ByteOS

Microsoft Dynamics 365 (on-premises) version 9.0

Product

Platforms

Unknown

Versions

Affected

From 9.0.0 before 9.0.47.08 (custom)

Vendor

Microsoft Dynamics 365 (on-premises) version 9.1

Product

Platforms

Unknown

Versions

Affected

From 9.0 before 9.1.18.22 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C

Version: 3.1

Base score: 8.2

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C

References

Hyperlink	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35335	vendor-advisory

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35335

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35335	vendor-advisory x_transferred

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35335

Resource:

vendor-advisory

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:11 Jul, 2023 | 18:15

Updated At:29 May, 2024 | 03:15

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Type: Primary

Version: 3.1

Base score: 8.2

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

CPE Matches

cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:on-premises:*:*:*

>>dynamics_365>>Versions from 9.0(inclusive) to 9.0.47.08(exclusive)

cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:on-premises:*:*:*

>>dynamics_365>>Versions from 9.1(inclusive) to 9.1.18.22(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-79	Secondary	secure@microsoft.com

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-79

Type: Secondary

Source: secure@microsoft.com

References

Hyperlink	Source	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35335	secure@microsoft.com	Patch Vendor Advisory

Hyperlink: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35335

Source: secure@microsoft.com

Resource:

Patch

Vendor Advisory

Similar CVEs

780Records found

CVE-2023-4973

Matching Score-6

Assigner-VulDB

Matching Score-6

Assigner-VulDB

CVSS Score-3.5||LOW

EPSS-5.01% / 89.52%

7 Day CHG~0.00%

Published-15 Sep, 2023 | 02:00

Updated-02 Aug, 2024 | 07:44

Academy LMS GET Parameter filter cross site scripting

A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument searched_word/searched_tution_class_type[]/searched_price_type[]/searched_duration[] leads to cross site scripting. The attack can be launched remotely. The identifier VDB-239749 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Vendor-Creativeitem Microsoft Corporation

Product-academy_lms windows LMS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-0912

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-9.92% / 92.88%

7 Day CHG~0.00%

Published-14 Mar, 2018 | 17:00

Updated-16 Sep, 2024 | 20:37

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0913, CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947.

Product-sharepoint_enterprise_server project_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2733

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.65%

7 Day CHG~0.00%

Published-10 Nov, 2010 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the Web Monitor in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "UAG XSS Allows EOP Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-38877

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-6.4||MEDIUM

EPSS-0.20% / 41.54%

7 Day CHG~0.00%

Published-23 Sep, 2021 | 18:05

Updated-16 Sep, 2024 | 23:21

IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208405.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix jazz_for_service_management windows linux_kernel Jazz for Service Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-38982

Matching Score-6

Assigner-IBM Corporation

Product-linux_kernel security_guardium_key_lifecycle_manager windows security_key_lifecycle_manager aix Security Key Lifecycle Manager

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.16% / 36.70%

7 Day CHG~0.00%

Published-15 Nov, 2021 | 15:35

Updated-16 Sep, 2024 | 20:52

IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212791.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-4114

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.67% / 70.96%

7 Day CHG~0.00%

Published-22 Dec, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Discovery & Dependency Mapping Inventory (DDMI) 2.5x, 7.5x, and 7.6x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-windows discovery\&dependency_mapping_inventory n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-38871

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.21% / 43.88%

7 Day CHG~0.00%

Published-24 Jun, 2022 | 16:15

Updated-17 Sep, 2024 | 02:01

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208345.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-jazz_team_server windows linux_kernel Jazz Team Server

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2429

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 50.78%

7 Day CHG~0.00%

Published-23 Jun, 2010 | 17:13

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.1.2, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer in a "404 Not Found" response.

Vendor-n/a Splunk LLC (Cisco Systems, Inc.)Microsoft Corporation

Product-splunk internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-39015

Matching Score-6

Assigner-IBM Corporation

Product-engineering_lifecycle_optimization_-_publishing engineering_lifecycle_optimization_publishing windows linux_kernel Engineering Lifecycle Optimization Publishing

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.12% / 31.29%

7 Day CHG~0.00%

Published-14 Jul, 2022 | 16:15

Updated-25 Mar, 2025 | 14:21

IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213655.

