CVE-2019-14667 | ByteOS Network

Vulnerability Details :

CVE-2019-14667

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-05 Aug, 2019 | 19:23

Updated At-05 Aug, 2024 | 00:19

Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:05 Aug, 2019 | 19:23

Updated At:05 Aug, 2024 | 00:19

▼CVE Numbering Authority (CNA)

Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://github.com/firefly-iii/firefly-iii/issues/2363	x_refsource_MISC
https://github.com/firefly-iii/firefly-iii/commit/427de0594d05a8222f55b2894311e648ba1be991	x_refsource_MISC
https://github.com/firefly-iii/firefly-iii/commit/15d4d185bbedf2bb9db4a8fa2ccf9fc359a06194	x_refsource_MISC

Hyperlink: https://github.com/firefly-iii/firefly-iii/issues/2363

Resource:

x_refsource_MISC

Hyperlink: https://github.com/firefly-iii/firefly-iii/commit/427de0594d05a8222f55b2894311e648ba1be991

Resource:

x_refsource_MISC

Hyperlink: https://github.com/firefly-iii/firefly-iii/commit/15d4d185bbedf2bb9db4a8fa2ccf9fc359a06194

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://github.com/firefly-iii/firefly-iii/issues/2363	x_refsource_MISC x_transferred
https://github.com/firefly-iii/firefly-iii/commit/427de0594d05a8222f55b2894311e648ba1be991	x_refsource_MISC x_transferred
https://github.com/firefly-iii/firefly-iii/commit/15d4d185bbedf2bb9db4a8fa2ccf9fc359a06194	x_refsource_MISC x_transferred

Hyperlink: https://github.com/firefly-iii/firefly-iii/issues/2363

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/firefly-iii/firefly-iii/commit/427de0594d05a8222f55b2894311e648ba1be991

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/firefly-iii/firefly-iii/commit/15d4d185bbedf2bb9db4a8fa2ccf9fc359a06194

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:cve@mitre.org

Published At:05 Aug, 2019 | 20:15

Updated At:16 Dec, 2020 | 17:00

Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.0

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

firefly-iii>>firefly_iii>>4.7.17.4

cpe:2.3:a:firefly-iii:firefly_iii:4.7.17.4:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/firefly-iii/firefly-iii/commit/15d4d185bbedf2bb9db4a8fa2ccf9fc359a06194	cve@mitre.org	Patch Third Party Advisory
https://github.com/firefly-iii/firefly-iii/commit/427de0594d05a8222f55b2894311e648ba1be991	cve@mitre.org	Patch Third Party Advisory
https://github.com/firefly-iii/firefly-iii/issues/2363	cve@mitre.org	Exploit Third Party Advisory

Hyperlink: https://github.com/firefly-iii/firefly-iii/commit/15d4d185bbedf2bb9db4a8fa2ccf9fc359a06194

Source: cve@mitre.org

Resource:

Patch

Third Party Advisory

Hyperlink: https://github.com/firefly-iii/firefly-iii/commit/427de0594d05a8222f55b2894311e648ba1be991

Source: cve@mitre.org

Resource:

Patch

Third Party Advisory

Hyperlink: https://github.com/firefly-iii/firefly-iii/issues/2363

Source: cve@mitre.org

Resource:

Exploit

Third Party Advisory

Similar CVEs

12308Records found

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-4.3||MEDIUM

EPSS-0.12% / 31.18%

||

7 Day CHG~0.00%

Published-01 Dec, 2021 | 10:20

Updated-03 Aug, 2024 | 17:16

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Vendor-firefly-iii firefly-iii

Product-firefly_iii firefly-iii/firefly-iii

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-4.3||MEDIUM

EPSS-0.14% / 35.15%

||

7 Day CHG~0.00%

Published-27 Oct, 2021 | 17:45

Updated-03 Aug, 2024 | 17:09

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Vendor-firefly-iii firefly-iii

Product-firefly_iii firefly-iii/firefly-iii

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-5.4||MEDIUM

EPSS-0.12% / 31.20%

||

7 Day CHG~0.00%

Published-13 Nov, 2021 | 08:55

Updated-03 Aug, 2024 | 17:09

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Vendor-firefly-iii firefly-iii

Product-firefly_iii firefly-iii/firefly-iii

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-6.5||MEDIUM

EPSS-0.11% / 30.24%

||

7 Day CHG~0.00%

Published-23 Aug, 2021 | 12:42

Updated-03 Aug, 2024 | 17:01

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Vendor-firefly-iii firefly-iii

