ByteOS

Microsoft Dynamics 365 (on-premises) version 9.1

Product

Platforms

Unknown

Versions

Affected

From 9.0 before 9.1.16.20 (custom)

Vendor

Microsoft Dynamics 365 (on-premises) version 9.0

Product

Platforms

Unknown

Versions

Affected

From 9.0.0 before 9.0.45.11 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C

References

Hyperlink	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807	vendor-advisory

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807	vendor-advisory x_transferred

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807

Resource:

vendor-advisory

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:14 Feb, 2023 | 20:15

Updated At:29 May, 2024 | 03:15

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Secondary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Type: Primary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

CPE Matches

cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:on-premises:*:*:*

>>dynamics_365>>Versions between 9.0(exclusive) and 9.0.45.11(exclusive)

cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:on-premises:*:*:*

>>dynamics_365>>Versions from 9.1(inclusive) to 9.1.16.20(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-79	Secondary	secure@microsoft.com

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-79

Type: Secondary

Source: secure@microsoft.com

References

Hyperlink	Source	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

698Records found

CVE-2017-12544

Matching Score-6

Assigner-Hewlett Packard Enterprise (HPE)

Vendor-Microsoft Corporation Hewlett Packard Enterprise (HPE)HP Inc.Linux Kernel Organization, Inc

Matching Score-6

Assigner-Hewlett Packard Enterprise (HPE)

CVSS Score-5.4||MEDIUM

EPSS-59.94% / 98.24%

7 Day CHG~0.00%

Published-15 Feb, 2018 | 22:00

Updated-17 Sep, 2024 | 02:47

A cross-site scripting vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found.

Product-windows system_management_homepage linux_kernel System Management Homepage for Windows and Linux

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-34362

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-4.6||MEDIUM

EPSS-0.38% / 58.97%

7 Day CHG~0.00%

Published-08 Feb, 2023 | 18:30

Updated-24 Mar, 2025 | 20:49

IBM Sterling Secure Proxy HOST header injection

IBM Sterling Secure Proxy 6.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 230523.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-linux_kernel sterling_secure_proxy linux_on_ibm_z windows aix Sterling Secure Proxy

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-4020

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-31.30% / 96.69%

7 Day CHG~0.00%

Published-15 Oct, 2008 | 00:00

Updated-07 Aug, 2024 | 10:00

Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a document that contains a "Content-Disposition: attachment" header and is accessed through a cdo: URL, which renders the content instead of raising a File Download dialog box, aka "Vulnerability in Content-Disposition Header Vulnerability."

Product-office n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-11775

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-0.85% / 74.76%

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka "Microsoft Office SharePoint XSS Vulnerability". This CVE ID is unique from CVE-2017-11777 and CVE-2017-11820.

Product-sharepoint_enterprise_server Microsoft SharePoint Enterprise Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-3843

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-11.67% / 93.56%

7 Day CHG~0.00%

Published-27 Aug, 2008 | 20:00

Updated-07 Aug, 2024 | 09:53

Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detect dangerous client input, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a query string containing a "<~/" (less-than tilde slash) sequence followed by a crafted STYLE element.

Product-windows_vista windows-nt windows_xp .net_framework windows_2000 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-34336

Matching Score-6

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.53% / 66.95%

7 Day CHG~0.00%

Published-13 Sep, 2022 | 20:45

Updated-17 Sep, 2024 | 02:52

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229714.

Product-solaris linux_kernel websphere_application_server i hp-ux windows z\/os aix WebSphere Application Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-3023

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-23.63% / 95.90%

7 Day CHG~0.00%

Published-07 Jul, 2008 | 17:00

Updated-07 Aug, 2024 | 09:21

Cross-site scripting (XSS) vulnerability in FreeStyle Wiki 3.6.2 and earlier, and 3.6.3 dev3 and earlier development versions, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2005-1799.

Vendor-fswiki n/a Microsoft Corporation

Product-internet_explorer freestyle_wiki n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-2248

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-24.34% / 96.01%

7 Day CHG~0.00%

Published-08 Jul, 2008 | 23:00

Updated-07 Aug, 2024 | 08:58

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified HTML, a different vulnerability than CVE-2008-2247.

