ByteOS

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.62% / 69.21%

7 Day CHG~0.00%

Published-28 Oct, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-insight_control_virtual_machine_management n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3291

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.84% / 73.81%

7 Day CHG~0.00%

Published-21 Oct, 2010 | 18:12

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP AssetCenter 5.0x through AC_5.03, and AssetManager 5.1x through AM_5.12 and 5.2x through AM_5.22, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-assetcenter assetmanager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-2021

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.17% / 38.13%

7 Day CHG~0.00%

Published-17 Jul, 2019 | 14:05

Updated-16 Sep, 2024 | 16:37

IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155345.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-qradar_security_information_and_event_manager linux_kernel QRadar SIEM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3936

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-42.35% / 97.36%

7 Day CHG~0.00%

Published-10 Nov, 2010 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS in Signurl.asp Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3985

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.85% / 73.98%

7 Day CHG~0.00%

Published-26 Oct, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Operations Orchestration before 9.0, when Internet Explorer 6.0 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-operations_orchestration internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3003

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.57% / 67.64%

7 Day CHG~0.00%

Published-10 Sep, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.0-11 on Linux allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-insight_diagnostics n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2429

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 50.77%

7 Day CHG~0.00%

Published-23 Jun, 2010 | 17:13

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.1.2, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer in a "404 Not Found" response.

Vendor-n/a Splunk LLC (Cisco Systems, Inc.)Microsoft Corporation

Product-splunk internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2091

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-5.71% / 90.07%

7 Day CHG~0.00%

Published-27 May, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.

Product-windows_server_2003 exchange_server internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2265

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-44.19% / 97.46%

7 Day CHG~0.00%

Published-14 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to sysinfo/sysinfomain.htm. NOTE: this can be leveraged with CVE-2010-1885 to execute arbitrary commands without user interaction.

Product-windows_server_2003 windows_xp windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2085

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-11.94% / 93.50%

7 Day CHG~0.00%

Published-27 May, 2010 | 18:32

Updated-11 Apr, 2025 | 00:51

The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the __VIEWSTATE parameter.

Product-.net_framework n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2665

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.68% / 70.71%

7 Day CHG~0.00%

Published-07 Jul, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote attackers to inject arbitrary web script or HTML via a data: URI, related to incorrect detection of the "opening site."

Vendor-unix n/a Microsoft Corporation Apple Inc.Opera

Product-windows opera_browser mac_os_x unix n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1489

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-22.05% / 95.57%

7 Day CHG~0.00%

Published-20 Apr, 2010 | 16:00

Updated-11 Apr, 2025 | 00:51

The XSS Filter in Microsoft Internet Explorer 8 does not properly perform neutering for the SCRIPT tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities, a different issue than CVE-2009-4074.

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1394

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.20% / 78.04%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML document fragments.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1762

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.91% / 74.86%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1036

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.60% / 68.63%

7 Day CHG~0.00%

Published-28 Apr, 2010 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP System Insight Manager before 6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-systems_insight_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1557

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.60% / 68.35%

7 Day CHG~0.00%

Published-14 May, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in HP Insight Control Server Migration before 6.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-insight_control_server_migration_for_windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1257

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-44.93% / 97.50%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.

Product-sharepoint_services windows_7 sharepoint_server windows_xp office_infopath windows_server_2008 windows_2003_server windows_vista internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1420

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.24% / 46.90%

7 Day CHG~0.00%

Published-21 Jul, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in CFNetwork in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted text/plain file.

Product-windows_7 cfnetwork windows_xp windows_vista safari n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6061

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-14.16% / 94.11%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."

Product-skype_for_business lync_room_system lync n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1418

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.20% / 78.07%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1389

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.01% / 76.14%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) paste or (2) drag-and-drop operation for a selection.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6123

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-12.05% / 93.53%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Excel for Mac 2011 and Excel 2016 for Mac allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message that is mishandled by Outlook for Mac, aka "Microsoft Outlook for Mac Spoofing Vulnerability."

Product-excel_for_mac n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-5159

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.77% / 72.60%

7 Day CHG~0.00%

Published-13 Mar, 2020 | 14:20

Updated-07 Aug, 2024 | 07:32

Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment.

Vendor-invisioncommunity n/a Microsoft Corporation

Product-invision_power_board internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0449

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 69.76%

7 Day CHG~0.00%

Published-31 Mar, 2010 | 17:35

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP SOA Registry Foundation 6.63 and 6.64 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

Vendor-n/a HP Inc.

Product-soa_registry_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2379

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.44% / 62.36%

7 Day CHG~0.00%

Published-09 Aug, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode, allows remote attackers to inject arbitrary web script or HTML via a crafted patch, related to content sniffing.

Vendor-n/a Mozilla Corporation Microsoft Corporation Apple Inc.

Product-bugzilla safari internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-4661

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.39% / 79.56%

7 Day CHG~0.00%

Published-10 Oct, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in HP Records Manager before 7.3.5 and 8.x before 8.1 Patch 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-records_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6138

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-24.02% / 95.82%

7 Day CHG~0.00%

Published-09 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 8 through 11 mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Internet Explorer XSS Filter Bypass Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6058

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-18.96% / 95.08%

7 Day CHG~0.00%

Published-14 Oct, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Edge XSS Filter Bypass."

Product-edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0452

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.67% / 70.36%

7 Day CHG~0.00%

Published-29 Mar, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in HP Project and Portfolio Management Center (PPMC, formerly Mercury IT Governance) 7.1 through SP10 and 7.5 through SP3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-hp-ux project_and_portfolio_management_center n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6099

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-25.18% / 95.97%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in ASP.NET in Microsoft .NET Framework 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka ".NET Elevation of Privilege Vulnerability."

