CVE-2019-15814 | ByteOS Network

Vulnerability Details :

CVE-2019-15814

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-04 Sep, 2019 | 13:50

Updated At-05 Aug, 2024 | 00:56

Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:04 Sep, 2019 | 13:50

Updated At:05 Aug, 2024 | 00:56

▼CVE Numbering Authority (CNA)

Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML.

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://www.exploit-db.com/exploits/47324	exploit x_refsource_EXPLOIT-DB

Hyperlink: https://www.exploit-db.com/exploits/47324

Resource:

exploit

x_refsource_EXPLOIT-DB

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.exploit-db.com/exploits/47324	exploit x_refsource_EXPLOIT-DB x_transferred

Hyperlink: https://www.exploit-db.com/exploits/47324

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

▼National Vulnerability Database (NVD)

Source:cve@mitre.org

Published At:04 Sep, 2019 | 14:15

Updated At:04 Sep, 2019 | 17:49

Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N

Type: Primary

Version: 3.0

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 3.5

Base severity: LOW

Vector:

AV:N/AC:M/Au:S/C:N/I:P/A:N

CPE Matches

sentrifugo>>sentrifugo>>3.2

cpe:2.3:a:sentrifugo:sentrifugo:3.2:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://www.exploit-db.com/exploits/47324	cve@mitre.org	Exploit Third Party Advisory VDB Entry

Hyperlink: https://www.exploit-db.com/exploits/47324

Source: cve@mitre.org

Resource:

Exploit

Third Party Advisory

VDB Entry

Similar CVEs

6353Records found

Matching Score-4

Assigner-Dell

Matching Score-4

Assigner-Dell

CVSS Score-6.2||MEDIUM

EPSS-0.21% / 42.57%

||

7 Day CHG~0.00%

Published-06 Feb, 2020 | 17:45

Updated-17 Sep, 2024 | 03:28

Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.

Vendor-Dell Inc.

Product-emc_elastic_cloud_storage Elastic Cloud Storage

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.39%

||

7 Day CHG~0.00%

Published-19 Jul, 2021 | 16:00

Updated-16 Sep, 2024 | 18:43

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 193738.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager rational_team_concert engineering_lifecycle_optimization rational_collaborative_lifecycle_management engineering_workflow_management Rational DOORS Next Generation Engineering Workflow Management Rational Collaborative Lifecycle Management Engineering Lifecycle Optimization Rational Engineering Lifecycle Manager Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-F5, Inc.

Matching Score-4

Assigner-F5, Inc.

CVSS Score-5.4||MEDIUM

EPSS-0.28% / 51.07%

||

7 Day CHG~0.00%

Published-05 Nov, 2020 | 19:20

Updated-04 Aug, 2024 | 08:47

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.

Vendor-n/a F5, Inc.

Product-big-ip_edge_gateway big-ip_webaccelerator big-ip_application_acceleration_manager big-ip_link_controller big-ip_policy_enforcement_manager big-ip_fraud_protection_service big-ip_global_traffic_manager big-ip_analytics big-ip_access_policy_manager big-ip_domain_name_system big-ip_local_traffic_manager big-ip_advanced_firewall_manager big-ip_application_security_manager BIG-IP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.88%

||

7 Day CHG~0.00%

Published-03 Jul, 2018 | 19:00

Updated-17 Sep, 2024 | 00:36

IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134796.

Vendor-IBM Corporation

Product-rational_collaborative_lifecycle_management rational_quality_manager Rational Quality Manager Rational Collaborative Lifecycle Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.29%

||

7 Day CHG~0.00%

Published-27 May, 2020 | 13:15

Updated-17 Sep, 2024 | 02:58

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178762.

Vendor-IBM Corporation

Product-spectrum_scale Spectrum Scale

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.31% / 54.26%

||

7 Day CHG~0.00%

Published-02 Jun, 2020 | 13:45

Updated-16 Sep, 2024 | 23:15

IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 180761.

