ByteOS

Microsoft Dynamics NAV 2017

Product

CPEs

cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:*

Platforms

Unknown

Versions

Affected

From 1.0 before 30601 (custom)

Vendor

Microsoft Dynamics NAV 2018

Product

CPEs

cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:*

Platforms

Unknown

Versions

Affected

From 1.0 before 47562 (custom)

Vendor

Dynamics 365 Business Central Spring 2019 Update

Product

CPEs

cpe:2.3:a:microsoft:dynamics_365_business_central:2019:spring_update:*:*:*:*:*:*

Platforms

Unknown

Versions

Affected

From 14.0.0 before Application Build 14.27.47563, Platform Build 14.0 (custom)

Vendor

Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.9

Product

CPEs

cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_2:*:*:*:*:*:*

Platforms

Unknown

Versions

Affected

From 17.0 before Application Build 17.9.28504, Platform Build 17.0. (custom)

Vendor

Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.15

Product

CPEs

cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_1:*:*:*:*:*:*

Platforms

Unknown

Versions

Affected

From 16.0 before Application Build 16.15.28500, Platform Build 16.0 (custom)

Problem Types

Type	CWE ID	Description
Impact	N/A	Spoofing

Type: Impact

CWE ID: N/A

Description: Spoofing

Metrics

Version	Base score	Base severity	Vector
3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36946	x_refsource_MISC

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36946

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36946	x_refsource_MISC x_transferred

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36946

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:12 Aug, 2021 | 18:15

Updated At:28 Dec, 2023 | 20:15

Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Secondary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 3.5

Base severity: LOW

Vector:

AV:N/AC:M/Au:S/C:N/I:P/A:N

CPE Matches

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36946	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36946

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

0Records found

CVE-2012-0007

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-59.16% / 98.18%

7 Day CHG~0.00%

Published-10 Jan, 2012 | 21:00

Updated-11 Apr, 2025 | 00:51

The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style Sheets (CSS) escaped character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML input, aka "AntiXSS Library Bypass Vulnerability."

Product-anti-cross_site_scripting_library n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4735

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.51% / 65.39%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/user/create and certain other files.

Vendor-n/a Parallels International Gmbh Red Hat, Inc.Microsoft Corporation

Product-enterprise_linux windows parallels_plesk_panel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0145

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-47.53% / 97.65%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in wizardlist.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in wizardlist.aspx Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0132

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.75% / 72.31%

7 Day CHG~0.00%

Published-04 Apr, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-business_availability_center windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4776

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.34%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other files.

Vendor-n/a Parallels International Gmbh Microsoft Corporation

Product-windows_server_2008 parallels_plesk_panel windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4777

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.34%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html.

Vendor-n/a Parallels International Gmbh Microsoft Corporation

Product-windows_server_2008 parallels_plesk_panel windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0287

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-2.6||LOW

EPSS-0.52% / 65.86%

7 Day CHG~0.00%

Published-06 Jan, 2012 | 02:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.

Vendor-n/a WordPress.org Microsoft Corporation

Product-wordpress internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0144

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-47.53% / 97.65%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in themeweb.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in themeweb.aspx Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4726

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.34%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain other files.

Vendor-n/a Parallels International Gmbh Red Hat, Inc.Microsoft Corporation

Product-enterprise_linux windows parallels_plesk_panel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4345

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-2.6||LOW

EPSS-0.44% / 62.52%

7 Day CHG~0.00%

Published-30 Nov, 2011 | 02:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Namazu before 2.0.21, when Internet Explorer 6 or 7 is used, allows remote attackers to inject arbitrary web script or HTML via a cookie.

Vendor-namazu n/a Microsoft Corporation

Product-namazu internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-17039

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.31%

7 Day CHG~0.00%

Published-14 Sep, 2018 | 07:00

Updated-05 Aug, 2024 | 10:39

MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.

Vendor-1234n n/a Microsoft Corporation

Product-minicms internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2379

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.44% / 62.52%

7 Day CHG~0.00%

Published-09 Aug, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode, allows remote attackers to inject arbitrary web script or HTML via a crafted patch, related to content sniffing.

Vendor-n/a Mozilla Corporation Microsoft Corporation Apple Inc.

Product-bugzilla safari internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2444

Matching Score-6

Matching Score-6

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.92% / 75.18%

7 Day CHG~0.00%

Published-22 Sep, 2011 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site scripting issue," as exploited in the wild in September 2011.