Vendor-IBM Corporation Microsoft Corporation Linux Kernel Organization, Inc

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2428

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.75% / 72.76%

7 Day CHG~0.00%

Published-23 Jun, 2010 | 17:13

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing FTP Server for Windows 3.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted POST request.

Vendor-wftpserver n/a Microsoft Corporation

Product-windows wing_ftp_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2734

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-47.88% / 97.65%

7 Day CHG~0.00%

Published-10 Nov, 2010 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the mobile portal in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS Issue on UAG Mobile Portal Website in Forefront Unified Access Gateway Vulnerability."

Product-forefront_unified_access_gateway n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2665

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.68% / 71.29%

7 Day CHG~0.00%

Published-07 Jul, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote attackers to inject arbitrary web script or HTML via a data: URI, related to incorrect detection of the "opening site."

Vendor-unix n/a Microsoft Corporation Apple Inc.Opera

Product-windows opera_browser mac_os_x unix n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-39035

Matching Score-6

Assigner-IBM Corporation

Vendor-Microsoft Corporation HP Inc.IBM Corporation Linux Kernel Organization, Inc Oracle Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.12% / 31.29%

7 Day CHG~0.00%

Published-16 Aug, 2022 | 18:45

Updated-16 Sep, 2024 | 18:38

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213965.

Product-sterling_b2b_integrator solaris linux_kernel hp-ux windows aix Sterling B2B Integrator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-35266

Matching Score-6

Matching Score-6

CVSS Score-7.6||HIGH

EPSS-0.36% / 57.96%

7 Day CHG~0.00%

Published-09 Jul, 2024 | 17:02

Updated-09 Dec, 2025 | 23:46

Azure DevOps Server Spoofing Vulnerability

Product-Azure DevOps Server 2022

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2085

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-11.86% / 93.58%

7 Day CHG~0.00%

Published-27 May, 2010 | 18:32

Updated-11 Apr, 2025 | 00:51

The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the __VIEWSTATE parameter.

Product-.net_framework n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2265

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-24.81% / 96.03%

7 Day CHG~0.00%

Published-14 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the GetServerName function in sysinfo/commonFunc.js in Microsoft Windows Help and Support Center for Windows XP and Windows Server 2003 allows remote attackers to inject arbitrary web script or HTML via the svr parameter to sysinfo/sysinfomain.htm. NOTE: this can be leveraged with CVE-2010-1885 to execute arbitrary commands without user interaction.

Product-windows_server_2003 windows_xp windows_2003_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-0916

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-9.92% / 92.88%

7 Day CHG~0.00%

Published-14 Mar, 2018 | 17:00

Updated-16 Sep, 2024 | 22:14

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913 CVE-2018-0914, CVE-2018-0915, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947.

Product-sharepoint_enterprise_server project_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-36946

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-1.02% / 76.88%

7 Day CHG~0.00%

Published-12 Aug, 2021 | 18:12

Updated-04 Aug, 2024 | 01:09

Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

Product-dynamics_365_business_central dynamics_nav Dynamics 365 Business Central Spring 2019 Update Microsoft Dynamics NAV 2017 Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.15 Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.9 Microsoft Dynamics NAV 2018

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-36950

Matching Score-6

Matching Score-6

CVSS Score-5.4||MEDIUM

EPSS-1.00% / 76.67%

7 Day CHG~0.00%

Published-12 Aug, 2021 | 18:12

Updated-04 Aug, 2024 | 01:09

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Product-dynamics_365 Microsoft Dynamics 365 (on-premises) version 9.0

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2004-2704

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-25.15% / 96.06%

7 Day CHG~0.00%

Published-06 Oct, 2007 | 21:00

Updated-03 Apr, 2025 | 01:03

Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition field for attachments, which causes the attachment to be rendered inline by Internet Explorer when the victim clicks the download link, which facilitates cross-site scripting (XSS) and possibly other attacks.

Vendor-hastymail n/a Microsoft Corporation

Product-hastymail internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-0923

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-9.92% / 92.88%

7 Day CHG~0.00%

Published-14 Mar, 2018 | 17:00

Updated-16 Sep, 2024 | 22:14

Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913 CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0944 and CVE-2018-0947.