Vendor-IBM Corporation

Product-planning_analytics_local Planning Analytics Local

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-3.45% / 87.32%

||

7 Day CHG-2.83%

Published-02 Dec, 2017 | 06:00

Updated-20 Apr, 2025 | 01:37

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.

Vendor-n/a Debian GNU/Linux WordPress.org

Product-wordpress debian_linux n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.29%

||

7 Day CHG~0.00%

Published-29 Jul, 2020 | 14:05

Updated-16 Sep, 2024 | 17:08

IBM Planning Analytics Local 2.0.0 through 2.0.9.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 185717.

Vendor-IBM Corporation

Product-planning_analytics_local Planning Analytics

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-3.7||LOW

EPSS-0.31% / 53.80%

||

7 Day CHG~0.00%

Published-02 Jul, 2020 | 16:55

Updated-04 Aug, 2024 | 07:52

Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites

In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467.

Vendor-octobercms October CMS

Product-october October

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.74%

||

7 Day CHG~0.00%

Published-27 Jan, 2021 | 16:15

Updated-16 Sep, 2024 | 19:09

IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182434.

Vendor-IBM Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Atlassian

Matching Score-4

Assigner-Atlassian

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.98%

||

7 Day CHG~0.00%

Published-01 Jun, 2020 | 06:35

Updated-16 Sep, 2024 | 20:36

The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.

Vendor-Atlassian

Product-fisheye crucible Fisheye Crucible

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.51%

||

7 Day CHG~0.00%

Published-19 May, 2020 | 13:15

Updated-17 Sep, 2024 | 02:07

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176475.

Vendor-IBM Corporation

Product-infosphere_information_server_on_cloud infosphere_information_server InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.09%

||

7 Day CHG~0.00%

Published-04 Mar, 2021 | 19:05

Updated-17 Sep, 2024 | 02:52

IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190742.

Vendor-IBM Corporation

Product-rational_doors_next_generation global_configuration_management engineering_test_management rational_quality_manager rational_team_concert engineering_workflow_management doors_next engineering_lifecycle_management engineering_requirements_quality_assistant_on-premises Rational Quality Manager Rational DOORS Next Generation Engineering Workflow Management Engineering Lifecycle Optimization Engineering Test Management Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-VMware by Broadcom

Matching Score-4

Assigner-VMware by Broadcom

CVSS Score-5.4||MEDIUM

EPSS-0.27% / 50.11%

||

7 Day CHG+0.04%

Published-23 Oct, 2020 | 13:49

Updated-04 Aug, 2024 | 07:52

VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed.

Vendor-n/a VMware (Broadcom Inc.)

Product-horizon VMware Horizon Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 30.07%

||

7 Day CHG~0.00%

Published-02 Jun, 2020 | 13:45

Updated-16 Sep, 2024 | 22:40

IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178765.

Vendor-IBM Corporation

Product-planning_analytics_local Planning Analytics Local

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-3.5||LOW

EPSS-0.34% / 56.01%

||

7 Day CHG~0.00%

Published-16 Jul, 2009 | 15:00

Updated-07 Aug, 2024 | 05:36

Cross-site scripting (XSS) vulnerability in the Administration interface in Cisco Customer Response Solutions (CRS) before 7.0(1) SR2 in Cisco Unified Contact Center Express (aka CCX) server allows remote authenticated users to inject arbitrary web script or HTML into the CCX database via unspecified vectors.

Vendor-n/a Cisco Systems, Inc.

Product-unified_ip_ivr customer_response_applications crs unified_ccx ip_qm unified_ip_contact_center_express n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 34.44%

||

7 Day CHG~0.00%

Published-01 Jul, 2021 | 15:40

Updated-16 Sep, 2024 | 22:02

IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191753.

