ByteOS

Microsoft Dynamics 365 (on-premises) version 9.1

Product

Platforms

Unknown

Versions

Affected

From 9.0 before 9.1.16.20 (custom)

Vendor

Microsoft Dynamics 365 (on-premises) version 9.0

Product

Platforms

Unknown

Versions

Affected

From 9.0.0 before 9.0.45.11 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C

References

Hyperlink	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807	vendor-advisory

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807	vendor-advisory x_transferred

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807

Resource:

vendor-advisory

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:14 Feb, 2023 | 20:15

Updated At:29 May, 2024 | 03:15

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Secondary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Type: Primary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

CPE Matches

cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:on-premises:*:*:*

>>dynamics_365>>Versions between 9.0(exclusive) and 9.0.45.11(exclusive)

cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:on-premises:*:*:*

>>dynamics_365>>Versions from 9.1(inclusive) to 9.1.16.20(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-79	Secondary	secure@microsoft.com

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-79

Type: Secondary

Source: secure@microsoft.com

References

Hyperlink	Source	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

698Records found

CVE-2021-26421

Matching Score-8

Matching Score-8

Product-lync_server skype_for_business_server Skype for Business Server 2015 CU11 Microsoft Lync Server 2013 CU10

CVSS Score-6.5||MEDIUM

EPSS-1.67% / 81.83%

7 Day CHG~0.00%

Published-11 May, 2021 | 19:11

Updated-03 Aug, 2024 | 20:26

Skype for Business and Lync Spoofing Vulnerability

Vendor-Microsoft Corporation

CVE-2021-29913

Matching Score-8

Assigner-IBM Corporation

Matching Score-8

Assigner-IBM Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.05% / 16.59%

7 Day CHG~0.00%

Published-17 Oct, 2023 | 01:28

Updated-13 Sep, 2024 | 18:07

IBM Security Verify Privilege improper input validation

IBM Security Verify Privilege On-Premise 11.5 could allow an authenticated user to obtain sensitive information or perform unauthorized actions due to improper input validation. IBM X-Force ID: 207898.

Vendor-Apple Inc.Microsoft Corporation IBM Corporation

Product-windows macos security_verify_privilege_on-premises Security Verify Privilege

CWE ID-CWE-20

Improper Input Validation

CVE-2021-24073

Matching Score-8

Matching Score-8

CVSS Score-6.5||MEDIUM

EPSS-0.53% / 66.95%

7 Day CHG~0.00%

Published-25 Feb, 2021 | 23:01

Updated-03 Aug, 2024 | 19:21

Skype for Business and Lync Spoofing Vulnerability

Vendor-Microsoft Corporation

Product-lync_server skype_for_business_server Microsoft Lync Server 2013 Skype for Business Server 2015 CU 8

CVE-2011-4345

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-2.6||LOW

EPSS-0.44% / 62.88%

7 Day CHG~0.00%

Published-30 Nov, 2011 | 02:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Namazu before 2.0.21, when Internet Explorer 6 or 7 is used, allows remote attackers to inject arbitrary web script or HTML via a cookie.

Vendor-namazu n/a Microsoft Corporation

Product-namazu internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1299

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.22% / 44.04%

7 Day CHG~0.00%

Published-12 Mar, 2008 | 17:00

Updated-03 Apr, 2025 | 14:15

Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Vendor-n/a Microsoft Corporation ManageEngine (Zoho Corporation Pvt. Ltd.)

Product-windows servicedesk_plus n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1888

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-24.96% / 96.05%

7 Day CHG~0.00%

Published-18 Apr, 2008 | 21:00

Updated-07 Aug, 2024 | 08:40

Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML via the Picture Source (aka picture object source) field in the Rich Text Editor.

Product-sharepoint_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-28529

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.13% / 32.69%

7 Day CHG~0.00%

Published-19 May, 2023 | 15:44

Updated-21 Jan, 2025 | 19:33

IBM InfoSphere Information Server 11.7

IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 251213.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix windows infosphere_information_server linux_kernel InfoSphere Information Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2444

Matching Score-6

Matching Score-6

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.92% / 75.66%

7 Day CHG~0.00%

Published-22 Sep, 2011 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site scripting issue," as exploited in the wild in September 2011.