Product-exchange_server outlook_web_access n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0195

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-0.96% / 76.27%

7 Day CHG~0.00%

Published-12 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server 2013 SP1 and Office Online Server allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka "Microsoft Office XSS Elevation of Privilege Vulnerability."

Product-sharepoint_server excel_web_app office_web_apps office_online_server office_web_apps_server Office

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0110

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-1.21% / 78.79%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability."

Product-exchange_server Exchange Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-0712

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-17.95% / 95.05%

7 Day CHG~0.00%

Published-17 Oct, 2003 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access (OWA) allows remote attackers to execute arbitrary web script.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-34009

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.5||MEDIUM

EPSS-0.26% / 49.30%

7 Day CHG~0.00%

Published-27 Jul, 2022 | 23:23

Updated-03 Aug, 2024 | 08:16

Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. This occurs because the ticket data is stored in a temporary file, and the product does not properly handle the absence of this file after Windows Defender has flagged it as malware.

Vendor-fossil-scm n/a Microsoft Corporation

Product-windows fossil n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0255

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-1.35% / 79.95%

7 Day CHG+0.19%

Published-12 May, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Microsoft SharePoint Foundation 2013 SP1 allows an elevation of privilege vulnerability when it does not properly sanitize a specially crafted web request, aka "Microsoft SharePoint XSS Vulnerability".

Product-sharepoint_foundation Microsoft Office

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-2163

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.43% / 62.13%

7 Day CHG~0.00%

Published-13 May, 2008 | 17:00

Updated-07 Aug, 2024 | 08:49

Cross-site scripting (XSS) vulnerability in IBM Lotus Quickr 8.1 before Hotfix 5 for Windows and AIX, and before Hotfix 3 for i5/OS, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to "WYSIWYG editors."

Vendor-n/a Microsoft Corporation IBM Corporation

Product-aix lotus_quickr windows_nt i5os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-34330

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.37% / 58.68%

7 Day CHG~0.00%

Published-04 Jan, 2023 | 17:07

Updated-10 Apr, 2025 | 13:57

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229469.

Vendor-Linux Kernel Organization, Inc IBM Corporation Microsoft Corporation

Product-sterling_b2b_integrator aix windows linux_kernel Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-11777

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-0.85% / 74.76%

7 Day CHG~0.00%

Published-13 Oct, 2017 | 13:00

Updated-20 Apr, 2025 | 01:37

Product-sharepoint_enterprise_server Microsoft SharePoint Enterprise Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-2247

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-23.23% / 95.86%

7 Day CHG~0.00%

Published-08 Jul, 2008 | 23:00

Updated-07 Aug, 2024 | 08:58

Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) for Exchange Server 2003 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified e-mail fields, a different vulnerability than CVE-2008-2248.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1888

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-24.96% / 96.08%

7 Day CHG~0.00%

Published-18 Apr, 2008 | 21:00

Updated-07 Aug, 2024 | 08:40

Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 2.0 allows remote attackers to inject arbitrary web script or HTML via the Picture Source (aka picture object source) field in the Rich Text Editor.

Product-sharepoint_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7280

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-7.61% / 91.74%

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7206.

Product-edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1873

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.92%

7 Day CHG~0.00%

Published-17 Apr, 2008 | 17:00

Updated-07 Aug, 2024 | 08:40

Cross-site scripting (XSS) vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje parameter. NOTE: some of these details are obtained from third party information.

Vendor-tru-zone n/a Microsoft Corporation

Product-nukeet internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7891

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-0.92% / 75.81%

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripting attacks.

Vendor-n/a Microsoft Corporation Adobe Inc.

Product-robohelp windows Adobe RoboHelp 2015.0.3 and earlier, RoboHelp 11 and earlier

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0017

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-1.89% / 82.97%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0065, and CVE-2017-0068.

Product-edge Edge

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2017-0107

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-2.32% / 84.58%

7 Day CHG~0.00%

Published-17 Mar, 2017 | 00:00

Updated-20 Apr, 2025 | 01:37

Microsoft SharePoint Server fails to sanitize crafted web requests, allowing remote attackers to run cross-script in local security context, aka "Microsoft SharePoint XSS Vulnerability."

