ByteOS

Microsoft Dynamics 365 (on-premises)

Product

Versions

Affected

Vendor

Microsoft Dynamics CRM 2015 (on-premises)

Product

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	Security Feature Bypass

Type: text

CWE ID: N/A

Description: Security Feature Bypass

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1008	x_refsource_MISC

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1008

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1008	x_refsource_MISC x_transferred

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1008

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:16 May, 2019 | 19:29

Updated At:24 Aug, 2020 | 17:37

A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feature Bypass'.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.9	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.0

Base score: 5.9

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

cpe:2.3:a:microsoft:dynamics_365:8.2:*:*:*:*:*:*:*

>>dynamics_365>>8.2

cpe:2.3:a:microsoft:dynamics_365:9.0:*:*:*:*:*:*:*

>>dynamics_365>>9.0

cpe:2.3:a:microsoft:dynamics_crm_2015:7.0:*:*:*:*:*:*:*

>>dynamics_crm_2015>>7.0

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1008	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1008

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

496Records found

CVE-2012-1863

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-41.34% / 97.48%

7 Day CHG~0.00%

Published-10 Jul, 2012 | 21:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Reflected List Parameter Vulnerability."

Product-office_sharepoint_server sharepoint_foundation sharepoint_server sharepoint_services n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-1857

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-42.22% / 97.53%

7 Day CHG~0.00%

Published-12 Jun, 2012 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the Enterprise Portal component in Microsoft Dynamics AX 2012 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Dynamics AX Enterprise Portal XSS Vulnerability."

Product-dynamics_ax n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-1457

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-50.85% / 97.92%

7 Day CHG~0.00%

Published-21 Mar, 2012 | 10:00

Updated-29 Apr, 2026 | 01:13

The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.

CVE-2012-1859

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-41.34% / 97.48%

7 Day CHG~0.00%

Published-10 Jul, 2012 | 21:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "XSS scriptresx.ashx Vulnerability."

Product-sharepoint_foundation sharepoint_server office_web_apps n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-1420

Matching Score-8

Assigner-MITRE Corporation

Product-nod32_antivirus f-prot_antivirus quick_heal fortinet_antivirus command_antivirus kaspersky_anti-virus security_essentials norman_antivirus_\&_antispyware antivirus rising_antivirus panda_antivirus n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-16.44% / 95.02%

7 Day CHG~0.00%

Published-21 Mar, 2012 | 10:00

Updated-29 Apr, 2026 | 01:13

The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Panda Antivirus 10.0.2.7, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \7fELF character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.

Vendor-cat k7computing norman f-prot authentium rising-global pandasecurity n/a ESET, spol. s r. o.Kaspersky Lab Fortinet, Inc.Microsoft Corporation

CVE-2017-1520

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.7||LOW

EPSS-0.20% / 41.88%

7 Day CHG~0.00%

Published-12 Sep, 2017 | 21:00

Updated-13 May, 2026 | 00:24

IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-Force ID: 129830.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-windows linux_kernel db2 db2_connect DB2 for Linux, UNIX and Windows

CWE ID-CWE-287

Improper Authentication

CVE-2021-43908

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-7.56% / 92.00%

7 Day CHG~0.00%

Published-15 Dec, 2021 | 14:15

Updated-04 Aug, 2024 | 04:10

Visual Studio Code Spoofing Vulnerability

Product-visual_studio_code Visual Studio Code

CVE-2012-0765

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-1.25% / 79.73%

7 Day CHG~0.00%

Published-15 Feb, 2012 | 01:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in Adobe RoboHelp 8 and 9 for Word allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to certain .htm files in (1) template_stock and (2) template_csh directories.

Vendor-n/a Microsoft Corporation Adobe Inc.

Product-robohelp windows word n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-3166

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-18.00% / 95.30%

7 Day CHG~0.00%

Published-10 Jul, 2013 | 01:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to inject arbitrary web script or HTML via vectors involving incorrect auto-selection of the Shift JIS encoding, leading to cross-domain scrolling events, aka "Shift JIS Character Encoding Vulnerability," a different vulnerability than CVE-2013-0015.

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-8113

Matching Score-8

Matching Score-8

CVSS Score-6.5||MEDIUM

EPSS-18.54% / 95.39%

7 Day CHG~0.00%

Published-14 Jun, 2018 | 12:00

Updated-05 Aug, 2024 | 06:46

A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mark of the Web Tagging (MOTW), aka "Internet Explorer Security Feature Bypass Vulnerability." This affects Internet Explorer 11.

Product-internet_explorer windows_10 Internet Explorer 11

CVE-2011-4726

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.38%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain other files.