Product-firefly_iii firefly-iii/firefly-iii

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-6.5||MEDIUM

EPSS-0.11% / 30.24%

||

7 Day CHG~0.00%

Published-23 Aug, 2021 | 12:41

Updated-03 Aug, 2024 | 17:01

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Vendor-firefly-iii firefly-iii

Product-firefly_iii firefly-iii/firefly-iii

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-4.3||MEDIUM

EPSS-0.12% / 31.18%

||

7 Day CHG~0.00%

Published-23 Aug, 2021 | 12:41

Updated-03 Aug, 2024 | 17:01

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Vendor-firefly-iii firefly-iii

Product-firefly_iii firefly-iii/firefly-iii

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

Matching Score-8

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-4.3||MEDIUM

EPSS-0.16% / 37.53%

||

7 Day CHG~0.00%

Published-04 Dec, 2021 | 12:00

Updated-03 Aug, 2024 | 17:16

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Vendor-firefly-iii firefly-iii

Product-firefly_iii firefly-iii/firefly-iii

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.97%

||

7 Day CHG~0.00%

Published-05 Aug, 2019 | 19:23

Updated-05 Aug, 2024 | 00:19

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link.

Vendor-firefly-iii n/a

Product-firefly_iii n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.97%

||

7 Day CHG~0.00%

Published-05 Aug, 2019 | 19:23

Updated-05 Aug, 2024 | 00:19

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.

Vendor-firefly-iii n/a

Product-firefly_iii n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.97%

||

7 Day CHG~0.00%

Published-05 Aug, 2019 | 19:23

Updated-05 Aug, 2024 | 00:19

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page.

Vendor-firefly-iii n/a

Product-firefly_iii n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.97%

||

7 Day CHG~0.00%

Published-05 Aug, 2019 | 19:22

Updated-05 Aug, 2024 | 00:19

Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.

Vendor-firefly-iii n/a

Product-firefly_iii n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.97%

||

7 Day CHG~0.00%

Published-18 Jul, 2019 | 02:17

Updated-04 Aug, 2024 | 23:57

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

Vendor-firefly-iii n/a

Product-firefly_iii n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.22% / 45.10%

||

7 Day CHG~0.00%

Published-18 Jul, 2019 | 02:17

Updated-04 Aug, 2024 | 23:57

Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tag_number$ tag summary page. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

Vendor-firefly-iii n/a

Product-firefly_iii n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.97%

||

7 Day CHG~0.00%

Published-18 Jul, 2019 | 02:17

Updated-04 Aug, 2024 | 23:57

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

Vendor-firefly-iii n/a

Product-firefly_iii n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 42.97%

||

7 Day CHG~0.00%

Published-18 Jul, 2019 | 02:17

Updated-04 Aug, 2024 | 23:57

Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability

Vendor-firefly-iii n/a

Product-firefly_iii n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.11% / 30.91%

||

7 Day CHG~0.00%

Published-05 Jan, 2024 | 00:00

Updated-05 Jun, 2025 | 17:15

Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.

Vendor-firefly-iii n/a

Product-firefly_iii n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.12% / 31.42%

||

7 Day CHG~0.00%

Published-09 Jun, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342.

Vendor-n/a Sophos Ltd.

Product-web_appliance n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.16%

||

7 Day CHG~0.00%

Published-30 Dec, 2021 | 12:53

Updated-04 Aug, 2024 | 04:54

Quectel UC20 UMTS/HSPA+ UC20 6.3.14 is affected by a Cross Site Scripting (XSS) vulnerability.

Vendor-quectel n/a

Product-uc20_firmware uc20 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-7.38% / 91.34%

||

7 Day CHG~0.00%

Published-05 Feb, 2019 | 05:00

Updated-04 Aug, 2024 | 20:46

Rukovoditel before 2.4.1 allows XSS.

Vendor-rukovoditel n/a

Product-rukovoditel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.30% / 53.04%

||

7 Day CHG~0.00%

Published-04 Feb, 2019 | 19:00

Updated-04 Aug, 2024 | 20:46

app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.

Vendor-kanboard n/a

Product-kanboard n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-HP Inc.

Matching Score-4

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.70% / 71.08%

||

7 Day CHG~0.00%

Published-16 May, 2011 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 8.06 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-business_availability_center n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Microsoft Corporation

Matching Score-4

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.79% / 72.94%

||

7 Day CHG~0.00%

Published-13 Sep, 2017 | 01:00

Updated-20 Apr, 2025 | 01:37

Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability."

