ByteOS

Product

Internet Explorer 11

Versions

Affected

Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1703 for 32-bit Systems
Windows 10 Version 1703 for x64-based Systems
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1709 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1803 for x64-based Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012 R2
Windows Server 2016

Problem Types

Type	CWE ID	Description
text	N/A	Security Feature Bypass

Type: text

CWE ID: N/A

Description: Security Feature Bypass

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470	x_refsource_CONFIRM
http://www.securitytracker.com/id/1041632	vdb-entry x_refsource_SECTRACK
http://www.securityfocus.com/bid/105267	vdb-entry x_refsource_BID

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securitytracker.com/id/1041632

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://www.securityfocus.com/bid/105267

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470	x_refsource_CONFIRM x_transferred
http://www.securitytracker.com/id/1041632	vdb-entry x_refsource_SECTRACK x_transferred
http://www.securityfocus.com/bid/105267	vdb-entry x_refsource_BID x_transferred

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securitytracker.com/id/1041632

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://www.securityfocus.com/bid/105267

Resource:

vdb-entry

x_refsource_BID

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:13 Sep, 2018 | 00:29

Updated At:09 Nov, 2018 | 16:18

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.0

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*

>>internet_explorer>>11

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*

>>windows_10>>1607

cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*

>>windows_10>>1703

cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*

>>windows_10>>1709

cpe:2.3:o:microsoft:windows_10:1803:*:*:*:*:*:*:*

>>windows_10>>1803

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

>>windows_7>>-

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

>>windows_8.1>>-

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:rt:*:*:*

>>windows_8.1>>-

cpe:2.3:o:microsoft:windows_server:2008:r2:sp1:*:*:*:x64:*

>>windows_server>>2008

cpe:2.3:o:microsoft:windows_server:2012:r2:*:*:*:*:*:*

>>windows_server>>2012

cpe:2.3:o:microsoft:windows_server:2016:*:*:*:*:*:*:*

>>windows_server>>2016

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/105267	secure@microsoft.com	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041632	secure@microsoft.com	Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: http://www.securityfocus.com/bid/105267

Source: secure@microsoft.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1041632

Source: secure@microsoft.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

12954Records found

CVE-2016-7282

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-5.20% / 89.68%

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."

Product-internet_explorer edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-3954

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.22% / 78.79%

7 Day CHG~0.00%

Published-24 Jul, 2007 | 17:00

Updated-16 Sep, 2024 | 20:43

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with SeaMonkey installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking SeaMonkey.exe, a related issue to CVE-2007-3670.

Vendor-n/a Mozilla Corporation Microsoft Corporation

Product-seamonkey internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1263

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-35.65% / 96.96%

7 Day CHG~0.00%

Published-10 Aug, 2011 | 21:16

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the logon page in Remote Desktop Web Access (RD Web Access) in Microsoft Windows Server 2008 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "Remote Desktop Web Access Vulnerability."

Product-windows_server_2008 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-4116

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-12.32% / 93.70%

7 Day CHG~0.00%

Published-11 Nov, 2014 | 22:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2010 SP2 allows remote authenticated users to inject arbitrary web script or HTML via a modified list, aka "SharePoint Elevation of Privilege Vulnerability."

Product-sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1587

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 44.68%

7 Day CHG~0.00%

Published-27 Apr, 2011 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-4070

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-18.34% / 95.05%

7 Day CHG~0.00%

Published-10 Sep, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync XSS Information Disclosure Vulnerability."

Product-lync_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-3033

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-58.15% / 98.13%

7 Day CHG+15.82%

Published-14 Aug, 2007 | 22:00

Updated-07 Aug, 2024 | 13:57

Cross-site scripting (XSS) vulnerability in Windows Vista Feed Headlines Gadget (aka Sidebar RSS Feeds Gadget) in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zone.

Product-windows_vista n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-6154

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.21% / 43.57%

7 Day CHG~0.00%

Published-23 Aug, 2019 | 21:06

Updated-06 Aug, 2024 | 01:22

The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).