Vendor-n/a Red Hat, Inc.Microsoft Corporation Parallels International Gmbh

Product-parallels_plesk_panel windows enterprise_linux n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-11863

Matching Score-8

Matching Score-8

CVSS Score-6.1||MEDIUM

EPSS-1.09% / 78.33%

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-13 May, 2026 | 00:24

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to trick a user into loading a page containing malicious content, due to how the Edge Content Security Policy (CSP) validates documents, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-11872 and CVE-2017-11874.

Product-windows_server_2016 windows_10 edge Microsoft Edge

CWE ID-CWE-20

Improper Input Validation

CVE-2017-11877

Matching Score-8

Matching Score-8

CVSS Score-5.5||MEDIUM

EPSS-11.99% / 93.92%

7 Day CHG~0.00%

Published-15 Nov, 2017 | 03:00

Updated-13 May, 2026 | 00:24

Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Excel Viewer 2007 Service Pack 3, and Microsoft Excel 2016 for Mac allow a security feature bypass by not enforcing macro settings on an Excel document, aka "Microsoft Excel Security Feature Bypass Vulnerability".

Product-office_compatibility_pack excel_viewer excel Microsoft Office

CVE-2012-0017

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-42.35% / 97.53%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in inplview.aspx Vulnerability."

Product-sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4776

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.38%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other files.

Vendor-n/a Microsoft Corporation Parallels International Gmbh

Product-parallels_plesk_panel windows_2003_server windows_server_2008 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4735

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.51% / 66.62%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/user/create and certain other files.

Vendor-n/a Red Hat, Inc.Microsoft Corporation Parallels International Gmbh

Product-parallels_plesk_panel windows enterprise_linux n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0007

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-59.66% / 98.29%

7 Day CHG~0.00%

Published-10 Jan, 2012 | 21:00

Updated-29 Apr, 2026 | 01:13

The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style Sheets (CSS) escaped character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML input, aka "AntiXSS Library Bypass Vulnerability."

Product-anti-cross_site_scripting_library n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0132

Matching Score-8

Assigner-HP Inc.

Matching Score-8

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.75% / 73.52%

7 Day CHG~0.00%

Published-04 Apr, 2012 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-windows business_availability_center n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0145

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-35.92% / 97.18%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in wizardlist.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in wizardlist.aspx Vulnerability."

Product-sharepoint_foundation sharepoint_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-44201

Matching Score-8

Assigner-Acronis International GmbH

Vendor-Acronis (Acronis International GmbH)Linux Kernel Organization, Inc Microsoft Corporation

Matching Score-8

Assigner-Acronis International GmbH

CVSS Score-6.1||MEDIUM

EPSS-0.32% / 55.10%

7 Day CHG~0.00%

Published-29 Nov, 2021 | 18:18

Updated-17 Sep, 2024 | 01:36

Cross-site scripting (XSS) was possible in notification pop-ups

Cross-site scripting (XSS) was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035

Product-cyber_protect windows linux_kernel Acronis Cyber Protect 15

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4777

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.38%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html.

Vendor-n/a Microsoft Corporation Parallels International Gmbh

Product-parallels_plesk_panel windows_2003_server windows_server_2008 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0144

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-35.92% / 97.18%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in themeweb.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in themeweb.aspx Vulnerability."

Product-sharepoint_foundation sharepoint_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-11305

Matching Score-8

Matching Score-8

Product-windows_10 mac_os_x windows_8.1 enterprise_linux_server enterprise_linux_workstation enterprise_linux_desktop windows flash_player linux_kernel flash_player_desktop_runtime chrome_os Adobe Flash Player 27.0.0.187 and earlier versions

CVSS Score-6.5||MEDIUM

EPSS-2.47% / 85.57%

7 Day CHG~0.00%

Published-13 Dec, 2017 | 21:00

Updated-13 May, 2026 | 00:24

A regression affecting Adobe Flash Player version 27.0.0.187 (and earlier versions) causes the unintended reset of the global settings preference file when a user clears browser data.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Red Hat, Inc.Microsoft Corporation Adobe Inc.

CVE-2021-43896

Matching Score-8

Matching Score-8

CVSS Score-5.5||MEDIUM

EPSS-7.59% / 92.02%

7 Day CHG~0.00%

Published-15 Dec, 2021 | 14:15

Updated-04 Aug, 2024 | 04:10

Microsoft PowerShell Spoofing Vulnerability

Product-powershell CBL Mariner 2.0 ARM CBL Mariner 1.0 x64 PowerShell 7.2 CBL Mariner 1.0 ARM CBL Mariner 2.0 x64

CVE-2017-0017

Matching Score-8

Matching Score-8

CVSS Score-6.1||MEDIUM

EPSS-1.89% / 83.54%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-13 May, 2026 | 00:24

The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0065, and CVE-2017-0068.