Vendor-Microsoft Corporation

Product-exchange_server Microsoft Exchange Server 2016

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.23% / 45.23%

||

7 Day CHG~0.00%

Published-14 Jan, 2020 | 20:58

Updated-06 Aug, 2024 | 23:08

A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71.

Vendor-snewscms sNews

Product-snews sNews

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.31% / 53.25%

||

7 Day CHG~0.00%

Published-26 Mar, 2017 | 18:00

Updated-20 Apr, 2025 | 01:37

In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.

Vendor-n/a Moodle Pty Ltd

Product-moodle Moodle 3.x

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.41% / 60.48%

||

7 Day CHG~0.00%

Published-05 Jun, 2017 | 19:00

Updated-20 Apr, 2025 | 01:37

Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.

Vendor-sunnythemes n/a

Product-spiffy_calendar n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-HP Inc.

Matching Score-4

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.20% / 78.05%

||

7 Day CHG~0.00%

Published-03 May, 2011 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP SiteScope 9.54, 10.13, 11.01, and 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-sitescope n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.22% / 44.95%

||

7 Day CHG~0.00%

Published-02 Aug, 2017 | 19:00

Updated-20 Apr, 2025 | 01:37

Cross-site scripting (XSS) vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card.

Vendor-trello n/a

Product-trello n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-2.05% / 83.12%

||

7 Day CHG~0.00%

Published-05 Jun, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

XSS via orig_url exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The affected script is guest/preview.cgi.

Vendor-peplink n/a

Product-balance_1350 balance_305 balance_580 balance_380 1350hw2_firmware 580hw2_firmware b305hw2_firmware 710hw3_firmware 380hw6_firmware balance_710 2500_firmware balance_2500 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.24% / 46.85%

||

7 Day CHG~0.00%

Published-17 Sep, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin before 3.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.

Vendor-slickremix n/a

Product-design_approval_system_plugin n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 52.54%

||

7 Day CHG~0.00%

Published-20 Sep, 2013 | 16:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in the oraadmin service page in Cisco MediaSense allow remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug IDs CSCuj23320, CSCuj23324, CSCuj23333, and CSCuj23338.

Vendor-n/a Cisco Systems, Inc.

Product-mediasense n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Microsoft Corporation

Matching Score-4

Assigner-Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.79% / 72.94%

||

7 Day CHG~0.00%

Published-11 Jul, 2017 | 21:00

Updated-20 Apr, 2025 | 01:37

Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way that Exchange Outlook Web Access (OWA) handles web requests, aka "Microsoft Exchange Cross-Site Scripting Vulnerability". This CVE ID is unique from CVE-2017-8559.

Vendor-Microsoft Corporation

Product-exchange_server Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-CERT/CC

Matching Score-4

Assigner-CERT/CC

CVSS Score-4.3||MEDIUM

EPSS-27.00% / 96.18%

||

7 Day CHG~0.00%

Published-12 Jan, 2014 | 15:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Atmail Webmail Server before 7.2 allows remote attackers to inject arbitrary web script or HTML via the body of an e-mail message, as demonstrated by the SRC attribute of an IFRAME element.

Vendor-atmail n/a

Product-atmail n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.16%

||

7 Day CHG~0.00%

Published-26 Jun, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS.

Vendor-tiki n/a

Product-tikiwiki_cms\/groupware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.16%

||

7 Day CHG~0.00%

Published-06 Jun, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag.

Vendor-pivotx n/a

Product-pivotx n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.30% / 52.55%

||

7 Day CHG~0.00%

Published-13 Feb, 2020 | 23:06

Updated-06 Aug, 2024 | 17:06

Cross-site Scripting (XSS) in EasyXDM before 2.4.18 allows remote attackers to inject arbitrary web script or html via the easyxdm.swf file.

Vendor-easyxdm n/a

Product-easyxdm n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Microsoft Corporation

Matching Score-4

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-12.38% / 93.63%

||

7 Day CHG~0.00%

Published-15 Jun, 2017 | 01:00

Updated-20 Apr, 2025 | 01:37

A remote code execution vulnerability exists in Skype for Business when the software fails to sanitize specially crafted content, aka "Skype for Business Remote Code Execution Vulnerability".