Product-sharepoint_enterprise_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-0914

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-9.92% / 92.88%

7 Day CHG~0.00%

Published-14 Mar, 2018 | 17:00

Updated-17 Sep, 2024 | 02:27

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0910. CVE-2018-0911, CVE-2018-0912, CVE-2018-0913, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947.

Product-sharepoint_enterprise_server project_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2091

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-4.46% / 88.85%

7 Day CHG~0.00%

Published-27 May, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.

Product-windows_server_2003 exchange_server internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-35240

Matching Score-6

Assigner-SolarWinds

Matching Score-6

Assigner-SolarWinds

CVSS Score-6.5||MEDIUM

EPSS-0.46% / 63.64%

7 Day CHG~0.00%

Published-31 Aug, 2021 | 15:57

Updated-04 Aug, 2024 | 00:33

Stored XSS via Help Server settings

A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'.

Vendor-SolarWinds Worldwide, LLC.Microsoft Corporation

Product-internet_explorer orion_platform Orion Platform

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-0910

Matching Score-6

Matching Score-6

CVSS Score-8.8||HIGH

EPSS-9.92% / 92.88%

7 Day CHG~0.00%

Published-14 Mar, 2018 | 17:00

Updated-17 Sep, 2024 | 01:15

Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0909, CVE-2018-0911, CVE-2018-0912, CVE-2018-0913, CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0921, CVE-2018-0923, CVE-2018-0944 and CVE-2018-0947.

Product-sharepoint_enterprise_server project_server Microsoft SharePoint

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2088

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-11.86% / 93.58%

7 Day CHG~0.00%

Published-27 May, 2010 | 18:32

Updated-11 Apr, 2025 | 00:51

ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form control via the __VIEWSTATE parameter.

Product-asp.net n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-35222

Matching Score-6

Assigner-SolarWinds

Matching Score-6

Assigner-SolarWinds

CVSS Score-8||HIGH

EPSS-1.03% / 77.06%

7 Day CHG~0.00%

Published-31 Aug, 2021 | 12:14

Updated-04 Aug, 2024 | 00:33

Resource.aspx Reflected Cross-Site Scripting Vulnerability

This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.

Vendor-SolarWinds Worldwide, LLC.Microsoft Corporation

Product-windows orion_platform Orion Platform

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-2084

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-6.40% / 90.83%

7 Day CHG~0.00%

Published-27 May, 2010 | 18:32

Updated-11 Apr, 2025 | 00:51

Microsoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to an attribute.

Product-asp.net n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-64675

Matching Score-6

Matching Score-6

CVSS Score-8.3||HIGH

EPSS-0.05% / 15.34%

7 Day CHG+0.01%

Published-18 Dec, 2025 | 23:15

Updated-20 Feb, 2026 | 15:59

Azure Cosmos DB Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to perform spoofing over a network.

Product-azure_cosmos_db Azure Cosmos DB

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1372

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.59% / 68.88%

7 Day CHG~0.00%

Published-17 Oct, 2007 | 01:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in links.php script in myPHPNuke 1.8.8, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the (1) ratenum or (2) query parameters.

Vendor-myphpnuke unix n/a Linux Kernel Organization, Inc Microsoft Corporation

Product-linux_kernel all_windows myphpnuke unix n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1582

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-2.6||LOW

EPSS-4.96% / 89.46%

7 Day CHG~0.00%

Published-05 Feb, 2010 | 22:13

Updated-11 Apr, 2025 | 00:51

Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response, as demonstrated by injecting XSS sequences, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

Product-internet_information_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62459

Matching Score-6

Matching Score-6

CVSS Score-8.3||HIGH

EPSS-0.06% / 19.86%

7 Day CHG~0.00%

Published-20 Nov, 2025 | 22:18

Updated-26 Feb, 2026 | 16:07

Microsoft Defender Portal Spoofing Vulnerability

Product-365_defender_portal Microsoft 365 Defender Portal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-0712

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-17.95% / 95.02%

7 Day CHG~0.00%

Published-17 Oct, 2003 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in the HTML encoding for the Compose New Message form in Microsoft Exchange Server 5.5 Outlook Web Access (OWA) allows remote attackers to execute arbitrary web script.

