Apple Inc.

Product-enterprise_linux mac_os_x_server mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1037

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.57% / 68.47%

7 Day CHG~0.00%

Published-27 Feb, 2008 | 19:00

Updated-07 Aug, 2024 | 08:08

Cross-site scripting (XSS) vulnerability in the file listing function in the web management interface in Packeteer PacketShaper and PolicyCenter 8.2.2 allows remote attackers to inject arbitrary web script or HTML via the FILELIST parameter to an arbitrary component, which triggers injection into an Error Report page.

Vendor-packeteer n/a

Product-policycenter packetshaper n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1025

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.97% / 76.41%

7 Day CHG~0.00%

Published-17 Apr, 2008 | 17:00

Updated-07 Aug, 2024 | 08:08

Cross-site scripting (XSS) vulnerability in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a colon in the hostname portion.

Vendor-n/a Apple Inc.

Product-safari webkit n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0848

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.47% / 64.59%

7 Day CHG~0.00%

Published-21 Feb, 2008 | 00:00

Updated-07 Aug, 2024 | 08:01

Cross-site scripting (XSS) vulnerability in lostsheep.php in Crafty Syntax Live Help (CSLH) before 2.14.16, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the versions claimed by the original researcher are probably incorrect.

Vendor-crafty_syntax_live_help n/a

Product-crafty_syntax_live_help n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0867

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.47% / 64.59%

7 Day CHG~0.00%

Published-21 Feb, 2008 | 01:00

Updated-07 Aug, 2024 | 08:01

Cross-site scripting (XSS) vulnerability in portal/server.pt in BEA AquaLogic Interaction 6.1 through MP1 and Plumtree Foundation 6.0 through SP1 allows remote attackers to inject arbitrary web script or HTML via the name parameter.

Vendor-n/a BEA Systems, Inc.

Product-plumtree_foundation aqualogic_interaction n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0919

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-7.20% / 91.48%

7 Day CHG~0.00%

Published-22 Feb, 2008 | 23:00

Updated-07 Aug, 2024 | 08:01

Cross-site scripting (XSS) vulnerability in session/login.php in Open Source Security Information Management (OSSIM) 0.9.9 rc5 and earlier allows remote attackers to inject arbitrary web script or HTML via the dest parameter.

Vendor-open_source_security_information_management n/a

Product-os-sim n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0239

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-9.55% / 92.75%

7 Day CHG~0.00%

Published-11 Jan, 2008 | 22:00

Updated-07 Aug, 2024 | 07:39

Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager 6.0 SP1 through SP3, 7.0, and 7.1 allow remote attackers to inject arbitrary HTML or web script via the (1) cntry or lang parameters to /idm/login.jsp, (2) resultsForm parameter to /idm/account/findForSelect.jsp, or (3) activeControl parameter to /idm/user/main.jsp.

Vendor-n/a Sun Microsystems (Oracle Corporation)

Product-java_system_identity_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-6470

Matching Score-4

Assigner-Chrome

Matching Score-4

Assigner-Chrome

CVSS Score-6.1||MEDIUM

EPSS-1.16% / 78.41%

7 Day CHG~0.00%

Published-21 May, 2020 | 03:46

Updated-04 Aug, 2024 | 09:02

Insufficient validation of untrusted input in clipboard in Google Chrome prior to 83.0.4103.61 allowed a local attacker to inject arbitrary scripts or HTML (UXSS) via crafted clipboard contents.

Vendor-Google LLC openSUSE Fedora Project Debian GNU/Linux

Product-debian_linux chrome fedora backports_sle leap Chrome

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0669

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 49.49%

7 Day CHG~0.00%

Published-12 Feb, 2008 | 00:00

Updated-16 Sep, 2024 | 23:45

Cross-site scripting (XSS) vulnerability in search.cgi in Sift Unity allows remote attackers to inject arbitrary web script or HTML via the qt parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-sift n/a

Product-unity n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0913

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.14%

7 Day CHG~0.00%

Published-22 Feb, 2008 | 23:00

Updated-16 Sep, 2024 | 19:36

Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB or IP.Board) 2.3.4 allows remote attackers to inject arbitrary web script or HTML via crafted BBCodes in an unspecified context.

