ByteOS

Product

Azure DevOps Server

Versions

Affected

2019.0.1

Vendor

Product

Azure DevOps Server 2019

Versions

Affected

Update 1

Vendor

Azure DevOps Server 2019 Update 1.1

Product

Versions

Affected

unspecified

Problem Types

Type	CWE ID	Description
text	N/A	Spoofing

Type: text

CWE ID: N/A

Description: Spoofing

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1327	x_refsource_MISC

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1327

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1327	x_refsource_MISC x_transferred

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1327

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:09 Jun, 2020 | 20:15

Updated At:21 Jul, 2021 | 11:39

A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

cpe:2.3:o:microsoft:azure_devops_server:2019:update1:*:*:*:*:*:*

>>azure_devops_server>>2019

cpe:2.3:o:microsoft:azure_devops_server:2019:update1.1:*:*:*:*:*:*

>>azure_devops_server>>2019

cpe:2.3:o:microsoft:azure_devops_server:2019.0.1:*:*:*:*:*:*:*

>>azure_devops_server>>2019.0.1

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1327	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1327

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

18102Records found

CVE-2014-1823

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-25.98% / 96.07%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2010 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing a valid meeting ID, aka "Lync Server Content Sanitization Vulnerability."

Product-lync_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-1754

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-12.15% / 93.56%

7 Day CHG~0.00%

Published-14 May, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2013 Gold and SP1, SharePoint Foundation 2013 Gold and SP1, Office Web Apps Server 2013 Gold and SP1, and SharePoint Server 2013 Client Components SDK allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."

Product-office_web_apps_server sharepoint_server_client_components_sdk sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-1820

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-19.54% / 95.19%

7 Day CHG~0.00%

Published-12 Aug, 2014 | 21:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Master Data Services (MDS) in Microsoft SQL Server 2012 SP1 and 2014 on 64-bit platforms allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "SQL Master Data Services XSS Vulnerability."

Product-sql_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-1055

Matching Score-10

Matching Score-10

CVSS Score-5.4||MEDIUM

EPSS-0.71% / 71.42%

7 Day CHG~0.00%

Published-21 May, 2020 | 22:52

Updated-28 Feb, 2025 | 20:15

A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs, aka 'Microsoft Active Directory Federation Services Cross-Site Scripting Vulnerability'.

Product-windows_server_2019 windows_server_2016 windows_10 Windows Server, version 1909 (Server Core installation)Windows 10 Version 1903 for ARM64-based Systems Windows 10 Version 1909 for 32-bit Systems Windows Server Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation)Windows 10 Version 1903 for 32-bit Systems Windows 10 Version 1909 for ARM64-based Systems Windows 10 Version 1909 for x64-based Systems Windows

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-4594

Matching Score-10

Assigner-Spanish National Cybersecurity Institute, S.A. (INCIBE)

Matching Score-10

Assigner-Spanish National Cybersecurity Institute, S.A. (INCIBE)

CVSS Score-6.1||MEDIUM

EPSS-0.08% / 23.78%

7 Day CHG~0.00%

Published-23 Nov, 2023 | 12:35

Updated-21 Nov, 2024 | 19:31

Cross-site Scripting in BVRP Software SLmail

Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in the MailAdmin_dll.htm file.

Vendor-seattlelab BVRP Software Microsoft Corporation

Product-windows slmail SLmail

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-1050

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-1.03% / 76.35%

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-04 Aug, 2024 | 06:25

A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'. This CVE ID is unique from CVE-2020-1049.

Product-dynamics_365_server Dynamics 365 Server, version 9.0 (on-premises)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0562

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 69.87%

7 Day CHG~0.00%

Published-17 Sep, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0812

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 57.18%

7 Day CHG~0.00%

Published-01 Feb, 2014 | 15:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in KENT-WEB Joyful Note 2.8 and earlier, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-kent-web n/a Microsoft Corporation

Product-internet_explorer joyful_note n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-8600

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-0.46% / 63.26%

7 Day CHG~0.00%

Published-14 Nov, 2018 | 01:00

Updated-05 Aug, 2024 | 07:02

A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka "Azure App Service Cross-site Scripting Vulnerability." This affects Azure App.

Product-azure_app_service_on_azure_stack Azure App

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-6905

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.23%

7 Day CHG~0.00%

Published-05 Dec, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Mozilla Corporation Cybozu, Inc.Microsoft Corporation

Product-garoon firefox internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-4116

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-12.32% / 93.61%

7 Day CHG~0.00%

Published-11 Nov, 2014 | 22:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2010 SP2 allows remote authenticated users to inject arbitrary web script or HTML via a modified list, aka "SharePoint Elevation of Privilege Vulnerability."

Product-sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-4075

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-18.60% / 95.01%

7 Day CHG~0.00%

Published-15 Oct, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in System.Web.Mvc.dll in Microsoft ASP.NET Model View Controller (MVC) 2.0 through 5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted web page, aka "MVC XSS Vulnerability."

