CVE-2019-1460 | ByteOS Network

Vulnerability Details :

CVE-2019-1460

Assigner-microsoft

Assigner Org ID-f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At-24 Jan, 2020 | 20:50

Updated At-04 Aug, 2024 | 18:20

A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:microsoft

Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At:24 Jan, 2020 | 20:50

Updated At:04 Aug, 2024 | 18:20

▼CVE Numbering Authority (CNA)

A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.

Affected Products

Vendor

Microsoft Corporation

Product

Microsoft Outlook for Android

Versions

Affected

unspecified

Problem Types

Type	CWE ID	Description
text	N/A	Spoofing

Type: text

CWE ID: N/A

Description: Spoofing

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1460	x_refsource_MISC

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1460

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1460	x_refsource_MISC x_transferred

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1460

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:secure@microsoft.com

Published At:24 Jan, 2020 | 21:15

Updated At:24 Aug, 2020 | 17:37

A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.6	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 4.6

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 3.5

Base severity: LOW

Vector:

AV:N/AC:M/Au:S/C:N/I:P/A:N

CPE Matches

Microsoft Corporation

cpe:2.3:a:microsoft:outlook:-:*:*:*:*:android:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1460	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1460

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

228Records found

Matching Score-8

Assigner-JPCERT/CC

Matching Score-8

Assigner-JPCERT/CC

CVSS Score-3.5||LOW

EPSS-0.23% / 45.87%

||

7 Day CHG~0.00%

Published-05 Dec, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in a search component in Cybozu Garoon before 3.7.2, when Internet Explorer is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Cybozu, Inc.Microsoft Corporation

Product-garoon internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 35.08%

||

7 Day CHG~0.00%

Published-18 Feb, 2021 | 15:10

Updated-16 Sep, 2024 | 19:05

IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196622.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-windows maximo_for_civil_infrastructure linux_kernel Maximo for Civil Infrastructure

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.98% / 75.81%

||

7 Day CHG~0.00%

Published-12 Jan, 2021 | 19:41

Updated-08 Oct, 2024 | 17:15

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability

Vendor-Microsoft Corporation

Product-sharepoint_server sharepoint_foundation sharepoint_enterprise_server Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2013 Service Pack 1

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.24%

||

7 Day CHG~0.00%

Published-27 Apr, 2021 | 16:32

Updated-17 Sep, 2024 | 04:04

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199167.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-content_navigator windows aix linux_kernel Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.71% / 71.46%

||

7 Day CHG~0.00%

Published-27 Jul, 2021 | 11:25

Updated-16 Sep, 2024 | 16:48

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199232.

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Product-sterling_b2b_integrator solaris linux_kernel i hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 35.08%

||

7 Day CHG~0.00%

Published-27 Apr, 2021 | 16:32

Updated-16 Sep, 2024 | 23:31

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196624.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-content_navigator windows aix linux_kernel Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Oracle

Matching Score-8

Assigner-Oracle

CVSS Score-3.5||LOW

EPSS-0.23% / 45.78%

||

7 Day CHG~0.00%

Published-16 Apr, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc.

Vendor-n/a IBM Corporation Canonical Ltd.Debian GNU/Linux Oracle Corporation Microsoft Corporation

Product-jrockit ubuntu_linux jdk forms_viewer windows debian_linux javafx jre n/a

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.24%

||

7 Day CHG~0.00%

Published-27 Apr, 2021 | 16:32

Updated-16 Sep, 2024 | 16:53

IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199168.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-content_navigator windows aix linux_kernel Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.98% / 75.81%

||

7 Day CHG~0.00%

Published-12 Jan, 2021 | 19:42

Updated-08 Oct, 2024 | 17:15

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability

Vendor-Microsoft Corporation

Product-sharepoint_server sharepoint_foundation sharepoint_enterprise_server Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Foundation 2013 Service Pack 1

Matching Score-8

Assigner-JPCERT/CC

Matching Score-8

Assigner-JPCERT/CC

CVSS Score-3.5||LOW

EPSS-0.23% / 45.87%

||

7 Day CHG~0.00%

Published-05 Dec, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the bulletin-board component in Cybozu Garoon before 3.7.2, when Internet Explorer or Firefox is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Mozilla Corporation Cybozu, Inc.Microsoft Corporation