Product-linux_kernel windows android flash_player sunos mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-45049

Matching Score-6

Assigner-Dutch Institute for Vulnerability Disclosure (DIVD)

Matching Score-6

Assigner-Dutch Institute for Vulnerability Disclosure (DIVD)

CVSS Score-6.1||MEDIUM

EPSS-0.13% / 32.68%

7 Day CHG~0.00%

Published-04 Jan, 2023 | 18:11

Updated-10 Apr, 2025 | 18:05

Reflected XSS in Axiell Iguana CMS

A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The url parameter on the novelist.php endpoint does not properly neutralise user input, resulting in the vulnerability.

Vendor-axiell Axiell Linux Kernel Organization, Inc Microsoft Corporation

Product-windows linux_kernel iguana Iguana

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2107

Matching Score-6

Matching Score-6

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.08% / 77.05%

7 Day CHG~0.00%

Published-07 Jun, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."

Product-linux_kernel windows acrobat_reader acrobat flash_player android sunos mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1897

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-15.11% / 94.37%

7 Day CHG~0.00%

Published-12 Oct, 2011 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Default Reflected XSS Vulnerability."

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1587

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 48.92%

7 Day CHG~0.00%

Published-27 Apr, 2011 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1765

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.43% / 61.88%

7 Day CHG~0.00%

Published-23 May, 2011 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1263

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-64.34% / 98.39%

7 Day CHG~0.00%

Published-10 Aug, 2011 | 21:16

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the logon page in Remote Desktop Web Access (RD Web Access) in Microsoft Windows Server 2008 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "Remote Desktop Web Access Vulnerability."

Product-windows_server_2008 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1894

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-20.11% / 95.31%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-11 Apr, 2025 | 00:51

The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for embedded content in an HTML document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted EMBED element in a web page that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_2003_server windows_vista n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1891

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.66%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in a request to a script, aka "Contact Details Reflected XSS Vulnerability."

Product-sharepoint_services sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1976

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-79.01% / 99.04%

7 Day CHG~0.00%

Published-10 Aug, 2011 | 21:16

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote attackers to inject arbitrary web script or HTML via a parameter in a data source, aka "Report Viewer Controls XSS Vulnerability."

Product-report_viewer visual_studio n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1896

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-10.69% / 93.08%

7 Day CHG~0.00%

Published-12 Oct, 2011 | 01:00

Updated-11 Apr, 2025 | 00:51

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1890

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-40.97% / 97.31%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in EditForm.aspx in Microsoft Office SharePoint Server 2010 and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via a post, aka "Editform Script Injection Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1992

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-22.07% / 95.61%

7 Day CHG~0.00%

Published-14 Dec, 2011 | 00:00

Updated-11 Apr, 2025 | 00:51

The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to read content from a different (1) domain or (2) zone via a "trial and error" attack, aka "XSS Filter Information Disclosure Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_vista internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1252

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-20.85% / 95.44%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the SafeHTML function in the toStaticHTML API in Microsoft Internet Explorer 7 and 8, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP1, Groove Server 2010 Gold and SP1, Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified strings, aka "toStaticHTML Information Disclosure Vulnerability" or "HTML Sanitization Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_2003_server windows_vista internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1264

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-2.98% / 86.07%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Active Directory Certificate Services Web Enrollment in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Active Directory Certificate Services Vulnerability."

Product-windows_server_2003 windows_server_2008 windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1893

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.66%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010, Windows SharePoint Services 2.0 and 3.0 SP2, and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "SharePoint XSS Vulnerability."

Product-sharepoint_server sharepoint_foundation sharepoint_services n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1578

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.70% / 71.18%

7 Day CHG~0.00%

Published-27 Apr, 2011 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0653

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.66%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010 Gold and SP1, and SharePoint Foundation 2010, allows remote attackers to inject arbitrary web script or HTML via the URI, aka "XSS in SharePoint Calendar Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-45051

Matching Score-6

Assigner-Dutch Institute for Vulnerability Disclosure (DIVD)

Matching Score-6

Assigner-Dutch Institute for Vulnerability Disclosure (DIVD)

CVSS Score-6.1||MEDIUM

EPSS-0.13% / 32.68%

7 Day CHG~0.00%

Published-04 Jan, 2023 | 18:11

Updated-10 Apr, 2025 | 18:05

Reflected POST XSS in Axiell Iguana CMS

A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The module parameter on the Service.template.cls endpoint does not properly neutralise user input, resulting in the vulnerability.