Product-edge Edge

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0064

Matching Score-8

Matching Score-8

CVSS Score-6.5||MEDIUM

EPSS-18.70% / 95.42%

7 Day CHG~0.00%

Published-12 May, 2017 | 14:00

Updated-13 May, 2026 | 00:24

A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings, aka "Internet Explorer Security Feature Bypass Vulnerability."

Product-internet_explorer Internet Explorer

CVE-2011-2379

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.44% / 63.63%

7 Day CHG~0.00%

Published-09 Aug, 2011 | 19:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode, allows remote attackers to inject arbitrary web script or HTML via a crafted patch, related to content sniffing.

Vendor-n/a Apple Inc.Mozilla Corporation Microsoft Corporation

Product-internet_explorer safari bugzilla n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0204

Matching Score-8

Matching Score-8

CVSS Score-5.5||MEDIUM

EPSS-11.66% / 93.81%

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-13 May, 2026 | 00:24

Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to bypass the Office Protected View via a specially crafted document, aka "Microsoft Office Security Feature Bypass Vulnerability."

Product-outlook Outlook

CVE-2021-43255

Matching Score-8

Matching Score-8

CVSS Score-5.5||MEDIUM

EPSS-1.78% / 83.06%

7 Day CHG~0.00%

Published-15 Dec, 2021 | 14:15

Updated-19 May, 2026 | 18:38

Microsoft Office Trust Center Spoofing Vulnerability

Product-365_apps office_long_term_servicing_channel office Microsoft 365 Apps for Enterprise Microsoft Office 2016 Microsoft Office LTSC 2021 Microsoft Office 2013 Service Pack 1 Microsoft Office 2019

CVE-2017-0207

Matching Score-8

Matching Score-8

CVSS Score-6.5||MEDIUM

EPSS-11.65% / 93.81%

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-13 May, 2026 | 00:24

Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka "Microsoft Browser Spoofing Vulnerability."

Product-outlook Outlook

CVE-2018-8150

Matching Score-8

Matching Score-8

CVSS Score-6.5||MEDIUM

EPSS-19.42% / 95.52%

7 Day CHG~0.00%

Published-09 May, 2018 | 19:00

Updated-05 Aug, 2024 | 06:46

A security feature bypass vulnerability exists when the Microsoft Outlook attachment block filter does not properly handle attachments, aka "Microsoft Outlook Security Feature Bypass Vulnerability." This affects Microsoft Office.

Product-office Microsoft Office

CVE-2011-2444

Matching Score-8

Matching Score-8

Vendor-n/a Apple Inc.Sun Microsystems (Oracle Corporation)Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.92% / 76.38%

7 Day CHG~0.00%

Published-22 Sep, 2011 | 01:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site scripting issue," as exploited in the wild in September 2011.

Product-mac_os_x sunos windows flash_player android linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0203

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-4.51% / 89.37%

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-13 May, 2026 | 00:24

A vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents. An attacker could trick a user into loading a web page with malicious content, aka "Microsoft Edge Security Feature Bypass Vulnerability."

Product-edge Microsoft Edge Microsoft Edge

CVE-2017-0107

Matching Score-8

Matching Score-8

CVSS Score-6.1||MEDIUM

EPSS-2.32% / 85.11%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-13 May, 2026 | 00:24

Microsoft SharePoint Server fails to sanitize crafted web requests, allowing remote attackers to run cross-script in local security context, aka "Microsoft SharePoint XSS Vulnerability."

Product-sharepoint_foundation SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0055

Matching Score-8

Matching Score-8

CVSS Score-6.1||MEDIUM

EPSS-1.39% / 80.71%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-13 May, 2026 | 00:24

Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka "Microsoft IIS Server XSS Elevation of Privilege Vulnerability."

Product-windows_10 windows_7 windows_8.1 windows_server_2008 windows_vista windows_server_2016 windows_rt_8.1 windows_server_2012 IIS Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0033

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-10.33% / 93.34%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-13 May, 2026 | 00:24

Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka "Microsoft Browser Spoofing Vulnerability." This vulnerability is different from those described in CVE-2017-0012 and CVE-2017-0069.