Product-garoon firefox internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-3.5||LOW

EPSS-0.21% / 43.25%

||

7 Day CHG~0.00%

Published-24 Jul, 2013 | 14:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Web\Content\Help\ in the Web Client in IBM Cognos Command Center (aka Star Command Center or Star Analytics) before 10.1, when Internet Explorer is used, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a IBM Corporation Microsoft Corporation

Product-star_command_center internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.53% / 66.21%

||

7 Day CHG~0.00%

Published-10 Dec, 2019 | 21:41

Updated-04 Aug, 2024 | 18:20

A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server Spoofing Vulnerability'.

Vendor-Microsoft Corporation

Product-skype_for_business Skype for Business Server 2019 CU2

CWE ID-CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-28 Feb, 2025 | 20:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.48% / 64.13%

||

7 Day CHG~0.00%

Published-11 Sep, 2019 | 21:24

Updated-04 Aug, 2024 | 18:13

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.

Vendor-Microsoft Corporation

Product-sharepoint_foundation Microsoft SharePoint Foundation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.48% / 64.36%

||

7 Day CHG~0.00%

Published-09 Apr, 2019 | 20:16

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0830.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.61% / 68.87%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-04 Aug, 2024 | 06:18

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0972, CVE-2020-0975, CVE-2020-0976.

Vendor-Microsoft Corporation

Product-sharepoint_server sharepoint_enterprise_server Microsoft SharePoint Server Microsoft SharePoint Enterprise Server

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.58% / 67.87%

||

7 Day CHG~0.00%

Published-16 May, 2019 | 18:24

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.

Vendor-Microsoft Corporation

Product-sharepoint_foundation Microsoft SharePoint Foundation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.43% / 61.57%

||

7 Day CHG~0.00%

Published-13 Sep, 2018 | 00:00

Updated-05 Aug, 2024 | 06:54

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8431.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.92% / 75.07%

||

7 Day CHG~0.00%

Published-11 Feb, 2020 | 21:23

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0693.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-5.43% / 89.78%

||

7 Day CHG+1.56%

Published-24 Oct, 2007 | 23:00

Updated-03 Apr, 2025 | 01:03

Absolute path traversal vulnerability in Alt-N Technologies WebAdmin 2.0.0 through 2.0.2 allows remote attackers with administrator privileges to (1) determine the installation path by reading the contents of the Name parameter in a link, and (2) read arbitrary files via an absolute path in the Name parameter.

Vendor-alt-n n/a Microsoft Corporation

Product-webadmin all_windows n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-1.10% / 77.18%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server 2013 SP1 and Office Online Server allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka "Microsoft Office XSS Elevation of Privilege Vulnerability."

Vendor-Microsoft Corporation

Product-sharepoint_server excel_web_app office_web_apps office_online_server office_web_apps_server Office

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.41% / 60.71%

||

7 Day CHG~0.00%

Published-21 Dec, 2020 | 17:50

Updated-16 Sep, 2024 | 17:43

IBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188600.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows content_navigator linux_kernel Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.19% / 40.74%

||

7 Day CHG~0.00%

Published-18 Feb, 2021 | 15:10

Updated-16 Sep, 2024 | 18:34

IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191751.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-jazz_reporting_service windows linux_kernel Jazz Reporting Service

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 35.08%

||

7 Day CHG~0.00%

Published-01 Jul, 2021 | 15:40

Updated-16 Sep, 2024 | 22:02

IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191753.

Vendor-Microsoft Corporation IBM Corporation

Product-windows datacap_navigator Datacap Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.29% / 51.73%

||

7 Day CHG~0.00%

Published-10 Sep, 2020 | 16:50

Updated-16 Sep, 2024 | 17:37

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 184433.

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Product-solaris linux_kernel websphere_application_server i hp-ux windows z\/os aix WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.99%

||

7 Day CHG~0.00%

Published-28 Jan, 2021 | 19:15

Updated-04 Aug, 2024 | 17:16

Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter in the 'Add New Record Feature'.

Vendor-egavilanmedia n/a Microsoft Corporation

Product-windows phpcrud n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.90% / 74.70%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0893.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.72% / 71.48%

||

7 Day CHG~0.00%

Published-14 Jan, 2020 | 23:11

Updated-04 Aug, 2024 | 06:11

A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'.