Vendor-n/a WatchGuard Technologies, Inc.Microsoft Corporation

Product-windows fireware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

CVE-2011-1252

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-18.93% / 95.15%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified strings, aka "toStaticHTML Information Disclosure Vulnerability" or "HTML Sanitization Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_2003_server windows_vista internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0587

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-1.39% / 80.06%

7 Day CHG~0.00%

Published-10 Feb, 2011 | 17:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-0604.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-2400

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.46% / 63.44%

7 Day CHG+0.02%

Published-25 Jun, 2007 | 19:00

Updated-07 Aug, 2024 | 13:33

Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.

Vendor-n/a Apple Inc.Microsoft Corporation

Product-iphone_os windows_vista safari windows_xp mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2007-2581

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-73.74% / 98.78%

7 Day CHG~0.00%

Published-09 May, 2007 | 21:00

Updated-07 Aug, 2024 | 13:42

Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoint Server 2007 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (query string) in "every main page," as demonstrated by default.aspx.

Product-sharepoint_server sharepoint_services windows_2003 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-3379

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-7.63% / 91.68%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0096

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-70.14% / 98.63%

7 Day CHG~0.00%

Published-31 Jan, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_2003_server windows_vista n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-1499

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-66.33% / 98.48%

7 Day CHG~0.00%

Published-17 Mar, 2007 | 10:00

Updated-07 Aug, 2024 | 12:59

Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."

Product-windows_xp windows_vista ie n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-3212

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-22.39% / 95.69%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, aka "Internet Explorer XSS Filter Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3936

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-42.35% / 97.35%

7 Day CHG~0.00%

Published-10 Nov, 2010 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS in Signurl.asp Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-4183

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 49.35%

7 Day CHG~0.00%

Published-05 Nov, 2010 | 16:28

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.

Vendor-htmlpurifier n/a Microsoft Corporation

Product-htmlpurifier internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-17039

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 46.98%

7 Day CHG~0.00%

Published-14 Sep, 2018 | 07:00

Updated-05 Aug, 2024 | 10:39

MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.

Vendor-1234n n/a Microsoft Corporation

Product-minicms internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0031

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.47% / 80.57%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-2543

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-6.93% / 91.22%

7 Day CHG~0.00%

Published-09 Sep, 2015 | 00:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-1757

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-10.69% / 93.15%

7 Day CHG~0.00%

Published-10 Jun, 2015 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability."

Product-active_directory_federation_services n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0509

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-0.58% / 68.46%

7 Day CHG~0.00%

Published-08 Apr, 2014 | 21:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2734

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.63%

7 Day CHG~0.00%

Published-10 Nov, 2010 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the mobile portal in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS Issue on UAG Mobile Portal Website in Forefront Unified Access Gateway Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0955

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-0.33% / 55.74%

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Experience Manager (AEM) 6.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a folder title field that is mishandled in the Deletion popup dialog.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-windows linux_kernel mac_os_x experience_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0032

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.47% / 80.57%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0030

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.47% / 80.57%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0029

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.29% / 79.31%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-0039

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.46% / 80.51%

7 Day CHG~0.00%

Published-10 Feb, 2016 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in SharePoint Server in Microsoft SharePoint Foundation 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."

Product-sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-3180

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-62.10% / 98.30%

7 Day CHG~0.00%

Published-11 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted POST request, aka "POST XSS Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-3648

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 52.60%

7 Day CHG~0.00%

Published-28 Jun, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in KENT-WEB POST-MAIL before 6.7, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.

Vendor-kent-web n/a Microsoft Corporation

Product-post-mail internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2429

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 50.72%

7 Day CHG~0.00%

Published-23 Jun, 2010 | 17:13

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.1.2, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer in a "404 Not Found" response.

Vendor-n/a Splunk LLC (Cisco Systems, Inc.)Microsoft Corporation

Product-splunk internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1762

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.89% / 75.04%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML in a TEXTAREA element.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6061

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-14.16% / 94.20%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."

Product-skype_for_business lync_room_system lync n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6144

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-24.12% / 95.93%

7 Day CHG~0.00%

Published-09 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Browser XSS Filter Bypass Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6117

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.47% / 80.62%

7 Day CHG~0.00%

Published-13 Jan, 2016 | 02:00

Updated-12 Apr, 2025 | 10:46

Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2016-0011.