Product-.net_framework n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6144

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-24.12% / 95.85%

7 Day CHG~0.00%

Published-09 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Browser XSS Filter Bypass Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0544

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.76% / 72.43%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0190

Matching Score-6

Assigner-Adobe Systems Incorporated

Matching Score-6

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-1.39% / 79.59%

7 Day CHG~0.00%

Published-14 Apr, 2010 | 15:44

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-4185

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.64% / 69.73%

7 Day CHG~0.00%

Published-05 Feb, 2010 | 22:13

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in proxy/smhui/getuiinfo in HP System Management Homepage (SMH) before 6.0 allows remote attackers to inject arbitrary web script or HTML via the servercert parameter.

Vendor-n/a HP Inc.

Product-system_management_homepage n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-4804

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.31% / 53.56%

7 Day CHG~0.00%

Published-23 Apr, 2010 | 14:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the Calendar Base (cal) extension before 1.1.1 for TYPO3, when Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via "search parameters."

Vendor-mario_matzulla n/a TYPO3 Association Microsoft Corporation

Product-calendar_base typo3 internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-4040

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.61%

7 Day CHG~0.00%

Published-20 Nov, 2009 | 19:00

Updated-16 Sep, 2024 | 16:23

Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.0.17 and 2.5.x before 2.5.2, when used with Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the search page.

Vendor-n/a Thorsten Rinne (phpMyFAQ)Microsoft Corporation

Product-internet_explorer phpmyfaq n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-4070

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-18.34% / 94.97%

7 Day CHG~0.00%

Published-10 Sep, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync XSS Information Disclosure Vulnerability."

Product-lync_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-1332

Matching Score-6

Matching Score-6

Product-sql_server_2019_reporting_services sql_server_2017_reporting_services power_bi_report_server SQL Server 2019 Reporting Services SQL Server 2017 Reporting Services Power BI Report Server

CVSS Score-6.1||MEDIUM

EPSS-2.05% / 83.14%

7 Day CHG~0.00%

Published-10 Dec, 2019 | 21:40

Updated-04 Aug, 2024 | 18:13

A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web request to an affected SSRS server, aka 'Microsoft SQL Server Reporting Services XSS Vulnerability'.

Vendor-Microsoft Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-3731

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.20% / 83.73%

7 Day CHG~0.00%

Published-16 Dec, 2009 | 18:00

Updated-07 Aug, 2024 | 06:38

Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.

Vendor-webworks n/a VMware (Broadcom Inc.)Microsoft Corporation

Product-publisher epublisher lab_manager esx_server vcenter_lab_manager stage_manager windows server vcenter vcenter_stage_manager help n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-0817

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-49.25% / 97.70%

7 Day CHG~0.00%

Published-29 Apr, 2010 | 21:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and SharePoint Services 3.0 SP1 and SP2, versions, allows remote attackers to inject arbitrary web script or HTML via the cid0 parameter.

Product-sharepoint_server sharepoint_services n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-2684

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-4.06% / 88.08%

7 Day CHG~0.00%

Published-13 Oct, 2009 | 10:00

Updated-07 Aug, 2024 | 05:59

Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-17039

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.17%

7 Day CHG~0.00%

Published-14 Sep, 2018 | 07:00

Updated-05 Aug, 2024 | 10:39

MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.

Vendor-1234n n/a Microsoft Corporation

Product-minicms internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-2420

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-14.54% / 94.20%

7 Day CHG~0.00%

Published-15 Aug, 2015 | 00:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and R2 before Rollup 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "System Center Operations Manager Web Console XSS Vulnerability."

Product-system_center_operations_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-34330

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.13% / 33.26%

7 Day CHG~0.00%

Published-04 Jan, 2023 | 17:07

Updated-10 Apr, 2025 | 13:57

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229469.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-sterling_b2b_integrator aix windows linux_kernel Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-0310

Matching Score-6

Assigner-Trellix

Matching Score-6

Assigner-Trellix

CVSS Score-6.1||MEDIUM

EPSS-0.17% / 38.75%

7 Day CHG~0.00%

Published-10 Jan, 2024 | 10:43

Updated-03 Sep, 2024 | 18:29

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy configuration.

Vendor-Microsoft Corporation Musarubra US LLC (Trellix)

Product-windows endpoint_security_web_control Trellix Endpoint Security (ENS) Web Control endpoint_security

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-5092

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-20.51% / 95.34%

7 Day CHG~0.00%

Published-09 Sep, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Product-fast_esp sharepoint_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-34362

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.14% / 34.00%

7 Day CHG~0.00%

Published-08 Feb, 2023 | 18:30

Updated-24 Mar, 2025 | 20:49

IBM Sterling Secure Proxy HOST header injection

IBM Sterling Secure Proxy 6.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 230523.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-linux_kernel sterling_secure_proxy linux_on_ibm_z windows aix Sterling Secure Proxy

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-34160

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.30% / 52.75%

7 Day CHG~0.00%

Published-08 Jul, 2022 | 17:00

Updated-16 Sep, 2024 | 22:03

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 229330.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-linux_kernel cics_tx CICS TX Advanced CICS TX Standard

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-1333

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.69% / 70.77%

7 Day CHG~0.00%

Published-17 Apr, 2009 | 14:00

Updated-07 Aug, 2024 | 05:13

Cross-site scripting (XSS) vulnerability in refresh_rate.htm in the web interface on the HP Deskjet 6840 printer with firmware XF1M131A allows remote attackers to inject arbitrary web script or HTML via the POST request body.

Vendor-n/a HP Inc.

Product-deskjet_6840 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-1757

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-12.41% / 93.64%

7 Day CHG~0.00%

Published-10 Jun, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability."