ByteOS

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-73.35% / 98.74%

7 Day CHG~0.00%

Published-09 May, 2007 | 21:00

Updated-07 Aug, 2024 | 13:42

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx.

Product-sharepoint_server sharepoint_services windows_2003 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-1106

Matching Score-10

Matching Score-10

CVSS Score-5.4||MEDIUM

EPSS-1.85% / 82.27%

7 Day CHG~0.00%

Published-21 May, 2020 | 22:53

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1099, CVE-2020-1100, CVE-2020-1101.

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0017

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.41% / 79.72%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0065, and CVE-2017-0068.

Product-edge Edge

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0107

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-2.32% / 84.16%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

Microsoft SharePoint Server fails to sanitize crafted web requests, allowing remote attackers to run cross-script in local security context, aka "Microsoft SharePoint XSS Vulnerability."

Product-sharepoint_foundation SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-19719

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-50.11% / 97.74%

7 Day CHG~0.00%

Published-11 Dec, 2019 | 03:05

Updated-05 Aug, 2024 | 02:25

Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.

Vendor-tableau n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-windows tableau_server linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-19692

Matching Score-10

Assigner-Trend Micro, Inc.

Matching Score-10

Assigner-Trend Micro, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.56% / 67.37%

7 Day CHG~0.00%

Published-20 Dec, 2019 | 04:05

Updated-05 Aug, 2024 | 02:25

Trend Micro Apex One (2019) is affected by a cross-site scripting (XSS) vulnerability on the product console. Note that the Japanese version of the product is NOT affected.

Vendor-Microsoft Corporation Trend Micro Incorporated

Product-apex_one windows Trend Micro Apex Central

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0055

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.39% / 79.57%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka "Microsoft IIS Server XSS Elevation of Privilege Vulnerability."

Product-windows_server_2008 windows_7 windows_server_2012 windows_server_2016 windows_8.1 windows_rt_8.1 windows_vista windows_10 IIS Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0110

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.21% / 78.14%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."

Product-exchange_server Exchange Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-1055

Matching Score-10

Matching Score-10

CVSS Score-5.4||MEDIUM

EPSS-0.71% / 71.42%

7 Day CHG~0.00%

Published-21 May, 2020 | 22:52

Updated-28 Feb, 2025 | 20:15

A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs, aka 'Microsoft Active Directory Federation Services Cross-Site Scripting Vulnerability'.

Product-windows_server_2019 windows_server_2016 windows_10 Windows Server, version 1909 (Server Core installation)Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows Server Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation)Windows 10 Version 1903 for 32-bit Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-1050

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.03% / 76.37%

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-04 Aug, 2024 | 06:25

A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'. This CVE ID is unique from CVE-2020-1049.

Product-dynamics_365_server Dynamics 365 Server, version 9.0 (on-premises)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-6154

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.29% / 51.89%

7 Day CHG~0.00%

Published-23 Aug, 2019 | 21:06

Updated-06 Aug, 2024 | 01:22

The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).

Vendor-n/a WatchGuard Technologies, Inc.Microsoft Corporation

Product-windows fireware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

CVE-2006-0032

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-66.59% / 98.47%

7 Day CHG~0.00%

Published-12 Sep, 2006 | 23:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.

Product-windows_xp windows_2000 windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-1823

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-25.98% / 96.07%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID, aka "Lync Server Content Sanitization Vulnerability."

Product-lync_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2005-0563

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-22.96% / 95.70%

7 Day CHG~0.00%

Published-14 Jun, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL ("jav&#X41sc
ript:") in an IMG tag.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2004-2704

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-25.15% / 95.97%

7 Day CHG~0.00%

Published-06 Oct, 2007 | 21:00

Updated-03 Apr, 2025 | 01:03

Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.

Vendor-hastymail n/a Microsoft Corporation

Product-hastymail internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-3212

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-5.22% / 89.57%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, aka "Internet Explorer XSS Filter Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-17070

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.44% / 62.23%

7 Day CHG~0.00%

Published-10 Oct, 2019 | 10:51

Updated-05 Aug, 2024 | 01:33

The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.

Vendor-lqd n/a Microsoft Corporation

Product-liquid_speech_balloon internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0532

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-3.47% / 87.09%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0531 and CVE-2014-0533.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0562

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 69.88%

7 Day CHG~0.00%

Published-17 Sep, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-6905

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.24%

7 Day CHG~0.00%

Published-05 Dec, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Mozilla Corporation Cybozu, Inc.Microsoft Corporation

Product-garoon firefox internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-6903

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.24%

7 Day CHG~0.00%

Published-05 Dec, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Mozilla Corporation Cybozu, Inc.Microsoft Corporation

Product-garoon firefox internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2004-0203

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-25.67% / 96.03%

7 Day CHG~0.00%

Published-12 Aug, 2004 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1467

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 69.90%

7 Day CHG~0.00%

Published-24 Oct, 2007 | 23:00

Updated-03 Apr, 2025 | 01:03

Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

Vendor-phorum unix n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel all_windows unix phorum n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-5072

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-6.93% / 91.03%

7 Day CHG~0.00%

Published-11 Dec, 2013 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-0712

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-18.97% / 95.08%

7 Day CHG~0.00%

Published-17 Oct, 2003 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access (OWA) allows remote attackers to execute arbitrary web script.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-3648

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 52.55%

7 Day CHG~0.00%

Published-28 Jun, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in KENT-WEB POST-MAIL before 6.7, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.

Vendor-kent-web n/a Microsoft Corporation

Product-post-mail internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1372

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.35% / 56.41%

7 Day CHG~0.00%

Published-17 Oct, 2007 | 01:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in links.php script in myPHPNuke 1.8.8, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the (1) ratenum or (2) query parameters.