Product-linux_kernel windows android flash_player sunos mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2379

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.44% / 62.88%

7 Day CHG~0.00%

Published-09 Aug, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode, allows remote attackers to inject arbitrary web script or HTML via a crafted patch, related to content sniffing.

Vendor-n/a Mozilla Corporation Microsoft Corporation Apple Inc.

Product-bugzilla safari internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-28347

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-9.6||CRITICAL

EPSS-1.53% / 81.12%

7 Day CHG~0.00%

Published-30 May, 2023 | 00:00

Updated-13 Jan, 2025 | 22:15

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that functions similarly to a Student Console, providing unauthenticated attackers with the ability to exploit XSS vulnerabilities within the Teacher Console application and achieve remote code execution as NT AUTHORITY/SYSTEM on all connected Student Consoles and the Teacher Console in a Zero Click manner.

Vendor-faronics n/a Microsoft Corporation

Product-windows insight n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1001

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.40% / 60.41%

7 Day CHG~0.00%

Published-19 Mar, 2008 | 00:00

Updated-07 Aug, 2024 | 08:08

Cross-site scripting (XSS) vulnerability in Apple Safari before 3.1, when running on Windows XP or Vista, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is not properly handled in the error page.

Product-safari windows_xp windows_vista n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-0009

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-24.93% / 96.04%

7 Day CHG~0.00%

Published-09 Jan, 2013 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System Center Operations Manager Web Console XSS Vulnerability," a different vulnerability than CVE-2013-0010.

Product-system_center_operations_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0454

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-43.65% / 97.44%

7 Day CHG~0.00%

Published-25 Jan, 2008 | 00:00

Updated-07 Aug, 2024 | 07:46

Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Title field of a (1) Dailymotion and possibly (2) Metacafe movie in the Skype video gallery, accessible through a search within the "Add video to chat" dialog, aka "videomood XSS."

Vendor-skype_technologies n/a Microsoft Corporation

Product-skype windows internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1893

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-58.89% / 98.18%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010, Windows SharePoint Services 2.0 and 3.0 SP2, and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "SharePoint XSS Vulnerability."

Product-sharepoint_server sharepoint_foundation sharepoint_services n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0751

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.50% / 65.36%

7 Day CHG~0.00%

Published-13 Feb, 2008 | 19:00

Updated-07 Aug, 2024 | 07:54

Cross-site scripting (XSS) vulnerability in the Freetag before 2.96 plugin for S9Y Serendipity, when using Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to plugin/tag/.

Vendor-s9y n/a Microsoft Corporation

Product-serendipity_event_freetag internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0460

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-15.66% / 94.56%

7 Day CHG~0.00%

Published-25 Jan, 2008 | 15:00

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki_botquery_ext internet_explorer mediawiki n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-0513

Matching Score-6

Assigner-Octopus Deploy

Vendor-Octopus Deploy Pty. Ltd.Linux Kernel Organization, Inc Microsoft Corporation

Matching Score-6

Assigner-Octopus Deploy

CVSS Score-1.8||LOW

EPSS-0.06% / 18.34%

7 Day CHG~0.00%

Published-11 Feb, 2025 | 10:27

Updated-02 Jul, 2025 | 17:24

In affected versions of Octopus Server error messages were handled unsafely on the error page. If an adversary could control any part of the error message they could embed code which may impact the user viewing the error message.

Product-linux_kernel windows octopus_server Octopus Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1264

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-1.88% / 82.87%

7 Day CHG~0.00%

Published-16 Jun, 2011 | 20:21

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Active Directory Certificate Services Web Enrollment in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Active Directory Certificate Services Vulnerability."

Product-windows_server_2003 windows_server_2008 windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1765

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.47%

7 Day CHG~0.00%

Published-23 May, 2011 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1992

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-18.15% / 95.05%

7 Day CHG~0.00%

Published-14 Dec, 2011 | 00:00

Updated-11 Apr, 2025 | 00:51

The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to read content from a different (1) domain or (2) zone via a "trial and error" attack, aka "XSS Filter Information Disclosure Vulnerability."