Vendor-invision_power_services n/a

Product-invision_power_board n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0868

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.90%

7 Day CHG~0.00%

Published-21 Feb, 2008 | 01:00

Updated-07 Aug, 2024 | 08:01

Cross-site scripting (XSS) vulnerability in Groupspace in BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 1 allows remote authenticated users to inject arbitrary web script or HTML via unknown vectors.

Vendor-n/a Oracle Corporation BEA Systems, Inc.

Product-weblogic_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0834

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 52.59%

7 Day CHG~0.00%

Published-20 Feb, 2008 | 21:00

Updated-07 Aug, 2024 | 08:01

Cross-site scripting (XSS) vulnerability in Lotus Quickr for i5/OS before 8.0.0.2 Hotfix 11, when anonymous access is disabled on HTTP ports, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a IBM Corporation

Product-lotus_quickr n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0354

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.18% / 78.56%

7 Day CHG~0.00%

Published-18 Jan, 2008 | 21:00

Updated-07 Aug, 2024 | 07:39

Cross-site scripting (XSS) vulnerability in the chat client in IBM Lotus Sametime 7.5 and 7.5.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted message, which triggers code execution after a mouseover event initiated by the victim.

Vendor-n/a IBM Corporation

Product-lotus_sametime n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0522

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.50% / 65.83%

7 Day CHG~0.00%

Published-31 Jan, 2008 | 19:30

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in multiple Hal Networks shopping-cart products allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-hal_networks n/a

Product-shop_hal_v1 perl__cgi_cart php_cart n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0539

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.55% / 81.23%

7 Day CHG~0.00%

Published-01 Feb, 2008 | 19:41

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in dms/policy/rep_request.php in F5 BIG-IP Application Security Manager (ASM) 9.4.3 allows remote attackers to inject arbitrary web script or HTML via the report_type parameter.

Vendor-n/a F5, Inc.

Product-big-ip_application_security_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-0396

Matching Score-4

Assigner-Cisco Systems, Inc.

Product-unified_communications_manager_im_and_presence_service Cisco Unified Communications Manager IM And Presence Service unknown

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.35% / 57.29%

7 Day CHG~0.00%

Published-18 Jul, 2018 | 23:00

Updated-29 Nov, 2024 | 14:49

A vulnerability in the web framework of the Cisco Unified Communications Manager IM and Presence Service software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting certain malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve25985.

Vendor-n/a Cisco Systems, Inc.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0769

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.56%

7 Day CHG~0.00%

Published-13 Feb, 2008 | 23:00

Updated-07 Aug, 2024 | 07:54

Cross-site scripting (XSS) vulnerability in Livelink ECM 9.0.0 through 9.7.0 and possibly earlier does not set the charset, which allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded input.

Vendor-n/a Open Text Corporation

Product-livelink_ecm n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0757

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.56%

7 Day CHG~0.00%

Published-13 Feb, 2008 | 20:00

Updated-07 Aug, 2024 | 07:54

Cross-site scripting (XSS) vulnerability in index.php in MercuryBoard 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter (aka the message text area), which leads to an injection in the messenger during private message (PM) preview. NOTE: some of these details are obtained from third party information.

Vendor-mercuryboard n/a

Product-mercuryboard_message_board n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0460

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-15.66% / 94.60%

7 Day CHG~0.00%

Published-25 Jan, 2008 | 15:00

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki_botquery_ext internet_explorer mediawiki n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0496

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.57% / 68.23%

7 Day CHG~0.00%

Published-30 Jan, 2008 | 21:00

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in index.php in AmpJuke 0.7.0 allows remote attackers to inject arbitrary web script or HTML via the limit parameter in a search action.