Product-asp.net_model_view_controller n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-6903

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.23%

7 Day CHG~0.00%

Published-05 Dec, 2013 | 11:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in a schedule component in Cybozu Garoon before 3.7.0, when Internet Explorer or Firefox is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Mozilla Corporation Cybozu, Inc.Microsoft Corporation

Product-garoon firefox internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-1106

Matching Score-10

Matching Score-10

CVSS Score-5.4||MEDIUM

EPSS-1.85% / 82.27%

7 Day CHG~0.00%

Published-21 May, 2020 | 22:53

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1099, CVE-2020-1100, CVE-2020-1101.

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-5072

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-6.93% / 91.03%

7 Day CHG~0.00%

Published-11 Dec, 2013 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-5042

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-10.41% / 92.92%

7 Day CHG~0.00%

Published-11 Dec, 2013 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft ASP.NET SignalR 1.1.x before 1.1.4 and 2.0.x before 2.0.1, and Visual Studio Team Foundation Server 2013, allows remote attackers to inject arbitrary web script or HTML via crafted Forever Frame transport protocol data, aka "SignalR XSS Vulnerability."

Product-visual_studio_team_foundation_server asp.net_signalr n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0533

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-0.97% / 75.74%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0531 and CVE-2014-0532.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0532

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-3.47% / 87.08%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-17070

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.44% / 62.23%

7 Day CHG~0.00%

Published-10 Oct, 2019 | 10:51

Updated-05 Aug, 2024 | 01:33

The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.

Vendor-lqd n/a Microsoft Corporation

Product-liquid_speech_balloon internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-3648

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 52.54%

7 Day CHG~0.00%

Published-28 Jun, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in KENT-WEB POST-MAIL before 6.7, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.

Vendor-kent-web n/a Microsoft Corporation

Product-post-mail internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-3649

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 52.54%

7 Day CHG~0.00%

Published-28 Jun, 2013 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in KENT-WEB CLIP-MAIL before 3.4, when Internet Explorer 7 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.

Vendor-kent-web n/a Microsoft Corporation

Product-internet_explorer clip-mail n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-3180

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.63%

7 Day CHG~0.00%

Published-11 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted POST request, aka "POST XSS Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-3179

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-11.88% / 93.48%

7 Day CHG~0.00%

Published-11 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "SharePoint XSS Vulnerability."

Product-sharepoint_services sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-2321

Matching Score-10

Assigner-HP Inc.

Matching Score-10

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.62% / 69.21%

7 Day CHG~0.00%

Published-02 May, 2013 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Service Manager Web Tier 9.31 before 9.31.2004 p2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-windows service_manager_web_tier n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-43039

Matching Score-10

Assigner-IBM Corporation

Matching Score-10

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.03% / 7.34%

7 Day CHG~0.00%

Published-08 Jul, 2025 | 18:25

Updated-17 Aug, 2025 | 00:04

IBM OpenPages with Watson cross-site scripting

IBM OpenPages with Watson 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel windows openpages_with_watson OpenPages with Watson

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-0942

Matching Score-10

Assigner-Dell

Matching Score-10

Assigner-Dell

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 51.59%

7 Day CHG~0.00%

Published-22 May, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a The Apache Software Foundation ELAN Microelectronics Corporation Microsoft Corporation

Product-http_server internet_information_server rsa_authentication_agent n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2005-0563

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-22.96% / 95.69%

7 Day CHG~0.00%

Published-14 Jun, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA) component in Exchange Server 5.5 allows remote attackers to inject arbitrary web script or HTML via an email message with an encoded javascript: URL ("jav&#X41sc
ript:") in an IMG tag.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-1289

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-61.90% / 98.28%

7 Day CHG~0.00%

Published-09 Apr, 2013 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."

Product-office_web_apps infopath groove_server sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2019-0869

Matching Score-10

Matching Score-10

CVSS Score-6.1||MEDIUM

EPSS-0.49% / 64.72%

7 Day CHG~0.00%

Published-09 Apr, 2019 | 20:20

Updated-04 Aug, 2024 | 17:58

A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'.

Product-azure_devops_server Azure DevOps Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2004-2704

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-25.15% / 95.97%

7 Day CHG~0.00%

Published-06 Oct, 2007 | 21:00

Updated-03 Apr, 2025 | 01:03

Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.

Vendor-hastymail n/a Microsoft Corporation

Product-hastymail internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0017

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-47.53% / 97.62%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in inplview.aspx Vulnerability."

Product-sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0132

Matching Score-10

Assigner-HP Inc.

Matching Score-10

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.75% / 72.15%

7 Day CHG~0.00%

Published-04 Apr, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-business_availability_center windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4735

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.51% / 65.24%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/user/create and certain other files.

Vendor-n/a Parallels International Gmbh Red Hat, Inc.Microsoft Corporation

Product-enterprise_linux windows parallels_plesk_panel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-0083

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-37.87% / 97.10%

7 Day CHG~0.00%

Published-13 Mar, 2013 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via crafted content, leading to administrative command execution, aka "SharePoint XSS Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1891

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.63%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in a request to a script, aka "Contact Details Reflected XSS Vulnerability."