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_vista internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1570

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-3.5||LOW

EPSS-0.65% / 70.34%

7 Day CHG~0.00%

Published-07 May, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to inject arbitrary web script or HTML via a message title, a different vulnerability than CVE-2004-2030.

Vendor-n/a Liferay Inc.Microsoft Corporation

Product-windows_7 liferay_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1578

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.71% / 71.98%

7 Day CHG~0.00%

Published-27 Apr, 2011 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1587

Matching Score-6

Assigner-Red Hat, Inc.

Matching Score-6

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 44.70%

7 Day CHG~0.00%

Published-27 Apr, 2011 | 00:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-2107

Matching Score-6

Matching Score-6

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.08% / 77.51%

7 Day CHG~0.00%

Published-07 Jun, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."

Product-linux_kernel windows acrobat_reader acrobat flash_player android sunos mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-3670

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-50.12% / 97.77%

7 Day CHG+0.39%

Published-10 Jul, 2007 | 19:00

Updated-07 Aug, 2024 | 14:28

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data."

Vendor-n/a Mozilla Corporation Microsoft Corporation

Product-firefox internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-8035

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 44.54%

7 Day CHG~0.00%

Published-21 Aug, 2024 | 20:20

Updated-13 Mar, 2025 | 21:15

Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Vendor-Microsoft Corporation Google LLC

Product-chrome windows Chrome

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-1859

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-41.34% / 97.32%

7 Day CHG~0.00%

Published-10 Jul, 2012 | 21:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "XSS scriptresx.ashx Vulnerability."

Product-sharepoint_foundation office_web_apps sharepoint_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-4040

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-16.60% / 94.78%

7 Day CHG~0.00%

Published-27 Jul, 2007 | 22:00

Updated-03 Apr, 2025 | 15:15

Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670.

Product-outlook outlook_express n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1896

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-10.20% / 92.99%

7 Day CHG~0.00%

Published-12 Oct, 2011 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "ExcelTable Reflected XSS Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-3760

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.36% / 79.94%

7 Day CHG~0.00%

Published-27 Sep, 2007 | 22:00

Updated-07 Aug, 2024 | 14:28

Cross-site scripting (XSS) vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to inject arbitrary web script or HTML via frame tags.

Product-iphone_os windows_vista safari windows_xp mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-2005

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.75% / 72.78%

7 Day CHG~0.00%

Published-02 May, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Insight Management Agents before 9.0.0.0 on Windows Server 2003 and 2008 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-windows_server_2008 windows_server_2003 windows_2003_server insight_management_agents n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1263

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-35.65% / 96.98%

7 Day CHG~0.00%

Published-10 Aug, 2011 | 21:16

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the logon page in Remote Desktop Web Access (RD Web Access) in Microsoft Windows Server 2008 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via the URI, aka "Remote Desktop Web Access Vulnerability."

Product-windows_server_2008 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-3482

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.30% / 53.29%

7 Day CHG~0.00%

Published-28 Jun, 2007 | 18:00

Updated-07 Aug, 2024 | 14:21

Cross-domain vulnerability in Apple Safari for Windows 3.0.1 allows remote attackers to bypass the "same origin policy" and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute.

Product-safari windows_nt n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-1890

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-34.59% / 96.91%

7 Day CHG~0.00%

Published-15 Sep, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in EditForm.aspx in Microsoft Office SharePoint Server 2010 and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via a post, aka "Editform Script Injection Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0767

Matching Score-6

Matching Score-6

Vendor-n/a Apple Inc.Adobe Inc.Linux Kernel Organization, Inc Oracle Corporation Google LLC Microsoft Corporation

CVSS Score-6.1||MEDIUM

EPSS-16.27% / 94.68%

7 Day CHG~0.00%

Published-16 Feb, 2012 | 19:00

Updated-22 Oct, 2025 | 01:15

Known KEV||Action Due Date - 2022-06-22||The impacted product is end-of-life and should be disconnected if still in use.