Product-sharepoint_foundation SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7206

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-3.78% / 87.88%

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Product-edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0751

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.50% / 65.52%

7 Day CHG~0.00%

Published-13 Feb, 2008 | 19:00

Updated-07 Aug, 2024 | 07:54

Cross-site scripting (XSS) vulnerability in the Freetag before 2.96 plugin for S9Y Serendipity, when using Internet Explorer 6 or 7, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to plugin/tag/.

Vendor-s9y n/a Microsoft Corporation

Product-serendipity_event_freetag internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-1001

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.40% / 60.53%

7 Day CHG~0.00%

Published-19 Mar, 2008 | 00:00

Updated-07 Aug, 2024 | 08:08

Cross-site scripting (XSS) vulnerability in Apple Safari before 3.1, when running on Windows XP or Vista, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is not properly handled in the error page.

Vendor-n/a Apple Inc.Microsoft Corporation

Product-safari windows_xp windows_vista n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-38709

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.37% / 58.68%

7 Day CHG~0.00%

Published-06 Oct, 2022 | 17:15

Updated-17 Sep, 2024 | 04:13

IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 234291.

Vendor-Microsoft Corporation IBM Corporation

Product-windows robotic_process_automation_for_cloud_pak Robotic Process Automation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2004-0203

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-25.67% / 96.16%

7 Day CHG~0.00%

Published-12 Aug, 2004 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in Outlook Web Access for Exchange Server 5.5 Service Pack 4 allows remote attackers to insert arbitrary script and spoof content in HTML email or web caches via an HTML redirect query.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-6154

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.21% / 43.70%

7 Day CHG~0.00%

Published-23 Aug, 2019 | 21:06

Updated-06 Aug, 2024 | 01:22

The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).

Vendor-n/a WatchGuard Technologies, Inc.Microsoft Corporation

Product-windows fireware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

CVE-2003-1467

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.79% / 73.72%

7 Day CHG~0.00%

Published-24 Oct, 2007 | 23:00

Updated-03 Apr, 2025 | 01:03

Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

Vendor-unix phorum n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel all_windows unix phorum n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2008-0460

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-15.66% / 94.60%

7 Day CHG~0.00%

Published-25 Jan, 2008 | 15:00

Updated-07 Aug, 2024 | 07:46

Cross-site scripting (XSS) vulnerability in api.php in (1) MediaWiki 1.11 through 1.11.0rc1, 1.10 through 1.10.2, 1.9 through 1.9.4, and 1.8; and (2) the BotQuery extension for MediaWiki 1.7 and earlier; when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Wikimedia Foundation Microsoft Corporation

Product-mediawiki_botquery_ext internet_explorer mediawiki n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-8577

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 16.04%

7 Day CHG~0.00%

Published-07 Aug, 2025 | 01:30

Updated-08 Aug, 2025 | 18:24

Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2002-1700

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-16.34% / 94.75%

7 Day CHG~0.00%

Published-21 Jun, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.

Vendor-n/a Macromedia, Inc.Microsoft Corporation

Product-internet_information_services coldfusion windows_2000 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-8579

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 16.04%

7 Day CHG~0.00%

Published-07 Aug, 2025 | 01:30

Updated-08 Aug, 2025 | 18:24

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-8581

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.25%

7 Day CHG~0.00%

Published-07 Aug, 2025 | 01:30

Updated-08 Aug, 2025 | 18:24

Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-8580

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 16.04%

7 Day CHG~0.00%

Published-07 Aug, 2025 | 01:30

Updated-08 Aug, 2025 | 18:24

Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Vendor-Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Google LLC

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7282

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-5.20% / 89.78%

7 Day CHG~0.00%

Published-20 Dec, 2016 | 05:54

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."

Product-internet_explorer edge n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0765

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-1.63% / 81.70%

7 Day CHG~0.00%

Published-15 Feb, 2012 | 01:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in Adobe RoboHelp 8 and 9 for Word allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to certain .htm files in (1) template_stock and (2) template_csh directories.

Vendor-n/a Adobe Inc.Microsoft Corporation

Product-windows word robohelp n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7251

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-7.63% / 91.75%

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."