Vendor-axiell Axiell Linux Kernel Organization, Inc Microsoft Corporation

Product-windows linux_kernel iguana Iguana

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0604

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-1.29% / 78.90%

7 Day CHG~0.00%

Published-10 Feb, 2011 | 17:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-0587.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-2078

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.21% / 43.45%

7 Day CHG~0.00%

Published-08 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter.

Vendor-n/a VMware (Broadcom Inc.)Microsoft Corporation

Product-windows vcenter_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0096

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-79.92% / 99.08%

7 Day CHG~0.00%

Published-31 Jan, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_2003_server windows_vista n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0587

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-1.39% / 79.71%

7 Day CHG~0.00%

Published-10 Feb, 2011 | 17:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0242

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 50.91%

7 Day CHG~0.00%

Published-21 Jul, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via vectors involving a URL that contains a username.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-4183

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 49.59%

7 Day CHG~0.00%

Published-05 Nov, 2010 | 16:28

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.

Vendor-htmlpurifier n/a Microsoft Corporation

Product-htmlpurifier internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-4114

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.67% / 70.54%

7 Day CHG~0.00%

Published-22 Dec, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Discovery & Dependency Mapping Inventory (DDMI) 2.5x, 7.5x, and 7.6x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-windows discovery\&dependency_mapping_inventory n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3936

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-42.35% / 97.38%

7 Day CHG~0.00%

Published-10 Nov, 2010 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS in Signurl.asp Vulnerability."

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-49745

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-0.05% / 14.28%

7 Day CHG~0.00%

Published-12 Aug, 2025 | 17:09

Updated-28 Aug, 2025 | 19:39

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to perform spoofing over a network.

Vendor-Microsoft Corporation

Product-dynamics_365 Microsoft Dynamics 365 (on-premises) version 9.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-28459

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-0.52% / 66.12%

7 Day CHG~0.00%

Published-13 Apr, 2021 | 19:33

Updated-03 Aug, 2024 | 21:40

Azure DevOps Server Spoofing Vulnerability

Vendor-Microsoft Corporation

Product-azure_devops_server Azure DevOps Server 2020.0.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-4111

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.47% / 63.99%

7 Day CHG-0.14%

Published-22 Dec, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.1.3712 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel windows insight_diagnostics n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3985

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.85% / 74.13%

7 Day CHG~0.00%

Published-26 Oct, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Operations Orchestration before 9.0, when Internet Explorer 6.0 is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-operations_orchestration internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3243

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-39.62% / 97.22%

7 Day CHG~0.00%

Published-13 Oct, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "HTML Sanitization Vulnerability."

Product-sharepoint_services windows_7 sharepoint_server windows_xp windows_server_2008 windows_server_2003 windows_vista internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-3324

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-43.67% / 97.45%

7 Day CHG~0.00%

Published-17 Sep, 2010 | 17:46

Updated-11 Apr, 2025 | 00:51

The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule, aka "HTML Sanitization Vulnerability," a different vulnerability than CVE-2010-1257.

Product-groove_server sharepoint_services sharepoint_server sharepoint_foundation web_apps internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2733

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.66%

7 Day CHG~0.00%

Published-10 Nov, 2010 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the Web Monitor in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "UAG XSS Allows EOP Vulnerability."

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2428

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.75% / 72.26%

7 Day CHG~0.00%

Published-23 Jun, 2010 | 17:13

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing FTP Server for Windows 3.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted POST request.

Vendor-wftpserver n/a Microsoft Corporation

Product-windows wing_ftp_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2665

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.68% / 70.85%

7 Day CHG~0.00%

Published-07 Jul, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote attackers to inject arbitrary web script or HTML via a data: URI, related to incorrect detection of the "opening site."

Vendor-unix n/a Microsoft Corporation Apple Inc.Opera

Product-windows opera_browser mac_os_x unix n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2429

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 50.91%

7 Day CHG~0.00%

Published-23 Jun, 2010 | 17:13

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.1.2, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer in a "404 Not Found" response.

Vendor-n/a Splunk LLC (Cisco Systems, Inc.)Microsoft Corporation

Product-splunk internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2265

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-44.19% / 97.48%

7 Day CHG~0.00%

Published-14 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to sysinfo/sysinfomain.htm. NOTE: this can be leveraged with CVE-2010-1885 to execute arbitrary commands without user interaction.