CVE-2021-41353 | ByteOS Network

Vulnerability Details :

CVE-2021-41353

Assigner-microsoft

Assigner Org ID-f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At-13 Oct, 2021 | 00:28

Updated At-04 Aug, 2024 | 03:08

Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability

Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:microsoft

Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At:13 Oct, 2021 | 00:28

Updated At:04 Aug, 2024 | 03:08

▼CVE Numbering Authority (CNA)

Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability

Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability

Affected Products

Vendor

Microsoft Corporation

Product

Microsoft Dynamics 365 (on-premises) version 9.0

CPEs

cpe:2.3:a:microsoft:dynamics_365:9.0:*:*:*:on-premises:*:*:*

Platforms

Unknown

Versions

Affected

From 9.0.0 before 9.0.31.7 (custom)

Vendor

Microsoft Corporation

Product

Microsoft Dynamics 365 (on-premises) version 9.1

CPEs

cpe:2.3:a:microsoft:dynamics_365:9.1:*:*:*:on-premises:*:*:*

Platforms

Unknown

Versions

Affected

From 9.0 before 9.1.4 (custom)

Problem Types

Type	CWE ID	Description
Impact	N/A	Spoofing

Type: Impact

CWE ID: N/A

Description: Spoofing

Metrics

Version	Base score	Base severity	Vector
3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41353	x_refsource_MISC

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41353

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CISA ADP Vulnrichment

Metrics Other Info

2. CVE Program Container

References

Hyperlink	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41353	x_refsource_MISC x_transferred

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41353

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:secure@microsoft.com

Published At:13 Oct, 2021 | 01:15

Updated At:01 Aug, 2023 | 23:15

Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Secondary	3.1	3.5	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 3.5

Base severity: LOW

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Type: Primary

Version: 2.0

Base score: 3.5

Base severity: LOW

Vector:

AV:N/AC:M/Au:S/C:N/I:P/A:N

CPE Matches

Microsoft Corporation

>>dynamics_365>>9.0

cpe:2.3:a:microsoft:dynamics_365:9.0:*:*:*:on-premises:*:*:*

Microsoft Corporation

>>dynamics_365>>9.1

cpe:2.3:a:microsoft:dynamics_365:9.1:*:*:*:on-premises:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41353	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41353

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

290Records found

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.05% / 14.62%

||

7 Day CHG~0.00%

Published-10 Apr, 2025 | 13:24

Updated-17 Aug, 2025 | 00:09

IBM Sterling Control Center cross-site scripting

IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-linux_kernel windows sterling_control_center aix linux_on_ibm_z Sterling Control Center

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.48% / 64.36%

||

7 Day CHG~0.00%

Published-09 Apr, 2019 | 20:16

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2019-0830.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.61% / 68.87%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-04 Aug, 2024 | 06:18

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0972, CVE-2020-0975, CVE-2020-0976.

Vendor-Microsoft Corporation

Product-sharepoint_server sharepoint_enterprise_server Microsoft SharePoint Server Microsoft SharePoint Enterprise Server

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.58% / 67.87%

||

7 Day CHG~0.00%

Published-16 May, 2019 | 18:24

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.

Vendor-Microsoft Corporation

Product-sharepoint_foundation Microsoft SharePoint Foundation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.07% / 22.83%

||

7 Day CHG~0.00%

Published-01 Dec, 2023 | 20:52

Updated-02 Aug, 2024 | 19:16

IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265504.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.43% / 61.57%

||

7 Day CHG~0.00%

Published-13 Sep, 2018 | 00:00

Updated-05 Aug, 2024 | 06:54

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-8431.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.92% / 75.07%

||

7 Day CHG~0.00%

Published-11 Feb, 2020 | 21:23

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0693.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.06% / 19.02%

||

7 Day CHG~0.00%

Published-01 Dec, 2023 | 20:57

Updated-02 Aug, 2024 | 19:16

IBM InfoSphere Information Server cross-site scripting

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 265938.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-5.43% / 89.78%

||

7 Day CHG+1.56%

Published-24 Oct, 2007 | 23:00

Updated-03 Apr, 2025 | 01:03

Absolute path traversal vulnerability in Alt-N Technologies WebAdmin 2.0.0 through 2.0.2 allows remote attackers with administrator privileges to (1) determine the installation path by reading the contents of the Name parameter in a link, and (2) read arbitrary files via an absolute path in the Name parameter.

Vendor-alt-n n/a Microsoft Corporation

Product-webadmin all_windows n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-1.10% / 77.18%

||

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server 2013 SP1 and Office Online Server allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka "Microsoft Office XSS Elevation of Privilege Vulnerability."