Vendor-Microsoft Corporation IBM Corporation

Product-windows datacap_navigator Datacap Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.16% / 37.23%

||

7 Day CHG~0.00%

Published-04 Jan, 2021 | 14:00

Updated-16 Sep, 2024 | 17:14

IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191273.

Vendor-IBM Corporation

Product-cloud_pak_system Cloud Pak System

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-JPCERT/CC

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-4.8||MEDIUM

EPSS-0.07% / 20.06%

||

7 Day CHG~0.00%

Published-16 Oct, 2025 | 10:03

Updated-16 Oct, 2025 | 15:28

Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.

Vendor-NEOJAPAN Inc.

Product-desknet's NEO

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.85%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-16 Sep, 2024 | 23:30

IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 175841.

Vendor-IBM Corporation Linux Kernel Organization, Inc

Product-qradar_security_information_and_event_manager linux_kernel QRadar Qradar

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.26% / 49.05%

||

7 Day CHG~0.00%

Published-20 Oct, 2020 | 14:15

Updated-16 Sep, 2024 | 16:38

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183933.

Vendor-IBM Corporation

Product-sterling_b2b_integrator sterling_file_gateway Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-2.4||LOW

EPSS-6.30% / 90.82%

||

7 Day CHG+0.41%

Published-12 Jun, 2020 | 16:00

Updated-04 Aug, 2024 | 07:52

Authenticated self-XSS via theme uploads in WordPress

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).

Vendor-WordPress Debian GNU/Linux WordPress.org Fedora Project

Product-wordpress debian_linux fedora wordpress-develop

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-3.7||LOW

EPSS-0.22% / 44.12%

||

7 Day CHG~0.00%

Published-15 Jun, 2020 | 00:00

Updated-04 Aug, 2024 | 07:52

XSS in Dijit Editor's LinkDialog plugin

In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin. This has been fixed in 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3.

Vendor-Dojo (OpenJS Foundation)NetApp, Inc.Debian GNU/Linux OpenJS Foundation

Product-debian_linux dijit oncommand_insight active_iq_unified_manager oncommand_workflow_automation snapcenter dijit

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.29%

||

7 Day CHG~0.00%

Published-02 Sep, 2020 | 18:25

Updated-16 Sep, 2024 | 16:29

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183314.

Vendor-IBM Corporation

Product-rational_doors_next_generation rational_engineering_lifecycle_manager engineering_requirements_management_doors_next engineering_test_management rational_quality_manager rational_team_concert eni engineering_workflow_management rational_collaborative_lifecycle_management doors_next Rational Quality Manager Rational DOORS Next Generation Engineering Workflow Management Rational Rhapsody Design Manager Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.10% / 28.73%

||

7 Day CHG~0.00%

Published-07 Jan, 2021 | 17:40

Updated-17 Sep, 2024 | 01:00

IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190986.

Vendor-IBM Corporation

Product-emptoris_strategic_supply_management Emptoris Sourcing

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.51%

||

7 Day CHG~0.00%

Published-15 Sep, 2020 | 13:50

Updated-17 Sep, 2024 | 01:01

IBM Business Automation Workflow C.D.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-ForceID: 182714.

Vendor-IBM Corporation

Product-business_automation_workflow business_process_manager Business Process Manager Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.51%

||

7 Day CHG~0.00%

Published-28 May, 2020 | 14:45

Updated-16 Sep, 2024 | 22:30

IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 180071.

Vendor-IBM Corporation

Product-jazz_reporting_service Jazz Reporting Service

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.15% / 35.50%

||

7 Day CHG~0.00%

Published-04 Mar, 2021 | 19:05

Updated-17 Sep, 2024 | 03:43

IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190460.

Vendor-IBM Corporation

Product-rational_doors_next_generation global_configuration_management engineering_test_management rational_quality_manager rational_team_concert engineering_workflow_management doors_next engineering_lifecycle_management engineering_requirements_quality_assistant_on-premises Rational Quality Manager Rational DOORS Next Generation Engineering Workflow Management Engineering Lifecycle Optimization Engineering Test Management Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.24% / 47.62%

||

7 Day CHG~0.00%

Published-12 Oct, 2020 | 13:20

Updated-16 Sep, 2024 | 20:59

IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186424.