Product-exchange_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-33850

Matching Score-6

Assigner-Cyber Security Works Pvt. Ltd.

Matching Score-6

Assigner-Cyber Security Works Pvt. Ltd.

CVSS Score-5.4||MEDIUM

EPSS-0.68% / 71.24%

7 Day CHG~0.00%

Published-19 Nov, 2021 | 15:52

Updated-04 Aug, 2024 | 00:05

There is a Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3. The XSS payload executes whenever the user changes the clarity configuration in Microsoft Clarity version 0.3. The payload is stored on the configuring project Id page.

Product-clarity Microsoft Clarity

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1257

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-36.86% / 97.06%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.

Product-sharepoint_services windows_7 sharepoint_server windows_xp office_infopath windows_server_2008 windows_2003_server windows_vista internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-62210

Matching Score-6

Matching Score-6

CVSS Score-8.7||HIGH

EPSS-0.07% / 20.55%

7 Day CHG~0.00%

Published-11 Nov, 2025 | 17:59

Updated-26 Feb, 2026 | 16:57

Dynamics 365 Field Service (online) Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

Product-dynamics_365 Dynamics 365 Field Service (online)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2002-1700

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-16.34% / 94.71%

7 Day CHG~0.00%

Published-21 Jun, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.

Vendor-n/a Macromedia, Inc.Microsoft Corporation

Product-internet_information_services coldfusion windows_2000 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-47707

Matching Score-6

Assigner-IBM Corporation

Matching Score-6

Assigner-IBM Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.09% / 25.60%

7 Day CHG~0.00%

Published-20 Dec, 2023 | 01:48

Updated-02 Aug, 2024 | 21:16

IBM Security Guardium Key Lifecycle Manager cross-site scripting

IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 271522.

Vendor-IBM Corporation Linux Kernel Organization, Inc Microsoft Corporation

Product-aix security_guardium_key_lifecycle_manager windows linux_kernel Security Guardium Key Lifecycle Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1390

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.17% / 78.37%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors related to improper UTF-7 canonicalization, and lack of termination of a quoted string in an HTML document.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1969

Matching Score-6

Assigner-HP Inc.

Matching Score-6

Assigner-HP Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.65% / 70.33%

7 Day CHG~0.00%

Published-22 Jul, 2010 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in HP Virtual Connect Enterprise Manager for Windows before 6.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

Vendor-n/a HP Inc.Microsoft Corporation

Product-windows virtual_connect_enterprise_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1762

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.89% / 75.15%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1420

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.18% / 39.93%

7 Day CHG~0.00%

Published-21 Jul, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in CFNetwork in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted text/plain file.

Product-windows_7 cfnetwork windows_xp windows_vista safari n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1389

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.98% / 76.50%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) paste or (2) drag-and-drop operation for a selection.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-30048

Matching Score-6

Matching Score-6

CVSS Score-7.6||HIGH

EPSS-0.67% / 71.05%

7 Day CHG~0.00%

Published-14 May, 2024 | 16:57

Updated-03 May, 2025 | 00:06

Dynamics 365 Customer Insights Spoofing Vulnerability

Product-dynamics_365_customer_insights Dynamics 365

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1778

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.20% / 41.87%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via an RSS feed.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1418

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.17% / 78.40%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via a FRAME element with a SRC attribute composed of a javascript: sequence preceded by spaces.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-29049

Matching Score-6

Matching Score-6

CVSS Score-4.1||MEDIUM

EPSS-0.53% / 66.95%

7 Day CHG~0.00%

Published-04 Apr, 2024 | 21:47

Updated-03 May, 2025 | 00:40

Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability

Product-edge_chromium Microsoft Edge (Chromium-based) Extended Stable Microsoft Edge (Chromium-based)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1394

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.17% / 78.37%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1489

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-22.05% / 95.66%

7 Day CHG~0.00%

Published-20 Apr, 2010 | 16:00

Updated-11 Apr, 2025 | 00:51

The XSS Filter in Microsoft Internet Explorer 8 does not properly perform neutering for the SCRIPT tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities, a different issue than CVE-2009-4074.

Product-internet_explorer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2010-1395

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.17% / 78.37%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving DOM constructor objects, related to a "scope management issue."