Vendor-Microsoft Corporation

Product-sharepoint_server excel_web_app office_web_apps office_online_server office_web_apps_server Office

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.41% / 60.71%

||

7 Day CHG~0.00%

Published-21 Dec, 2020 | 17:50

Updated-16 Sep, 2024 | 17:43

IBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188600.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows content_navigator linux_kernel Content Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.19% / 40.74%

||

7 Day CHG~0.00%

Published-18 Feb, 2021 | 15:10

Updated-16 Sep, 2024 | 18:34

IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191751.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-jazz_reporting_service windows linux_kernel Jazz Reporting Service

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.14% / 35.08%

||

7 Day CHG~0.00%

Published-01 Jul, 2021 | 15:40

Updated-16 Sep, 2024 | 22:02

IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191753.

Vendor-Microsoft Corporation IBM Corporation

Product-windows datacap_navigator Datacap Navigator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.29% / 51.73%

||

7 Day CHG~0.00%

Published-10 Sep, 2020 | 16:50

Updated-16 Sep, 2024 | 17:37

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 184433.

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Product-solaris linux_kernel websphere_application_server i hp-ux windows z\/os aix WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.18% / 39.99%

||

7 Day CHG~0.00%

Published-28 Jan, 2021 | 19:15

Updated-04 Aug, 2024 | 17:16

Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or Last Name parameter in the 'Add New Record Feature'.

Vendor-egavilanmedia n/a Microsoft Corporation

Product-windows phpcrud n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.02% / 2.61%

||

7 Day CHG~0.00%

Published-14 Apr, 2025 | 20:44

Updated-15 Aug, 2025 | 15:20

IBM Aspera Console cross-site scripting

IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-aspera_console windows linux_kernel Aspera Console

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 8.46%

||

7 Day CHG~0.00%

Published-18 Jul, 2025 | 18:51

Updated-18 Aug, 2025 | 01:33

IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-aix sterling_b2b_integrator windows sterling_file_gateway linux_kernel Sterling File Gateway Sterling B2B Integrator

CWE ID-CWE-1022

Use of Web Link to Untrusted Target with window.opener Access

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 7.22%

||

7 Day CHG~0.00%

Published-08 Jul, 2025 | 14:51

Updated-24 Aug, 2025 | 11:31

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-aix sterling_b2b_integrator windows sterling_file_gateway linux_kernel Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Intel Corporation

Matching Score-8

Assigner-Intel Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.20%

||

7 Day CHG~0.00%

Published-14 Nov, 2023 | 19:04

Updated-30 Aug, 2024 | 17:46

Cross-site request forgery in some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.

Vendor-n/a Intel Corporation Apple Inc.Google LLC Microsoft Corporation

Product-android windows unison_software iphone_os Intel Unison software

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.90% / 74.70%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0893.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.72% / 71.48%

||

7 Day CHG~0.00%

Published-14 Jan, 2020 | 23:11

Updated-04 Aug, 2024 | 06:11

A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server, aka 'Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability'.

Vendor-Microsoft Corporation

Product-dynamics_365 Dynamics 365 Field Service (on-premises) v7 series

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-CERT/CC

Matching Score-8

Assigner-CERT/CC

CVSS Score-5.7||MEDIUM

EPSS-0.51% / 65.53%

||

7 Day CHG~0.00%

Published-09 Dec, 2020 | 00:30

Updated-16 Sep, 2024 | 23:01

Microsoft Teams displayName stored cross-site scripting vulnerability

The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020.

Vendor-Microsoft Corporation

Product-teams Teams

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.62% / 69.15%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-28 Feb, 2025 | 21:15

This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0795.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.61% / 68.87%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-04 Aug, 2024 | 06:18

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0972, CVE-2020-0976, CVE-2020-0977.

Vendor-Microsoft Corporation

Product-sharepoint_server sharepoint_foundation sharepoint_enterprise_server Microsoft SharePoint Server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-28 Feb, 2025 | 20:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-project_server sharepoint_enterprise_server sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server Microsoft Project Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.90% / 74.70%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0894.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.73% / 71.80%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.

Vendor-Microsoft Corporation

Product-exchange_server Microsoft Exchange Server 2019 Cumulative Update 4 Microsoft Exchange Server 2016 Cumulative Update 15 Microsoft Exchange Server 2019 Cumulative Update 3 Microsoft Exchange Server 2016 Cumulative Update 14

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.47% / 63.58%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-28 Feb, 2025 | 21:15

This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server, aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0891.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation business_productivity_servers Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft Business Productivity Servers

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-28 Feb, 2025 | 20:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.61% / 68.87%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:13

Updated-04 Aug, 2024 | 06:18

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0975, CVE-2020-0976, CVE-2020-0977.