Product-sql_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-69268

Matching Score-6

Matching Score-6

CVSS Score-5.3||MEDIUM

EPSS-0.03% / 10.11%

7 Day CHG~0.00%

Published-12 Jan, 2026 | 03:59

Updated-14 Jan, 2026 | 18:03

Spectrum reflected XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Reflected XSS.This issue affects DX NetOps Spectrum: 24.3.8 and earlier.

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Broadcom Inc.

Product-linux_kernel windows dx_netops_spectrum DX NetOps Spectrum

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-7239

Matching Score-6

Matching Score-6

CVSS Score-3.1||LOW

EPSS-13.53% / 94.11%

7 Day CHG~0.00%

Published-10 Nov, 2016 | 06:16

Updated-12 Apr, 2025 | 10:46

The RegEx class in the XSS filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability."

Product-internet_explorer edge n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-32024

Matching Score-6

Matching Score-6

CVSS Score-3||LOW

EPSS-0.28% / 51.31%

7 Day CHG~0.00%

Published-14 Jun, 2023 | 14:52

Updated-28 Feb, 2025 | 20:02

Microsoft Power Apps Spoofing Vulnerability

Product-power_apps Microsoft Power Apps

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-2078

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.18% / 39.92%

7 Day CHG~0.00%

Published-08 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Windows allows remote attackers to inject arbitrary web script or HTML via the flashvars parameter.

Vendor-n/a VMware (Broadcom Inc.)Microsoft Corporation

Product-windows vcenter_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-69275

Matching Score-6

Matching Score-6

CVSS Score-7.1||HIGH

EPSS-0.03% / 10.11%

7 Day CHG~0.00%

Published-12 Jan, 2026 | 04:47

Updated-14 Jan, 2026 | 16:47

Spectrum outdated java library in class-path

Dependency on Vulnerable Third-Party Component vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows DOM-Based XSS.This issue affects DX NetOps Spectrum: 24.3.9 and earlier.

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Broadcom Inc.

Product-linux_kernel windows dx_netops_spectrum DX NetOps Spectrum

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-1395

Dependency on Vulnerable Third-Party Component

CVE-2016-3379

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-7.63% / 91.75%

7 Day CHG~0.00%

Published-14 Sep, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a meeting-invitation request, aka "Microsoft Exchange Elevation of Privilege Vulnerability."

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-31663

Matching Score-6

Assigner-VMware by Broadcom

Product-access_connector linux_kernel identity_manager_connector one_access windows identity_manager VMware Workspace ONE Access, Identity Manager and vRealize Automation

Matching Score-6

Assigner-VMware by Broadcom

CVSS Score-6.1||MEDIUM

EPSS-1.18% / 78.60%

7 Day CHG~0.00%

Published-05 Aug, 2022 | 15:06

Updated-03 Aug, 2024 | 07:26

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.

Vendor-n/a Linux Kernel Organization, Inc VMware (Broadcom Inc.)Microsoft Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2016-3212

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-22.39% / 95.73%

7 Day CHG~0.00%

Published-16 Jun, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, aka "Internet Explorer XSS Filter Vulnerability."

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-67709

Matching Score-6

Assigner-Environmental Systems Research Institute, Inc.

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Environmental Systems Research Institute, Inc. ("Esri")

Matching Score-6

Assigner-Environmental Systems Research Institute, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.05% / 14.49%

7 Day CHG~0.00%

Published-31 Dec, 2025 | 22:17

Updated-06 Jan, 2026 | 19:04

There is a cross site scripting issue in ArcGIS Server.

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

Product-linux_kernel windows arcgis_server ArcGIS Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-67704

Matching Score-6

Assigner-Environmental Systems Research Institute, Inc.

Vendor-Microsoft Corporation Linux Kernel Organization, Inc Environmental Systems Research Institute, Inc. ("Esri")

Matching Score-6

Assigner-Environmental Systems Research Institute, Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.05% / 14.49%

7 Day CHG~0.00%

Published-31 Dec, 2025 | 22:14

Updated-06 Jan, 2026 | 19:14

Stored XSS vulnerability in ArcGIS Server.

Product-linux_kernel windows arcgis_server ArcGIS Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-67703

Matching Score-6

Assigner-Environmental Systems Research Institute, Inc.