Vendor-IBM Corporation

Product-security_guardium Security Guardium

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.34% / 56.46%

||

7 Day CHG~0.00%

Published-20 Feb, 2018 | 22:00

Updated-05 Aug, 2024 | 20:51

Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible, and instead use param_exists() and the correct param_*() function to fetch the expected value.

Vendor-n/a Mahara

Product-mahara n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.18% / 39.22%

||

7 Day CHG~0.00%

Published-04 Mar, 2021 | 19:05

Updated-16 Sep, 2024 | 18:34

IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190566.

Vendor-IBM Corporation

Product-rational_doors_next_generation global_configuration_management engineering_test_management rational_quality_manager rational_team_concert engineering_workflow_management doors_next engineering_lifecycle_management engineering_requirements_quality_assistant_on-premises Rational Quality Manager Rational DOORS Next Generation Engineering Workflow Management Engineering Lifecycle Optimization Engineering Test Management Rational Team Concert

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.13% / 32.04%

||

7 Day CHG~0.00%

Published-01 Jun, 2009 | 14:00

Updated-07 Aug, 2024 | 05:27

Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow (1) remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not properly handled in the "HTML exports of books" feature; and (2) allow remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via the help text of an arbitrary vocabulary. NOTE: vector 1 exists because of an incomplete fix for CVE-2009-1575.

Vendor-n/a The Drupal Association

Product-drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.22% / 44.77%

||

7 Day CHG~0.00%

Published-22 Dec, 2017 | 18:00

Updated-20 Apr, 2025 | 01:37

ServersCheck Monitoring Software before 14.2.3 is prone to a cross-site scripting vulnerability as user supplied-data is not validated/sanitized when passed in the settings_SMS_ALERT_TYPE parameter, and JavaScript can be executed on settings-save.html (the Settings - SMS Alerts page).

Vendor-serverscheck n/a

Product-monitoring_software n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Atlassian

Matching Score-4

Assigner-Atlassian

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.34%

||

7 Day CHG~0.00%

Published-02 Feb, 2018 | 14:00

Updated-16 Sep, 2024 | 18:38

The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a branch.

Vendor-Atlassian

Product-bamboo Bamboo

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.17% / 38.27%

||

7 Day CHG~0.00%

Published-12 Oct, 2020 | 13:20

Updated-17 Sep, 2024 | 00:51

IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188197.

Vendor-IBM Corporation

Product-infosphere_information_server InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.74%

||

7 Day CHG~0.00%

Published-04 Aug, 2021 | 14:00

Updated-16 Sep, 2024 | 18:24

IBM API Connect 5.0.0.0 through 5.0.8.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187370.

Vendor-IBM Corporation

Product-api_connect API Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.51%

||

7 Day CHG~0.00%

Published-11 Jun, 2020 | 12:10

Updated-16 Sep, 2024 | 17:53

IBM Workload Scheduler 9.3.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179160.

Vendor-IBM Corporation

Product-workload_scheduler Workload Scheduler

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-VMware by Broadcom

Matching Score-4

Assigner-VMware by Broadcom

CVSS Score-4.8||MEDIUM

EPSS-0.33% / 55.13%

||

7 Day CHG-0.01%

Published-15 Apr, 2020 | 17:20

Updated-04 Aug, 2024 | 07:52

Cross Site Scripting (XSS) vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.

Vendor-n/a VMware (Broadcom Inc.)

Product-vrealize_log_insight VMware vRealize Log Insight

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-20

Improper Input Validation

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.22% / 44.77%

||

7 Day CHG~0.00%

Published-04 Sep, 2020 | 13:35

Updated-16 Sep, 2024 | 20:42

IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187187.