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-1289

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-44.95% / 97.49%

7 Day CHG~0.00%

Published-09 Apr, 2013 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."

Product-office_web_apps infopath groove_server sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6099

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-32.20% / 96.71%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in ASP.NET in Microsoft .NET Framework 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka ".NET Elevation of Privilege Vulnerability."

Product-.net_framework n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6123

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-12.05% / 93.62%

7 Day CHG~0.00%

Published-11 Nov, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Excel for Mac 2011 and Excel 2016 for Mac allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message that is mishandled by Outlook for Mac, aka "Microsoft Outlook for Mac Spoofing Vulnerability."

Product-excel_for_mac n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-0942

Matching Score-10

Assigner-Dell

Matching Score-10

Assigner-Dell

CVSS Score-4.3||MEDIUM

EPSS-0.50% / 65.22%

7 Day CHG~0.00%

Published-22 May, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a The Apache Software Foundation ELAN Microelectronics Corporation Microsoft Corporation

Product-http_server internet_information_server rsa_authentication_agent n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-6176

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-4.30% / 88.62%

7 Day CHG~0.00%

Published-09 Dec, 2015 | 11:00

Updated-12 Apr, 2025 | 10:46

Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Edge XSS Filter Bypass Vulnerability."

Product-edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-0908

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.05% / 77.19%

7 Day CHG~0.00%

Published-26 Feb, 2018 | 22:00

Updated-16 Sep, 2024 | 22:40

Microsoft Identity Manager 2016 SP1 allows an attacker to gain elevated privileges when it does not properly sanitize a specially crafted attribute value being displayed to a user on an affected MIM 2016 server, aka "Microsoft Identity Manager XSS Elevation of Privilege Vulnerability."

Vendor-Microsoft Corporation

Product-identity_manager Microsoft Identity Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2006-0032

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-70.55% / 98.65%

7 Day CHG~0.00%

Published-12 Sep, 2006 | 23:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.

Product-windows_xp windows_2000 windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1778

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.20% / 41.84%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via an RSS feed.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-8551

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-0.76% / 72.85%

7 Day CHG~0.00%

Published-15 Jun, 2017 | 01:00

Updated-20 Apr, 2025 | 01:37

An elevation of privilege vulnerability exists when Microsoft SharePoint software fails to properly sanitize a specially crafted requests, aka "Microsoft SharePoint XSS vulnerability".

Vendor-Microsoft Corporation

Product-project_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-8560

Matching Score-10

Matching Score-10

Product-exchange_server Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5.

CVSS Score-6.1||MEDIUM

EPSS-0.79% / 73.45%

7 Day CHG~0.00%

Published-11 Jul, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8559.

Vendor-Microsoft Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-7109

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.94% / 75.77%

7 Day CHG~0.00%

Published-23 Oct, 2017 | 01:00

Updated-20 Apr, 2025 | 01:37

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via crafted web content that incorrectly interacts with the Application Cache policy.

Vendor-n/a Apple Inc.Microsoft Corporation

Product-itunes tvos iphone_os icloud safari windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-5069

Matching Score-10

Assigner-Chrome

Product-chrome enterprise_linux_desktop enterprise_linux_workstation linux_kernel windows enterprise_linux_server macos android Google Chrome prior to 58.0.3029.81 for Linux, Windows and Mac, and 58.0.3029.83 for Android

Matching Score-10

Assigner-Chrome

CVSS Score-6.1||MEDIUM

EPSS-0.49% / 65.05%

7 Day CHG~0.00%

Published-27 Oct, 2017 | 05:00

Updated-20 Apr, 2025 | 01:37

Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page.

Vendor-n/a Linux Kernel Organization, Inc Red Hat, Inc.Apple Inc.Microsoft Corporation Google LLC

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2015-2398

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-19.81% / 95.29%

7 Day CHG~0.00%

Published-14 Jul, 2015 | 21:00

Updated-12 Apr, 2025 | 10:46

Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document, aka "Internet Explorer XSS Filter Bypass Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-2929

Matching Score-10

Matching Score-10