Product-internet_explorer edge Browser

CWE ID-CWE-20

Improper Input Validation

CVE-2011-1895

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-20.27% / 95.65%

7 Day CHG~0.00%

Published-12 Oct, 2011 | 01:00

Updated-29 Apr, 2026 | 01:13

CRLF injection vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via unspecified vectors, aka "ExcelTable Response Splitting XSS Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2011-2107

Matching Score-8

Matching Score-8

Vendor-n/a Apple Inc.Sun Microsystems (Oracle Corporation)Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.08% / 78.18%

7 Day CHG~0.00%

Published-07 Jun, 2011 | 19:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."

Product-acrobat acrobat_reader mac_os_x sunos windows flash_player android linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0231

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-8.54% / 92.55%

7 Day CHG~0.00%

Published-12 May, 2017 | 14:00

Updated-13 May, 2026 | 00:24

A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter, aka "Microsoft Browser Spoofing Vulnerability."

Product-internet_explorer edge Microsoft browsers

CWE ID-CWE-20

Improper Input Validation

CVE-2021-42305

Matching Score-8

Matching Score-8

CVSS Score-6.5||MEDIUM

EPSS-24.33% / 96.21%

7 Day CHG~0.00%

Published-10 Nov, 2021 | 00:47

Updated-04 Aug, 2024 | 03:30

Microsoft Exchange Server Spoofing Vulnerability

Product-exchange_server Microsoft Exchange Server 2019 Cumulative Update 11 Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 22 Microsoft Exchange Server 2016 Cumulative Update 21 Microsoft Exchange Server 2019 Cumulative Update 10

CVE-2017-0069

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-7.95% / 92.23%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-13 May, 2026 | 00:24

Microsoft Edge allows remote attackers to spoof web content via a crafted web site, aka "Microsoft Edge Spoofing Vulnerability." This vulnerability is different from those described in CVE-2017-0012 and CVE-2017-0033.

Product-edge Edge

CWE ID-CWE-20

Improper Input Validation

CVE-2011-1893

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-58.89% / 98.26%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010, Windows SharePoint Services 2.0 and 3.0 SP2, and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "SharePoint XSS Vulnerability."

Product-sharepoint_foundation sharepoint_server sharepoint_services n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1252

Matching Score-8

Matching Score-8

CVSS Score-6.1||MEDIUM

EPSS-13.43% / 94.34%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified strings, aka "toStaticHTML Information Disclosure Vulnerability" or "HTML Sanitization Vulnerability."

Product-internet_explorer windows_7 windows_server_2008 windows_vista windows_xp windows_2003_server windows_server_2003 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0012

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-8.37% / 92.47%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-13 May, 2026 | 00:24

Product-internet_explorer edge Browsers

CWE ID-CWE-20

Improper Input Validation

CVE-2017-0211

Matching Score-8

Matching Score-8

CVSS Score-5.5||MEDIUM

EPSS-22.34% / 95.94%

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-13 May, 2026 | 00:24

An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 versions of Microsoft Windows OLE when it fails an integrity-level check, aka "Windows OLE Elevation of Privilege Vulnerability."

Product-windows_10 windows_8.1 windows_server_2016 windows_rt_8.1 windows_server_2012 Windows OLE

CWE ID-CWE-610

Externally Controlled Reference to a Resource in Another Sphere

CVE-2011-1891

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.78%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in a request to a script, aka "Contact Details Reflected XSS Vulnerability."

Product-sharepoint_foundation sharepoint_services n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1896

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-10.20% / 93.29%

7 Day CHG~0.00%

Published-12 Oct, 2011 | 01:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "ExcelTable Reflected XSS Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1890

Matching Score-8

Matching Score-8

CVSS Score-4.3||MEDIUM

EPSS-34.59% / 97.10%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in EditForm.aspx in Microsoft Office SharePoint Server 2010 and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via a post, aka "Editform Script Injection Vulnerability."

Product-sharepoint_foundation sharepoint_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0210

Matching Score-8

Matching Score-8

CVSS Score-8.8||HIGH

EPSS-42.96% / 97.56%

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-22 Apr, 2026 | 13:50

Known KEV||Action Due Date - 2022-06-14||Apply updates per vendor instructions.

An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain, aka "Internet Explorer Elevation of Privilege Vulnerability."

Product-internet_explorer windows_7 windows_8.1 windows_10_1511 windows_server_2008 windows_10_1607 windows_10_1703 windows_10_1507 windows_server_2016 windows_rt_8.1 windows_server_2012 Internet Explorer Internet Explorer

CVE-2017-0110

Matching Score-8

Matching Score-8

CVSS Score-6.1||MEDIUM

EPSS-1.08% / 78.22%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-13 May, 2026 | 00:24

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."