Vendor-IBM Corporation

Product-infosphere_information_server InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.29%

||

7 Day CHG~0.00%

Published-29 Jun, 2020 | 14:00

Updated-17 Sep, 2024 | 00:16

IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183611.

Vendor-IBM Corporation

Product-business_automation_workflow business_process_manager Business Process Manager Business Automation Workflow

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.51%

||

7 Day CHG~0.00%

Published-19 Jun, 2020 | 16:10

Updated-16 Sep, 2024 | 18:13

IBM DOORS Next Generation (DNG/RRC) 6.0.2, 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176141.

Vendor-IBM Corporation

Product-rational_doors_next_generation doors_next Rational DOORS Next Generation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.37% / 58.46%

||

7 Day CHG~0.00%

Published-01 Jun, 2021 | 14:13

Updated-04 Aug, 2024 | 15:56

A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update.

Vendor-bigtreecms n/a

Product-bigtree_cms n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.31% / 54.26%

||

7 Day CHG~0.00%

Published-03 Mar, 2020 | 13:50

Updated-17 Sep, 2024 | 03:17

IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 174907.

Vendor-IBM Corporation

Product-tivoli_netcool\/omnibus Tivoli Netcool/OMNIbus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.51%

||

7 Day CHG~0.00%

Published-04 Aug, 2020 | 16:00

Updated-17 Sep, 2024 | 03:18

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179359.

Vendor-IBM Corporation

Product-engineering_test_management Rational Rhapsody Design Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Atlassian

Matching Score-4

Assigner-Atlassian

CVSS Score-5.4||MEDIUM

EPSS-0.23% / 45.75%

||

7 Day CHG-0.03%

Published-01 Jun, 2020 | 06:35

Updated-16 Sep, 2024 | 16:47

Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view.

Vendor-Atlassian

Product-jira_server jira_software_data_center jira_data_center jira Jira Server and Data Center

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-VMware by Broadcom

Matching Score-4

Assigner-VMware by Broadcom

CVSS Score-5.4||MEDIUM

EPSS-0.30% / 53.38%

||

7 Day CHG~0.00%

Published-21 Aug, 2020 | 17:54

Updated-04 Aug, 2024 | 07:52

VMware App Volumes 2.x prior to 2.18.6 and VMware App Volumes 4 prior to 2006 contain a Stored Cross-Site Scripting (XSS) vulnerability. A malicious actor with access to create and edit applications or create storage groups, may be able to inject malicious script which will be executed by a victim's browser when viewing.

Vendor-n/a VMware (Broadcom Inc.)

Product-app_volumes VMware App Volumes

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.11% / 29.69%

||

7 Day CHG~0.00%

Published-12 Oct, 2020 | 13:05

Updated-17 Sep, 2024 | 03:03

A cross-site scripting (XSS) vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. This vulnerability allows attackers to inject malicious scripts into web applications for the purpose of running unwanted actions on the end user's device, restricted to a single location. IBM X-Force ID: 189153.

Vendor-IBM Corporation

Product-curam_social_program_management Curam SPM

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.17% / 38.27%

||

7 Day CHG~0.00%

Published-19 Nov, 2020 | 15:15

Updated-17 Sep, 2024 | 04:28

IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187731.

Vendor-IBM Corporation

Product-jazz_reporting_service Jazz Reporting Service

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.51%

||

7 Day CHG~0.00%

Published-06 May, 2020 | 13:45

Updated-16 Sep, 2024 | 17:02

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 179265.

Vendor-IBM Corporation

Product-infosphere_information_server_on_cloud infosphere_qualitystage InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-IBM Corporation

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.24% / 46.29%

||

7 Day CHG~0.00%

Published-08 Jan, 2021 | 14:45

Updated-16 Sep, 2024 | 17:58

IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186234.

Vendor-IBM Corporation

Product-engineering_requirements_quality_assistant_on-premises Engineering Requirements Quality Assistant

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')