Vendor-Microsoft Corporation

Product-sharepoint_server sharepoint_foundation sharepoint_enterprise_server Microsoft SharePoint Server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-1.10% / 77.16%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.82% / 73.51%

||

7 Day CHG~0.00%

Published-15 Apr, 2020 | 15:12

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923, CVE-2020-0924, CVE-2020-0926, CVE-2020-0927, CVE-2020-0930, CVE-2020-0933, CVE-2020-0954, CVE-2020-0973, CVE-2020-0978.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server sharepoint_foundation sharepoint_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Foundation Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.70% / 71.02%

||

7 Day CHG~0.00%

Published-11 Feb, 2020 | 21:23

Updated-28 Feb, 2025 | 21:15

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0694.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server Microsoft SharePoint Enterprise Server Microsoft SharePoint Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.53% / 66.13%

||

7 Day CHG~0.00%

Published-12 Mar, 2020 | 15:48

Updated-04 Aug, 2024 | 06:11

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.

Vendor-Microsoft Corporation

Product-azure_devops_server team_foundation_server Azure DevOps Server 2019 Update 1.1 Team Foundation Server 2018 Team Foundation Server Azure DevOps Server Azure DevOps Server 2019

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Intel Corporation

Matching Score-8

Assigner-Intel Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 37.11%

||

7 Day CHG~0.00%

Published-14 Nov, 2023 | 19:04

Updated-30 Aug, 2024 | 18:28

Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.

Vendor-n/a Intel Corporation Apple Inc.Google LLC Microsoft Corporation

Product-android windows unison_software iphone_os Intel Unison software

CWE ID-CWE-284

Improper Access Control

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 7.22%

||

7 Day CHG~0.00%

Published-08 Jul, 2025 | 14:59

Updated-24 Aug, 2025 | 11:22

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-aix sterling_b2b_integrator windows sterling_file_gateway linux_kernel Sterling B2B Integrator Sterling File Gateway

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.6||HIGH

EPSS-0.25% / 47.93%

||

7 Day CHG~0.00%

Published-12 Sep, 2023 | 16:58

Updated-27 Feb, 2025 | 20:53

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Vendor-Microsoft Corporation

Product-dynamics_365 Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.10% / 28.81%

||

7 Day CHG~0.00%

Published-06 Nov, 2023 | 22:51

Updated-28 Feb, 2025 | 20:15

Microsoft OneNote Spoofing Vulnerability

Microsoft OneNote Spoofing Vulnerability

Vendor-Microsoft Corporation

Product-onenote Microsoft OneNote 2013 Microsoft OneNote 2016 Microsoft Office 2019 Microsoft OneNote 2013 Service Pack 1 Microsoft Office LTSC 2021

CWE ID-CWE-290

Authentication Bypass by Spoofing

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.6||HIGH

EPSS-0.23% / 45.52%

||

7 Day CHG~0.00%

Published-12 Sep, 2023 | 16:58

Updated-27 Feb, 2025 | 20:54

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Vendor-Microsoft Corporation

Product-dynamics_365 Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.6||HIGH

EPSS-0.23% / 45.52%

||

7 Day CHG~0.00%

Published-14 Nov, 2023 | 17:57

Updated-29 Apr, 2025 | 23:34

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Vendor-Microsoft Corporation

Product-dynamics_365 Microsoft Dynamics 365 (on-premises) version 9.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.6||HIGH

EPSS-0.10% / 28.83%

||

7 Day CHG~0.00%

Published-12 Dec, 2023 | 18:10

Updated-01 Jan, 2025 | 02:18

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Vendor-Microsoft Corporation

Product-dynamics_365 Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.6||HIGH

EPSS-0.23% / 45.52%

||

7 Day CHG~0.00%

Published-12 Sep, 2023 | 16:58

Updated-01 Jan, 2025 | 02:04

Dynamics Finance and Operations Cross-site Scripting Vulnerability

Dynamics Finance and Operations Cross-site Scripting Vulnerability

Vendor-Microsoft Corporation

Product-dynamics_365 Dynamics 365 for Finance and Operations

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.6||HIGH

EPSS-0.23% / 45.52%

||

7 Day CHG~0.00%

Published-14 Nov, 2023 | 17:57

Updated-29 Apr, 2025 | 23:34

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Vendor-Microsoft Corporation

Product-dynamics_365 Microsoft Dynamics 365 (on-premises) version 9.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.03% / 5.42%

||

7 Day CHG~0.00%

Published-23 Jan, 2025 | 17:19

Updated-15 Aug, 2025 | 12:46

IBM Tivoli Application Dependency Discovery Manager cross-site scripting

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-Linux Kernel Organization, Inc Microsoft Corporation IBM Corporation

Product-linux_kernel tivoli_application_dependency_discovery_manager windows aix Tivoli Application Dependency Discovery Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.6||HIGH

EPSS-0.39% / 59.37%

||

7 Day CHG~0.00%

Published-11 Apr, 2023 | 19:13

Updated-28 Feb, 2025 | 20:03

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Vendor-Microsoft Corporation

Product-dynamics_365 Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-Microsoft Corporation

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-4.6||MEDIUM

EPSS-1.44% / 79.90%

||

7 Day CHG~0.00%

Published-24 Jan, 2020 | 20:50

Updated-04 Aug, 2024 | 18:20

A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.

Vendor-Microsoft Corporation

Product-outlook Microsoft Outlook for Android