Vendor-myphpnuke unix n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel all_windows myphpnuke unix n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-26582

Matching Score-10

Assigner-Hewlett Packard Enterprise (HPE)

Matching Score-10

Assigner-Hewlett Packard Enterprise (HPE)

CVSS Score-6.1||MEDIUM

EPSS-0.30% / 52.82%

7 Day CHG~0.00%

Published-15 Apr, 2021 | 17:50

Updated-03 Aug, 2024 | 20:26

A security vulnerability in HPE IceWall SSO Domain Gateway Option (Dgfw) module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windows and 11.0 on Windows could be exploited remotely to allow cross-site scripting (XSS).

Vendor-n/a Microsoft Corporation HP Inc.Red Hat, Inc.

Product-icewall_sso_dgfw windows enterprise_linux hp-ux IceWall SSO Dgfw

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7280

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-10.39% / 92.92%

7 Day CHG+1.30%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7206.

Product-edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7206

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-2.54% / 84.87%

7 Day CHG+0.35%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Product-edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-8160

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.30% / 78.91%

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:11

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to information disclosure.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-0942

Matching Score-10

Assigner-Dell

Matching Score-10

Assigner-Dell

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 51.61%

7 Day CHG~0.00%

Published-22 May, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a The Apache Software Foundation ELAN Microelectronics Corporation Microsoft Corporation

Product-http_server internet_information_server rsa_authentication_agent n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2002-1700

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-30.37% / 96.54%

7 Day CHG~0.00%

Published-21 Jun, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.

Vendor-n/a Macromedia, Inc.Microsoft Corporation

Product-internet_information_services coldfusion windows_2000 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-3591

Matching Score-10

Assigner-Trellix

Matching Score-10

Assigner-Trellix

CVSS Score-3.9||LOW

EPSS-0.31% / 53.79%

7 Day CHG~0.00%

Published-24 Jul, 2019 | 14:30

Updated-04 Aug, 2024 | 19:12

DLP Endpoint ePO extension vulnerable to XSS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.

Vendor-McAfee, LLC Microsoft Corporation

Product-windows data_loss_prevention_endpoint Data Loss Prevention ePO extension

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7251

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-7.63% / 91.52%

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."

Product-sql_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-18654

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.30% / 52.41%

7 Day CHG~0.00%

Published-01 Nov, 2019 | 18:25

Updated-05 Aug, 2024 | 01:54

A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.

Vendor-avg n/a Microsoft Corporation

Product-anti-virus windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-18653

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.30% / 52.41%

7 Day CHG~0.00%

Published-01 Nov, 2019 | 18:25

Updated-05 Aug, 2024 | 01:54

A Cross Site Scripting (XSS) issue exists in Avast AntiVirus (Free, Internet Security, and Premiere Edition) 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.

Vendor-avast n/a Microsoft Corporation

Product-windows antivirus n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-4142

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.42% / 61.01%

7 Day CHG~0.00%

Published-06 Aug, 2012 | 16:00

Updated-11 Apr, 2025 | 00:51

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, ignores some characters in HTML documents in unspecified circumstances, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.

Vendor-n/a Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Opera

Product-mac_os_x opera_browser linux_kernel windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-4681

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.25% / 48.27%

7 Day CHG~0.00%

Published-24 Mar, 2020 | 15:20

Updated-16 Sep, 2024 | 20:13

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 171734.

Vendor-Oracle Corporation IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-solaris linux_kernel windows aix tivoli_netcool\/impact Tivoli Netcool Impact

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-1872

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.31% / 78.95%

7 Day CHG~0.00%

Published-12 Jun, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability."

Product-windows_xp windows_vista windows_7 internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0132

Matching Score-10

Assigner-HP Inc.

Matching Score-10

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.75% / 72.16%

7 Day CHG~0.00%

Published-04 Apr, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-business_availability_center windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7891

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-0.99% / 75.97%

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripting attacks.

Vendor-n/a Microsoft Corporation Adobe Inc.

Product-robohelp windows Adobe RoboHelp 2015.0.3 and earlier, RoboHelp 11 and earlier

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7282

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-2.26% / 83.96%

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."

Product-internet_explorer edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0767

Matching Score-10

Matching Score-10

Vendor-n/a Linux Kernel Organization, Inc Microsoft Corporation Google LLC Adobe Inc.Apple Inc.Oracle Corporation

CVSS Score-6.1||MEDIUM

EPSS-16.38% / 94.61%

7 Day CHG~0.00%

Published-16 Feb, 2012 | 19:00

Updated-30 Jul, 2025 | 01:47

Known KEV||Action Due Date - 2022-06-22||The impacted product is end-of-life and should be disconnected if still in use.

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

Product-linux_kernel windows solaris android flash_player mac_os_x n/a Flash Player

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0017

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-47.53% / 97.62%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in inplview.aspx Vulnerability."

Product-sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0007

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-59.16% / 98.16%

7 Day CHG~0.00%

Published-10 Jan, 2012 | 21:00

Updated-11 Apr, 2025 | 00:51

The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style Sheets (CSS) escaped character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML input, aka "AntiXSS Library Bypass Vulnerability."

Product-anti-cross_site_scripting_library n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4726

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.21%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain other files.

Vendor-n/a Parallels International Gmbh Red Hat, Inc.Microsoft Corporation

Product-enterprise_linux windows parallels_plesk_panel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-3379

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-7.16% / 91.20%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-2078

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.21% / 43.32%

7 Day CHG~0.00%

Published-08 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter.

Vendor-n/a VMware (Broadcom Inc.)Microsoft Corporation

Product-windows vcenter_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-8559

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-0.79% / 72.95%

7 Day CHG~0.00%

Published-11 Jul, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8560.