Product-sharepoint_services sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-6326

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-5.13% / 89.47%

7 Day CHG~0.00%

Published-11 Dec, 2014 | 00:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6325.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-4374

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.54% / 66.62%

7 Day CHG~0.00%

Published-03 Apr, 2019 | 17:43

Updated-05 Aug, 2024 | 05:11

A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.

Vendor-n/a Apple Inc.Microsoft Corporation

Product-itunes iphone_os watchos safari windows icloud iOS, watchOS, Safari, iTunes for Windows, iCloud for Windows

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2004-0203

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-25.67% / 96.03%

7 Day CHG~0.00%

Published-12 Aug, 2004 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-4144

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.40% / 60.10%

7 Day CHG~0.00%

Published-06 Aug, 2012 | 16:00

Updated-11 Apr, 2025 | 00:51

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, does not properly escape characters in DOM elements, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted HTML document.

Vendor-n/a Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Opera

Product-mac_os_x opera_browser linux_kernel windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-4015

Matching Score-10

Assigner-JPCERT/CC

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.20%

7 Day CHG~0.00%

Published-25 Sep, 2012 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the management screen in myLittleTools myLittleAdmin for SQL Server 2000 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted database entry.

Vendor-mylittletools n/a Microsoft Corporation

Product-mylittleadmin sql_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3324

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-43.67% / 97.43%

7 Day CHG~0.00%

Published-17 Sep, 2010 | 17:46

Updated-11 Apr, 2025 | 00:51

The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule, aka "HTML Sanitization Vulnerability," a different vulnerability than CVE-2010-1257.

Product-groove_server sharepoint_services sharepoint_server sharepoint_foundation web_apps internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-4136

Matching Score-10

Assigner-Crafter CMS

Matching Score-10

Assigner-Crafter CMS

CVSS Score-7.4||HIGH

EPSS-14.17% / 94.11%

7 Day CHG~0.00%

Published-03 Aug, 2023 | 13:33

Updated-13 Feb, 2025 | 17:17

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.

Vendor-craftercms CrafterCMS Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-windows linux_kernel macos craftercms CrafterCMS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1762

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.91% / 74.85%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML in a TEXTAREA element.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-25256

Matching Score-10

Assigner-MITRE Corporation

Vendor-sas n/a Hewlett Packard Enterprise (HPE)Oracle Corporation Microsoft Corporation IBM Corporation Linux Kernel Organization, Inc

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.75% / 72.11%

7 Day CHG~0.00%

Published-19 Feb, 2022 | 00:17

Updated-03 Aug, 2024 | 04:36

SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list. The first one affects the content of the button placed in the top left. The second affects the page to which the user is directed after pressing the button, e.g., a malicious web page. In addition, the second parameter executes JavaScript, which means XSS is possible by adding a javascript: URL.

Product-hp-ux_ipfilter solaris linux_kernel windows web_report_studio aix n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-4142

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.42% / 61.00%

7 Day CHG~0.00%

Published-06 Aug, 2012 | 16:00

Updated-11 Apr, 2025 | 00:51

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, ignores some characters in HTML documents in unspecified circumstances, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.

Vendor-n/a Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Opera

Product-mac_os_x opera_browser linux_kernel windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1372

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.35% / 56.40%

7 Day CHG~0.00%

Published-17 Oct, 2007 | 01:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in links.php script in myPHPNuke 1.8.8, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the (1) ratenum or (2) query parameters.

Vendor-myphpnuke unix n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel all_windows myphpnuke unix n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1467

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 69.90%

7 Day CHG~0.00%

Published-24 Oct, 2007 | 23:00

Updated-03 Apr, 2025 | 01:03

Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

Vendor-phorum unix n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel all_windows unix phorum n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-7140

Matching Score-10

Assigner-Hewlett Packard Enterprise (HPE)

Matching Score-10

Assigner-Hewlett Packard Enterprise (HPE)

CVSS Score-6.1||MEDIUM

EPSS-0.40% / 59.78%

7 Day CHG~0.00%

Published-08 Jul, 2020 | 13:39

Updated-04 Aug, 2024 | 09:18

A security vulnerability in HPE IceWall SSO Dfw and Dgfw (Domain Gateway Option) could be exploited remotely to cause a remote cross-site scripting (XSS). HPE has provided the following information to resolve this vulnerability in HPE IceWall SSO DFW and Dgfw: https://www.hpe.com/jp/icewall_patchaccess

Vendor-n/a Microsoft Corporation HP Inc.Red Hat, Inc.

Product-icewall_sso_dgfw windows icewall_sso_dfw enterprise_linux IceWall SSO Dfw; IceWall SSO Dgfw

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-0712

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-18.97% / 95.08%

7 Day CHG~0.00%

Published-17 Oct, 2003 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access (OWA) allows remote attackers to execute arbitrary web script.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-2520

Matching Score-10

Matching Score-10

CVSS Score-4.3||MEDIUM

EPSS-28.05% / 96.29%

7 Day CHG~0.00%

Published-09 Oct, 2012 | 21:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."