Vendor-ampjuke n/a

Product-ampjuke n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0980

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.37% / 58.54%

7 Day CHG~0.00%

Published-25 Feb, 2008 | 23:00

Updated-07 Aug, 2024 | 08:01

Multiple cross-site scripting (XSS) vulnerabilities in Spyce - Python Server Pages (PSP) 2.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the url or type parameter to docs/examples/redirect.spy; (2) the x parameter to docs/examples/handlervalidate.spy; (3) the name parameter to spyce/examples/request.spy; (4) the Name parameter to spyce/examples/getpost.spy; (5) the mytextarea parameter, the mypass parameter, or an empty parameter to spyce/examples/formtag.spy; (6) the newline parameter to the default URI under demos/chat/; (7) the text1 parameter to docs/examples/formintro.spy; or (8) the mytext or mydate parameter to docs/examples/formtag.spy.

Vendor-spyce n/a

Product-spyce n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-1000148

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-9.35% / 92.67%

7 Day CHG~0.00%

Published-10 Oct, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Reflected XSS in wordpress plugin s3-video v0.983

Vendor-s3-video_project n/a

Product-s3-video n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0415

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.48% / 80.81%

7 Day CHG~0.00%

Published-08 Feb, 2008 | 21:00

Updated-07 Aug, 2024 | 07:46

Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to execute script outside of the sandbox and conduct cross-site scripting (XSS) attacks via multiple vectors including the XMLDocument.load function, aka "JavaScript privilege escalation bugs."

Vendor-n/a Mozilla Corporation

Product-firefox thunderbird seamonkey n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-0716

Matching Score-4

Assigner-QNAP Systems, Inc.

Matching Score-4

Assigner-QNAP Systems, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.27% / 50.39%

7 Day CHG~0.00%

Published-30 Nov, 2018 | 14:00

Updated-05 Aug, 2024 | 03:35

Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions could allow remote attackers to inject Javascript code in the compromised application.

Vendor-QNAP Systems, Inc.

Product-qts Qsync Central

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-6367

Matching Score-4

Assigner-SAP SE

Product-netweaver_composite_application_framework SAP NetWeaver Composite Application Framework

Matching Score-4

Assigner-SAP SE

CVSS Score-8.2||HIGH

EPSS-1.25% / 79.19%

7 Day CHG~0.00%

Published-20 Oct, 2020 | 13:32

Updated-04 Aug, 2024 | 09:02

There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that the script should not be trusted, and will execute the script, resulting in sensitive information being disclosed or modified.

Vendor-SAP SE

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-6319

Matching Score-4

Assigner-SAP SE

Matching Score-4

Assigner-SAP SE

CVSS Score-6.1||MEDIUM

EPSS-0.32% / 54.97%

7 Day CHG~0.00%

Published-15 Oct, 2020 | 01:52

Updated-04 Aug, 2024 | 08:55

SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal authentication information of the user, such as data relating to his or her current session and limitedly impact confidentiality and integrity of the application, leading to Reflected Cross Site Scripting.

Vendor-SAP SE

Product-netweaver_application_server_java SAP NetWeaver Application Server Java

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0463

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.56%

7 Day CHG~0.00%

Published-25 Jan, 2008 | 15:00

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in the Workflow 4.7.x before 4.7.x-1.2 and 5.x before 5.x-1.2 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving node properties.

Vendor-n/a The Drupal Association

Product-workflow n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-16863

Matching Score-4

Assigner-Atlassian

Matching Score-4

Assigner-Atlassian

CVSS Score-6.1||MEDIUM

EPSS-0.20% / 42.38%

7 Day CHG~0.00%

Published-18 Jan, 2018 | 18:00

Updated-17 Sep, 2024 | 02:58

The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a project or filter.

Vendor-Atlassian

Product-jira Atlassian Jira

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0720

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.47% / 64.59%

7 Day CHG~0.00%

Published-12 Feb, 2008 | 01:00

Updated-07 Aug, 2024 | 07:54

Cross-site scripting (XSS) vulnerability in Webmin 1.370 and 1.390 and Usermin 1.300 and 1.320 allows remote attackers to inject arbitrary web script or HTML via the search parameter to webmin_search.cgi (aka the search section), and possibly other components accessed through a "search box" or "open file box." NOTE: some of these details are obtained from third party information.