Vendor-Microsoft Corporation

Product-dynamics_365 Dynamics 365 Field Service (on-premises) v7 series

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-CERT/CC

Matching Score-8

Assigner-CERT/CC

CVSS Score-5.7||MEDIUM

EPSS-0.51% / 65.53%

||

7 Day CHG~0.00%

Published-09 Dec, 2020 | 00:30

Updated-16 Sep, 2024 | 23:01

Microsoft Teams displayName stored cross-site scripting vulnerability

The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020.

Vendor-Microsoft Corporation

Product-teams Teams

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.62% / 69.15%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-28 Feb, 2025 | 21:15

This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0795.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.61% / 68.87%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-04 Aug, 2024 | 06:18

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0972, CVE-2020-0976, CVE-2020-0977.

Vendor-Microsoft Corporation

Product-sharepoint_server sharepoint_foundation sharepoint_enterprise_server Microsoft SharePoint Server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-28 Feb, 2025 | 20:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-project_server sharepoint_enterprise_server sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server Microsoft Project Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.90% / 74.70%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0894.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.73% / 71.80%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.

Vendor-Microsoft Corporation

Product-exchange_server Microsoft Exchange Server 2019 Cumulative Update 4 Microsoft Exchange Server 2016 Cumulative Update 15 Microsoft Exchange Server 2019 Cumulative Update 3 Microsoft Exchange Server 2016 Cumulative Update 14

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.47% / 63.58%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-28 Feb, 2025 | 21:15

This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0891.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation business_productivity_servers Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft Business Productivity Servers

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-28 Feb, 2025 | 20:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.61% / 68.87%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-04 Aug, 2024 | 06:18

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0975, CVE-2020-0976, CVE-2020-0977.

Vendor-Microsoft Corporation

Product-sharepoint_server sharepoint_foundation sharepoint_enterprise_server Microsoft SharePoint Server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-1.10% / 77.16%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.70% / 71.02%

||

7 Day CHG~0.00%

Published-11 Feb, 2020 | 21:23

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0694.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.53% / 66.13%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-04 Aug, 2024 | 06:11

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.

Vendor-Microsoft Corporation

Product-azure_devops_server team_foundation_server Azure DevOps Server 2019 Update 1.1 Team Foundation Server 2018 Team Foundation Server Azure DevOps Server Azure DevOps Server 2019

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.10% / 28.81%

||

7 Day CHG~0.00%

Published-06 Nov, 2023 | 22:51

Updated-28 Feb, 2025 | 20:15

Microsoft OneNote Spoofing Vulnerability

Microsoft OneNote Spoofing Vulnerability

Vendor-Microsoft Corporation

Product-onenote Microsoft OneNote 2013 Microsoft OneNote 2016 Microsoft Office 2019 Microsoft OneNote 2013 Service Pack 1 Microsoft Office LTSC 2021

CWE ID-CWE-290

Authentication Bypass by Spoofing

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.20% / 42.46%

||

7 Day CHG~0.00%

Published-08 Aug, 2023 | 17:08

Updated-01 Jan, 2025 | 01:58

Azure HDInsight Jupyter Notebook Spoofing Vulnerability

Azure HDInsight Jupyter Notebook Spoofing Vulnerability

Vendor-Microsoft Corporation

Product-azure_hdinsights Azure HDInsight

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.98% / 75.82%

||

7 Day CHG~0.00%

Published-10 Oct, 2019 | 13:28

Updated-04 Aug, 2024 | 18:13

A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'.

Vendor-Microsoft Corporation

Product-dynamics_365 Microsoft Dynamics 365 (on-premises)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.60% / 68.34%

||

7 Day CHG~0.00%

Published-10 Oct, 2019 | 13:28

Updated-04 Aug, 2024 | 18:13

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'.

Vendor-Microsoft Corporation

Product-sharepoint_foundation sharepoint_enterprise_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.98% / 75.82%

||

7 Day CHG~0.00%

Published-10 Oct, 2019 | 13:28

Updated-04 Aug, 2024 | 18:13

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1330.

Vendor-Microsoft Corporation

Product-sharepoint_foundation sharepoint_enterprise_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')