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

Product-mac_os_x flash_player windows linux_kernel solaris android n/a Flash Player

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-44201

Matching Score-6

Assigner-Acronis International GmbH

Vendor-Acronis (Acronis International GmbH)Linux Kernel Organization, Inc Microsoft Corporation

Matching Score-6

Assigner-Acronis International GmbH

CVSS Score-6.1||MEDIUM

EPSS-0.32% / 54.34%

7 Day CHG~0.00%

Published-29 Nov, 2021 | 18:18

Updated-17 Sep, 2024 | 01:36

Cross-site scripting (XSS) was possible in notification pop-ups

Cross-site scripting (XSS) was possible in notification pop-ups. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 28035

Product-cyber_protect windows linux_kernel Acronis Cyber Protect 15

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-3033

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-58.15% / 98.14%

7 Day CHG~0.00%

Published-14 Aug, 2007 | 22:00

Updated-07 Aug, 2024 | 13:57

Cross-site scripting (XSS) vulnerability in Windows Vista Feed Headlines Gadget (aka Sidebar RSS Feeds Gadget) in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zone.

Product-windows_vista n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0604

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-1.29% / 79.35%

7 Day CHG~0.00%

Published-10 Feb, 2011 | 17:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-0587.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-2400

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.46% / 63.56%

7 Day CHG~0.00%

Published-25 Jun, 2007 | 19:00

Updated-07 Aug, 2024 | 13:33

Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.

Product-iphone_os windows_vista safari windows_xp mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2012-0287

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-2.6||LOW

EPSS-0.60% / 69.09%

7 Day CHG~0.00%

Published-06 Jan, 2012 | 02:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.

Vendor-n/a WordPress.org Microsoft Corporation

Product-wordpress internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0145

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-35.92% / 96.99%

7 Day CHG~0.00%

Published-14 Feb, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in wizardlist.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in wizardlist.aspx Vulnerability."

Product-sharepoint_server sharepoint_foundation n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-4776

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.03%

7 Day CHG~0.00%

Published-16 Dec, 2011 | 11:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other files.

Vendor-n/a Parallels International Gmbh Microsoft Corporation

Product-windows_server_2008 parallels_plesk_panel windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0242

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.20% / 41.87%

7 Day CHG~0.00%

Published-21 Jul, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via vectors involving a URL that contains a username.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-37527

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.07% / 21.61%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 15:49

Updated-11 Mar, 2025 | 18:14

IBM OpenPages with Watson cross-site scripting

IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

Product-openpages_with_watson linux_kernel windows OpenPages with Watson

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0587

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-1.39% / 80.12%

7 Day CHG~0.00%

Published-10 Feb, 2011 | 17:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-54138

Matching Score-6

Assigner-GitHub, Inc.

Matching Score-6

Assigner-GitHub, Inc.

CVSS Score-6.9||MEDIUM

EPSS-0.55% / 67.80%

7 Day CHG~0.00%

Published-06 Dec, 2024 | 21:56

Updated-05 Sep, 2025 | 15:48

XSS Vulnerability in NuGetGallery's Markdown Autolinks Processing

NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. This vulnerability is fixed in 2024.12.06.

Vendor-NuGet nuget Microsoft Corporation

Product-nugetgallery NuGetGallery nugetgallery

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-35753

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.00%

7 Day CHG~0.00%

Published-22 Jan, 2021 | 03:40

Updated-04 Aug, 2024 | 17:09

The job posting recommendation form in Persis Human Resource Management Portal (Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20), when the "Recommend job posting" function is enabled, allows XSS via the SENDER parameter.

Vendor-persis n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-human_resource_management_portal windows linux_kernel n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-1005

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-1.10% / 77.77%

7 Day CHG~0.00%

Published-12 Apr, 2018 | 01:00

Updated-05 Aug, 2024 | 03:44

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint. This CVE ID is unique from CVE-2018-1014, CVE-2018-1032, CVE-2018-1034.

Vendor-Microsoft Corporation

Product-sharepoint_enterprise_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-0220

Matching Score-6

Matching Score-6

CVSS Score-6.8||MEDIUM

EPSS-43.67% / 97.45%

7 Day CHG~0.00%

Published-08 May, 2007 | 23:00

Updated-07 Aug, 2024 | 12:12

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-0096

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-59.20% / 98.19%

7 Day CHG~0.00%

Published-31 Jan, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."