Vendor-Microsoft Corporation

Product-office Skype for Business

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-4.12% / 88.16%

||

7 Day CHG~0.00%

Published-29 Jan, 2014 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in afa/php/Login.php in AlgoSec Firewall Analyzer 6.1-b86 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

Vendor-n/a AlgoSec Inc.

Product-firewall_analyzer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.22% / 44.92%

||

7 Day CHG~0.00%

Published-10 May, 2017 | 05:14

Updated-20 Apr, 2025 | 01:37

Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.

Vendor-getsymphony n/a

Product-symphony n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.41% / 60.76%

||

7 Day CHG+0.10%

Published-09 Sep, 2013 | 17:00

Updated-20 Aug, 2025 | 13:03

Multiple cross-site scripting (XSS) vulnerabilities in ls/htmlchat.php in the VideoWhisper Live Streaming Integration plugin 4.25.3 and possibly earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) message parameter. NOTE: some of these details are obtained from third party information.

Vendor-videowhisper n/a WordPress.org

Product-live_streaming_integration_plugin wordpress videowhisper_live_streaming_integration n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.41% / 60.30%

||

7 Day CHG~0.00%

Published-20 Aug, 2013 | 14:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Forums/EditPost.aspx in mojoPortal before 2.3.9.8 allows remote attackers to inject arbitrary web script or HTML via the txtSubject parameter.

Vendor-sourcetreesolutions n/a

Product-mojoportal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.36% / 57.27%

||

7 Day CHG~0.00%

Published-31 May, 2017 | 03:54

Updated-20 Apr, 2025 | 01:37

inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "<svg/onload=" substring instead of an "<svg onload=" substring.

Vendor-syspass n/a

Product-syspass n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.16%

||

7 Day CHG~0.00%

Published-05 May, 2017 | 18:00

Updated-20 Apr, 2025 | 01:37

An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/smtpg_add.html with the param parameter.

Vendor-n/a Accellion (Kiteworks USA, LLC)

Product-file_transfer_appliance n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Oracle

Matching Score-4

Assigner-Oracle

CVSS Score-4.3||MEDIUM

EPSS-2.75% / 85.42%

||

7 Day CHG~0.00%

Published-17 Jul, 2014 | 02:36

Updated-12 Apr, 2025 | 10:46

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.

Vendor-n/a Oracle Corporation

Product-mojarra n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-HP Inc.

Matching Score-4

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.62% / 69.21%

||

7 Day CHG~0.00%

Published-17 Dec, 2013 | 02:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Operations Orchestration before 9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.

Product-operations_orchestration n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-CERT/CC

Matching Score-4

Assigner-CERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.34% / 55.94%

||

7 Day CHG~0.00%

Published-28 Oct, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to inject arbitrary web script or HTML via the accountNum parameter to an unspecified component.

Vendor-tylertech n/a

Product-taxweb n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-1.08% / 76.97%

||

7 Day CHG~0.00%

Published-06 Jan, 2022 | 04:08

Updated-04 Aug, 2024 | 05:02

Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.

Vendor-n/a Roundcube Webmail Project Debian GNU/Linux

Product-debian_linux roundcube n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.16%

||

7 Day CHG~0.00%

Published-29 May, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Bram Korsten Note through 1.2.0 is vulnerable to a reflected XSS in note-source\ui\editor.php (edit parameter).

Vendor-note_project n/a

Product-note n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Elastic

Matching Score-4

Assigner-Elastic

CVSS Score-6.1||MEDIUM

EPSS-0.34% / 55.66%

||

7 Day CHG~0.00%

Published-05 Jun, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Kibana version 5.4.0 was affected by a Cross Site Scripting (XSS) bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users.

Vendor-Elasticsearch BV

Product-kibana Kibana

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.20% / 41.75%

||

7 Day CHG~0.00%

Published-10 May, 2017 | 17:00

Updated-20 Apr, 2025 | 01:37

Cross-site scripting (XSS) vulnerability in OpenText Tempo Box 10.0.3 allows remote attackers to inject arbitrary web script or HTML persistently via the name of an uploaded image.

Vendor-n/a Open Text Corporation

Product-tempo_box n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.22% / 44.95%

||

7 Day CHG~0.00%

Published-04 May, 2017 | 03:55

Updated-20 Apr, 2025 | 01:37

Cross-site scripting (XSS) vulnerability in modules/Base/Box/check_for_new_version.php in EPESI in Telaxus/EPESI 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URI that lacks the cid parameter.

Vendor-telaxius n/a

Product-epesi n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')