Vendor-n/a Webmin

Product-webmin usermin n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0722

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.68% / 71.37%

7 Day CHG~0.00%

Published-12 Feb, 2008 | 01:00

Updated-07 Aug, 2024 | 07:54

Cross-site scripting (XSS) vulnerability in index.php in Pagetool 1.0.7 allows remote attackers to inject arbitrary web script or HTML via the search_term parameter in a pagetool_search action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-pagetool n/a

Product-pagetool n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-1000037

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.41% / 61.33%

7 Day CHG-0.08%

Published-06 Nov, 2019 | 18:27

Updated-06 Aug, 2024 | 03:47

Pagure: XSS possible in file attachment endpoint

Vendor-n/a Red Hat, Inc.Fedora Project

Product-pagure fedora enterprise_linux n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0444

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.47% / 64.59%

7 Day CHG~0.00%

Published-24 Jan, 2008 | 23:00

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via subtext parameter to unspecified components.

Vendor-elog n/a

Product-elog n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-6254

Matching Score-4

Assigner-SAP SE

Matching Score-4

Assigner-SAP SE

CVSS Score-6.1||MEDIUM

EPSS-0.19% / 40.94%

7 Day CHG~0.00%

Published-12 May, 2020 | 17:57

Updated-04 Aug, 2024 | 08:55

SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors, allowing XSS payload reflecting in the response, leading to reflected Cross Site Scripting.

Vendor-SAP SE

Product-enterprise_threat_detection SAP Enterprise Threat Detection

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0552

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-6.41% / 90.91%

7 Day CHG~0.00%

Published-01 Feb, 2008 | 19:41

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in index.php in eTicket 1.5.6-RC4 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

Vendor-eticket n/a

Product-eticket n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0783

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-3.84% / 88.02%

7 Day CHG~0.00%

Published-14 Feb, 2008 | 22:00

Updated-07 Aug, 2024 | 07:54

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via (1) the view_type parameter to graph.php; (2) the filter parameter to graph_view.php; (3) the action parameter to the draw_navigation_text function in lib/functions.php, reachable through index.php (aka the login page) or data_input.php; or (4) the login_username parameter to index.php.

Vendor-n/a The Cacti Group, Inc.

Product-cacti n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0751

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.50% / 65.53%

7 Day CHG~0.00%

Published-13 Feb, 2008 | 19:00

Updated-07 Aug, 2024 | 07:54

Cross-site scripting (XSS) vulnerability in the Freetag before 2.96 plugin for S9Y Serendipity, when using Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to plugin/tag/.

Vendor-s9y n/a Microsoft Corporation

Product-serendipity_event_freetag internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0497

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.86% / 74.92%

7 Day CHG~0.00%

Published-30 Jan, 2008 | 21:00

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in action.php in Nucleus CMS 3.31 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO, which is not quoted when processing PHP_SELF.

Vendor-nucleus_cms n/a

Product-nucleus_cms n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-14425

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.62% / 69.79%

7 Day CHG~0.00%

Published-30 May, 2019 | 17:07

Updated-05 Aug, 2024 | 09:29

There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.

Vendor-n/a Synacor, Inc.

Product-zimbra_collaboration_suite n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-1000029

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.12%

7 Day CHG~0.00%

Published-09 Feb, 2018 | 23:00

Updated-05 Aug, 2024 | 12:33

mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier contains a Cross Site Scripting (XSS) vulnerability in index view (/) that can result in . This attack appear to be exploitable via Payload delivered via the type, name, and value parameters of /Query/set_preference and the name and value parameters of /Query/preference. Payload executed when the user visits the index view (/).

Vendor-elsa_project n/a

Product-elsa n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-5729

Matching Score-4

Matching Score-4